search

matanolabs / matano

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS
https://matano.dev
Apache License 2.0
1.44k stars 97 forks source link

Can Matano directly pull Crowdstrike Falcon api data? #126

Open brentley opened 1 year ago

brentley commented 1 year ago

Greetings!

Can Matano directly pull Crowdstrike Falcon api data, rather than relying on the SIEM connector?

The SIEM connector needs a running server to pull from the API, then a second agent to push the data into s3. It seems like we could "cut out the middle man" and stay serverless if Matano pulls the logs from the streaming API directly, much like it does for other services.

I'm attaching a PDF of the docs page (since it requires a login)

Event streams APIs Deployment and Management APIs CrowdStrike APIs Documentation Support and resources Falcon.pdf

shaeqahmed commented 1 year ago

Hi @brentley! Thanks for cutting an issue. This makes a lot of sense and is something we are planning to work on.

One thing to note, the data like (detection summaries for alerts) that are available in the streaming API should also be available in the FDR. To assist with pulling data from Falcon / FDR in a completely serverless we will

1) Implement a log puller that uses FDR credentials to connect to Crowdstrike managed SQS queue and pull all the data into Matano.

2) Implement a log puller for Falcon Streaming API that entirely replaces the Crowdstrike SIEM connector and directly connects to the datafeed over http to receive the streaming events and write them to Matano on a regular basis.

Do you have a link to additional documentation on the Falcon Event Streaming API to better understand the format / spec of the API and the events? Thank you!