Skip to content

asmith-1/chronicle-intel-bridge

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

24 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

CrowdStrike to Chronicle Intel Bridge

Python Lint Container Build on Quay

CrowdStrike to Chronicle Intel Bridge forwards CrowdStrike Falcon Intelligence Indicators to Chronicle.

Deployment Instructions

  • Create new API key pair at CrowdStrike Falcon. This key pair will be used to read falcon events and supplementary information from CrowdStrike Falcon.

    Make sure only the following permissions are assigned to the key pair:

    • Indicators (Falcon Intelligence): READ
  • Obtain Chronicle Service Account file. Your Chronicle Support representative will provide you Chronicle Customer ID and Service Account JSON file.

  • Run the bridge application

    docker run -it --rm \
           -e FALCON_CLIENT_ID="$FALCON_CLIENT_ID" \
           -e FALCON_CLIENT_SECRET="$FALCON_CLIENT_SECRET" \
           -e FALCON_CLOUD="$FALCON_CLOUD" \
           -e CHRONICLE_CUSTOMER_ID="$CHRONICLE_CUSTOMER_ID" \
           -e GOOGLE_APPLICATION_CREDENTIALS=/gcloud/sa.json \
           -v ~/my/path/to/service/account/file/sa.json:/gcloud/ \
           quay.io/crowdstrike/chronicle-intel-bridge:latest
    

Advanced Configuration

  • Consult configuration file template for available configuration options:
  • Modify template to suite your needs
  • Mount configuration file to the container
        -v config.ini:/ccib/config.ini
    

Developer instructions

  • Build container
    docker build . -t ccib:latest
    
  • Run the Bridge
    docker run -it --rm \
           -e FALCON_CLIENT_ID="$FALCON_CLIENT_ID" \
           -e FALCON_CLIENT_SECRET="$FALCON_CLIENT_SECRET" \
           -e FALCON_CLOUD="$FALCON_CLOUD" \
           -e CHRONICLE_CUSTOMER_ID="$CHRONICLE_CUSTOMER_ID" \
           -e GOOGLE_APPLICATION_CREDENTIALS=/gcloud/sa.json \
           -v ~/my/path/to/service/account/file/sa.json:/gcloud/ \
           ccib:latest
    

Statement of Support

Chronicle Intel Bridge is an open source project, not CrowdStrike product. As such it carries no formal support, expressed or implied.

About

CrowdStrike to Chronicle Intel Bridge

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Python 97.5%
  • Dockerfile 2.5%