LinkedIn
Twitter
Hi TPankaj,
I can help you with your question. There are multiple parsers for the event data produced by Crowdstrike. You're correct in your statement, in that there are 4 Crowdstrike Log Types or Ingestion Labels. Below is a little more information about the different parsers and log types:
- Crowdstrike Detection Monitoring
- Ingestion Label or Log_type is CS_DETECTS
- Utilizes a Cloud to Cloud connection to Crowdstrike using the Detect API.
- Ingests the Crowdstrike Detection Summary Events, that you typically find on the Crowdstrike Endpoint Detections Dashboard
- Chronicle Documentation on how to export Crowdstrike Detection logs to Chronicle
- Crowdstrike Falcon Data Replicator (FDR)
- Ingestion Label is CS_EDR
- Provides near real time telemetry data, such as files being accessed, registry modifications, etc.
- Ingested via a Crowdstrike owned AWS S3 Bucket
- Crowdstrike Falcon Stream
- Ingestion Label is CS_STREAM
- Includes Detections, Events, and Audit data using the Crowdstrike Event Streaming API
- Requires the Crowdstrike SIEM Connector service, which is a service and executable maintained by CS, but requires that you stand up a linux system on which to install the service.
- Crowdstrike IOCs
- Ingestion Label is CROWDSTRIKE_IOC
- Ingests the IOCs and IOAs via Crowdstrike Threat Intelligence
- Requires the Crowdstrike Chronicle Intel bridge, which is a CS Maintained docker container.
- Chronicle Documentation on how to export Crowdstrike IOC logs to Chronicle
All of this said, Google Chronicle recommends that you utilize the Crowdstrike Detection Monitoring (CS_DETECTS) and Crowdstrike Falcon (CS_EDR) log types to ingest Crowdstrike Event data, and the Crowdstrike IOCs (CROWDSTRIKE_IOC) log type to ingest the IOCs and IOAs created by the Crowdstrike Threat Intelligence team.
Below you'll find a rudimentary drawing of what the ingestion looks for each log type or ingestion label.
- Starting with the red, Crowdstrike Detection Monitoring. We can see that this is handled by Feed Management and is a direct cloud to cloud connection using the CS Detect API.
- Second, the blue, Crowdstrike FDR. This feed is also managed by Feed Management, but is a connection to a S3 or GCS bucket owned and maintained by your organization into which CS copies the event data. This requires a ticket with CS Support to disable and enable.
- Third, if we focus on the yellow, Crowdstrike Falcon Stream, the Crowdstrike SIEM Connector service is installed on a linux VM. The service supports CentOS or Ubuntu, and requires at a minimum 2 CPUs, 8GB of RAM and 12GB of disk space. The SIEM Connector connects to the Crowdstrike Streaming Event API and then forwards those events to the Chronicle Forwarder using Syslog, in one of several formats that include JSON or CEF.
- Finally the green, Crowdstrike IOCs. In order to ingest the IOCs and IOAs provided by Crowdstrike Threat Intelligence, it is required to use the Crowdstrike Chronicle Intel Bridge which is a docker container maintained by Crowdstrike. The docker container pulls down the IOCs and IOAs and then forwards them to the Chronicle Forwarder using Syslog.
I hope this helps explains the differences and provides you with a better understanding of the 4 Crowdstrike log types.
