CrowdStrike Orchestrator Configuration

ydamas commented 7 years ago

I have the orchestrator installed on Windows 2012R2. I followed the documentation provided and for some reason, it is not pulling any data. Please help.

mr-burnse commented 7 years ago

Is there anything in the RunLog output located at C:\Program Files (x86)\Falcon Orchestrator\RunLog.txt ? If the client service is throwing some sort of error we should see it in this file. Also, ensure that you hit the refresh button on the top right of the navigation bar to populate any new alerts in the Orchestrator UI.

ydamas commented 7 years ago

Hi, Evan, thank you for the quick response. Below are the RunLog and I am not what's missing from the config. Thanks the help,

2017-09-26 21:00:05,448 FATAL FalconOrchestrator.Client.Authentication - Error while authenticating to API System.Net.WebException: The remote server returned an error: (401) Unauthorized. at System.Net.HttpWebRequest.GetResponse() at FalconOrchestrator.Client.Authentication.AuthenticateAndGetResponse() 2017-09-26 21:00:05,479 FATAL FalconOrchestrator.Client.FalconOrchestratorService - An unhandled error occured System.Net.WebException: The remote server returned an error: (401) Unauthorized. at System.Net.HttpWebRequest.GetResponse() at FalconOrchestrator.Client.Authentication.AuthenticateAndGetResponse() at FalconOrchestrator.Client.FalconOrchestratorService.Invoke() 2017-09-26 21:14:22,577 FATAL FalconOrchestrator.Client.Authentication - Error while authenticating to API System.Net.WebException: The remote server returned an error: (401) Unauthorized. at System.Net.HttpWebRequest.GetResponse() at FalconOrchestrator.Client.Authentication.AuthenticateAndGetResponse() 2017-09-26 21:14:22,577 FATAL FalconOrchestrator.Client.FalconOrchestratorService - An unhandled error occured System.Net.WebException: The remote server returned an error: (401) Unauthorized. at System.Net.HttpWebRequest.GetResponse() at FalconOrchestrator.Client.Authentication.AuthenticateAndGetResponse() at FalconOrchestrator.Client.FalconOrchestratorService.Invoke()

mr-burnse commented 7 years ago

No problem. So a couple of things to verify in the case of Authentication errors:

Did you work with our support team to have streaming API enabled for your environment?
Is the system clock on the Orchestrator server in sync? The API uses HMAC authentication which requires an accurate current timestamp to be calculated.
The credentials you input into the Streaming API section in the configuration should be the same ones you generate from the Falcon UI.

ydamas commented 7 years ago

Hi, can you clarify what needs to be done on the time sync? We have the streaming API enabled for the environment and we are not seeing any data.

mr-burnse commented 7 years ago

Just need to ensure the system clock is accurate. Usually this is done by synchronization through an NTP server.

ydamas commented 7 years ago

Yes, I checked the system clock and it is accurate.

ydamas commented 7 years ago

Evan, below are some logs from the server. We put the API in the DEBUG mode and can see it pulling information. As you can see we have a successful connection to the database. However; the dashboard is still blank. looks like it is not storing in the database as the tables are blank.

2017-10-04 18:35:25,675 DEBUG FalconOrchestrator.Client.FalconOrchestratorService - Connection to database is successful, starting service 2017-10-04 18:35:27,946 DEBUG FalconOrchestrator.Client.FalconOrchestratorService - [0] Event already stored in database 2017-10-04 18:35:27,946 DEBUG FalconOrchestrator.Client.FalconOrchestratorService - [1] Event already stored in database 2017-10-04 18:35:27,946 DEBUG FalconOrchestrator.Client.FalconOrchestratorService - [2] Event already stored in database 2017-10-04 18:35:27,946 DEBUG FalconOrchestrator.Client.FalconOrchestratorService - [3] Event already stored in database

2017-10-04 18:35:28,634 FATAL FalconOrchestrator.Client.Rule - An error occured while sending an email notification System.IO.DirectoryNotFoundException: Could not find a part of the path 'C:\Inetpub\Falcon Orchestrator\App_Data\Templates\alert_template.html'. at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath) at System.IO.FileStream.Init(String path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost) at System.IO.FileStream..ctor(String path, FileMode mode, FileAccess access, FileShare share, Int32 bufferSize, FileOptions options, String msgPath, Boolean bFromProxy, Boolean useLongPath, Boolean checkHost) at System.IO.StreamReader..ctor(String path, Encoding encoding, Boolean detectEncodingFromByteOrderMarks, Int32 bufferSize, Boolean checkHost) at System.IO.File.InternalReadAllText(String path, Encoding encoding, Boolean checkHost) at System.IO.File.ReadAllText(String path) at FalconOrchestrator.Client.EmailNotification.SendEmail() at FalconOrchestrator.Client.EmailNotification.Execute()

mr-burnse commented 7 years ago

Well it looks like you're past the 401 error now. Does the file 'C:\Inetpub\Falcon Orchestrator\App_Data\Templates\alert_template.html' exist? Is the app installed on a different drive letter? If so, you'll need to point it to the proper file location via the configuration section in the Orchestrator UI.

CrowdStrike / falcon-orchestrator

CrowdStrike Orchestrator Configuration #46