CrowdStrike: Configuring the XOps Integration

Using an API connector, you can integrate data from CrowdStrike detections to generate stories for endpoint devices. The endpoint stories help you get a more complete picture of potential threats in your network.

A story is created in the CMA by correlating CrowdStrike detections based on the Incident ID. These stories include all relevant evidence for the detection identified by CrowdStrike. The Stories Workbench shows the endpoint stories together with the other story types, and you can sort and filter the stories to focus on the Endpoint incidents.

CrowdStrike stories are created in near real-time after the original alert is generated. 

To integrate CrowdStrike EndPoint Detection data with Cato XOps, you need to set up the API connectors for CrowdStrike. After creating the connector, the Endpoint Detection engine retrieves and analyzes the detection data from CrowdStrike.

For more information on reviewing XOps stories, including data from CrowdStrike, see Drilling-Down and Analyzing XOps Security Stories.

To create the connector between Cato and your CrowdStrike tenant, you need to:

Step 1: Create the API Client in the Falcon CrowdStrike Platform

In the Falcon CrowdStrike platform, create the API Client.

To create the API Client:

1. In your Falcon CrowdStrike platform, navigate to Support and resources > API clients and keys.

   
2. Click Create API client.

3. Add a Client name and Description, and Read access for these scopes:

   • Alerts
   • Incidents
   • Threatgraph
4. Save the Client ID, Secret, and Base URL so they can be added in the CMA.

Step 2: Create the API Connector in the CMA

After you have created the API client, add the details in the CMA.

To configure the CrowdStrike Connector in the CMA:

1. From the navigation menu, select Resources > Integrations.
2. On the Integrated Apps tab, click New. The New Integration panel opens.
3. From the SaaS Application drop-down menu, select CrowdStrike.
4. Enter a Name, Description (optional), and the Base URL, Application ID, and Client Secret Value from step 1.
5. (Optional) Choose to track errors in the integration by creating an event.
6. Click Save.

Understanding the Connector Status

The Status column on the Connectors Settings page shows the status of the connection between the CrowdStrike app and your Cato account. These are the explanations of the statuses:

• Connected - Your account is connected to the app and working correctly
• Pending user consent - Permissions have not been granted to let Cato access the CrowdStrike app. To resolve this issue, refresh the browser. If Status changes to Connected, the issue is resolved, if Status doesn't change, delete and recreate the connector.
• Error - There is a connectivity, permissions, license, or other issue with the connector. Delete and recreate the connector.