06-23-2022 07:36 AM
Hi there, I hope to find some help here.
We are facing issues to make the CrowdStrike Falcon mirroring options work. @
We are following the instruction provided in the documentation https://xsoar.pan.dev/docs/reference/integrations/crowdstrike-falcon
Here is how our integration is set:
1. Set a classifier (the system classifier "CrowdStrike Falcon Incident Classifier")
2. Set an incident type (a custom one)
3. Set an incoming mapper (custom mapper but based on the System mapper "CrowdStrike Falcon Mapper", The custom has just a few more fields than the original one)
4. Set an outgoing mapper (the system one "CrowdStrike Mapper - outgoing Mapper")
5. Set Server URL + client ID + secret
6. Set First fecth timestamp and max indicent per fetch (15)
7. Enable Fetches incidents.
8. In the Fetch types integration parameter, we selected to mirror Detections.
9. In the Mirroring Direction integration parameter, we selected Incoming And Outgoing
10. We checked the Close Mirrored XSOAR Incident integration parameter
11. We checked the Close Mirrored CrowdStrike Falcon Incident or Detection integration parameter
12. Set Incident Fecth Interval each 1 minuteSo far, the CrowdStrike detections are correctly imported as incidents in XSOAR but if a detection is subsequently closed in CrowdStrike, it is not reflected in the XSOAR incident in any way. And if we close the incident in XSOAR, it is not reflected in the detection in CrowdStrike.
Could someone here help me? Thank you a lot.
