diff --git a/plugins/CrowdStrike/v1/configValidation.json b/plugins/CrowdStrike/v1/configValidation.json new file mode 100644 index 00000000..8e9a3a2a --- /dev/null +++ b/plugins/CrowdStrike/v1/configValidation.json @@ -0,0 +1,11 @@ +{ + "steps": [ + { + "displayName": "Authenticate", + "dataStream": { "name": "currentUser" }, + "required": true, + "error": "Could not authenticate. Check your Client ID, Client Secret and CrowdStrike Cloud region are correct, and that the API client has the Hosts: Read scope.", + "success": "Connected successfully." + } + ] +} diff --git a/plugins/CrowdStrike/v1/custom_types.json b/plugins/CrowdStrike/v1/custom_types.json new file mode 100644 index 00000000..3b67cc35 --- /dev/null +++ b/plugins/CrowdStrike/v1/custom_types.json @@ -0,0 +1,16 @@ +[ + { + "name": "CrowdStrike Host Group", + "sourceType": "CrowdStrike Host Group", + "icon": "layer-group", + "singular": "Host Group", + "plural": "Host Groups" + }, + { + "name": "CrowdStrike Host", + "sourceType": "CrowdStrike Host", + "icon": "desktop", + "singular": "Host", + "plural": "Hosts" + } +] diff --git a/plugins/CrowdStrike/v1/dataStreams/alerts.json b/plugins/CrowdStrike/v1/dataStreams/alerts.json new file mode 100644 index 00000000..d7d4e527 --- /dev/null +++ b/plugins/CrowdStrike/v1/dataStreams/alerts.json @@ -0,0 +1,232 @@ +{ + "name": "alerts", + "displayName": "Alerts", + "description": "Detections and incidents from the unified Falcon Alerts API, one row per alert, with computed detection and response latency", + "tags": [ + "Security", + "Alerts" + ], + "baseDataSourceName": "httpRequestUnscoped", + "config": { + "httpMethod": "post", + "endpointPath": "/alerts/combined/alerts/v1", + "postBody": { + "limit": 1000, + "sort": "created_timestamp|desc", + "filter": "{{ (typeof timeframe !== 'undefined' && timeframe && timeframe.start && timeframe.end ? [ \"created_timestamp:>'\" + timeframe.start.replace(/\\.\\d+Z$/, 'Z') + \"'+created_timestamp:<'\" + timeframe.end.replace(/\\.\\d+Z$/, 'Z') + \"'\" ] : []).concat(((S => S.length > 1 ? [ \"(\" + S.join(\",\") + \")\" ] : S)((typeof scope === 'undefined' || !scope ? [] : [ [\"device.device_id\", scope.filter(o => (typeof o.type === 'string' ? o.type : JSON.stringify(o)).indexOf('Host Group') < 0)], [\"device.groups\", scope.filter(o => (typeof o.type === 'string' ? o.type : JSON.stringify(o)).indexOf('Host Group') >= 0)] ].filter(p => p[1].length).map(p => p[0] + \":[\" + p[1].map(o => \"'\" + String([].concat(o.rawId !== undefined ? o.rawId : (o.sourceId || o.id))[0]).split('~').pop() + \"'\").join(\",\") + \"]\"))))).concat((typeof status === 'undefined' || !status || !status.length ? [] : [ \"status:[\" + status.map(s => \"'\" + (s.value || s) + \"'\").join(\",\") + \"]\" ])).join(\"+\") || \"created_timestamp:>'2000-01-01T00:00:00Z'\" }}" + }, + "paging": { + "mode": "token", + "in": { + "realm": "payload", + "path": "meta.pagination.after" + }, + "out": { + "realm": "body", + "path": "after" + } + }, + "pathToData": "resources", + "expandInnerObjects": true, + "errorHandling": { + "type": "script", + "script": "errorHandling/falconApiError.js" + } + }, + "matches": "none", + "ui": [ + { + "type": "objects", + "name": "scope", + "label": "Host or Host Group (optional)", + "matches": { + "sourceType": { + "type": "oneOf", + "values": [ + "CrowdStrike Host", + "CrowdStrike Host Group" + ] + } + } + }, + { + "type": "choiceChips", + "name": "status", + "label": "Status", + "isMulti": true, + "options": [ + { + "value": "new", + "label": "New" + }, + { + "value": "in_progress", + "label": "In Progress" + }, + { + "value": "closed", + "label": "Closed" + }, + { + "value": "reopened", + "label": "Reopened" + } + ] + } + ], + "metadata": [ + { + "name": "composite_id", + "displayName": "ID", + "shape": "string", + "role": "id", + "visible": false + }, + { + "name": "name", + "displayName": "Name", + "shape": "string", + "role": "label" + }, + { + "name": "description", + "displayName": "Description", + "shape": "string" + }, + { + "name": "status", + "displayName": "Status", + "shape": "string" + }, + { + "name": "severity_name", + "displayName": "Severity", + "shape": "string" + }, + { + "name": "severity", + "displayName": "Severity Score", + "shape": "number" + }, + { + "name": "confidence", + "displayName": "Confidence", + "shape": "number" + }, + { + "name": "product", + "displayName": "Product", + "shape": "string" + }, + { + "name": "type", + "displayName": "Alert Type", + "shape": "string" + }, + { + "name": "tactic", + "displayName": "Tactic", + "shape": "string" + }, + { + "name": "technique", + "displayName": "Technique", + "shape": "string" + }, + { + "name": "device.device_id", + "displayName": "Device ID", + "shape": "string", + "visible": false + }, + { + "name": "device.hostname", + "displayName": "Hostname", + "shape": "string" + }, + { + "name": "device.platform_name", + "displayName": "Platform", + "shape": "string" + }, + { + "name": "filename", + "displayName": "File Name", + "shape": "string" + }, + { + "name": "filepath", + "displayName": "File Path", + "shape": "string" + }, + { + "name": "cmdline", + "displayName": "Command Line", + "shape": "string" + }, + { + "name": "user_name", + "displayName": "User", + "shape": "string" + }, + { + "name": "tags", + "displayName": "Tags", + "shape": "string" + }, + { + "name": "created_timestamp", + "displayName": "Created", + "shape": "date", + "role": "timestamp" + }, + { + "name": "updated_timestamp", + "displayName": "Last Updated", + "shape": "date" + }, + { + "name": "first_behavior", + "displayName": "First Behavior", + "shape": "date" + }, + { + "name": "last_behavior", + "displayName": "Last Behavior", + "shape": "date" + }, + { + "name": "detectionLatencySeconds", + "displayName": "Detection Latency", + "computed": true, + "valueExpression": "{{ ($['first_behavior'] && $['created_timestamp']) ? Math.max(0, (new Date($['created_timestamp']) - new Date($['first_behavior'])) / 1000) : null }}", + "shape": [ + "seconds", + { + "formatDuration": true + } + ] + }, + { + "name": "responseLatencySeconds", + "displayName": "Response Latency", + "computed": true, + "valueExpression": "{{ ($['seconds_to_triaged'] !== undefined && $['seconds_to_triaged'] !== null && $['seconds_to_triaged'] !== '' && !isNaN(Number($['seconds_to_triaged']))) ? Math.max(0, Number($['seconds_to_triaged'])) : null }}", + "shape": [ + "seconds", + { + "formatDuration": true + } + ] + }, + { + "sourceId": "device.device_id", + "sourceType": "CrowdStrike Host", + "name": "device.hostname" + }, + { + "pattern": ".*" + } + ], + "timeframes": true +} diff --git a/plugins/CrowdStrike/v1/dataStreams/currentUser.json b/plugins/CrowdStrike/v1/dataStreams/currentUser.json new file mode 100644 index 00000000..10cc6411 --- /dev/null +++ b/plugins/CrowdStrike/v1/dataStreams/currentUser.json @@ -0,0 +1,18 @@ +{ + "name": "currentUser", + "displayName": "Host IDs", + "description": "A minimal Falcon Hosts query, used only to verify the configured credentials can reach the API", + "tags": ["Security"], + "baseDataSourceName": "httpRequestUnscoped", + "config": { + "httpMethod": "get", + "endpointPath": "/devices/queries/devices/v1", + "getArgs": [{ "key": "limit", "value": "1" }], + "paging": { "mode": "none" }, + "pathToData": "resources" + }, + "matches": "none", + "visibility": { "type": "hidden" }, + "metadata": [{ "pattern": ".*" }], + "timeframes": false +} diff --git a/plugins/CrowdStrike/v1/dataStreams/devices.json b/plugins/CrowdStrike/v1/dataStreams/devices.json new file mode 100644 index 00000000..ed88a1fb --- /dev/null +++ b/plugins/CrowdStrike/v1/dataStreams/devices.json @@ -0,0 +1,199 @@ +{ + "name": "devices", + "displayName": "Devices", + "description": "Host inventory with platform, sensor, network, group membership and policy assignment detail, one row per device", + "tags": [ + "Security", + "Hosts" + ], + "baseDataSourceName": "httpRequestUnscoped", + "config": { + "httpMethod": "get", + "endpointPath": "/devices/combined/devices/v1", + "getArgs": [ + { + "key": "sort", + "value": "device_id.asc" + }, + { + "key": "fields", + "value": "device_id,hostname,platform_name,os_version,product_type_desc,agent_version,status,reduced_functionality_mode,first_seen,last_seen,local_ip,external_ip,mac_address,machine_domain,site_name,serial_number,system_manufacturer,system_product_name,groups,tags,device_policies" + }, + { + "key": "filter", + "value": "{{ (typeof scope === 'undefined' || !scope ? [] : [ [\"device_id\", scope.filter(o => (typeof o.type === 'string' ? o.type : JSON.stringify(o)).indexOf('Host Group') < 0)], [\"groups\", scope.filter(o => (typeof o.type === 'string' ? o.type : JSON.stringify(o)).indexOf('Host Group') >= 0)] ].filter(p => p[1].length).map(p => p[0] + \":[\" + p[1].map(o => \"'\" + String([].concat(o.rawId !== undefined ? o.rawId : (o.sourceId || o.id))[0]).split('~').pop() + \"'\").join(\",\") + \"]\")).join(\",\") || null }}" + } + ], + "paging": { + "mode": "token", + "pageSize": { + "realm": "queryArg", + "path": "limit", + "value": "500" + }, + "in": { + "realm": "payload", + "path": "meta.pagination.next" + }, + "out": { + "realm": "queryArg", + "path": "offset" + } + }, + "pathToData": "resources", + "expandInnerObjects": true, + "errorHandling": { + "type": "script", + "script": "errorHandling/falconApiError.js" + } + }, + "matches": "none", + "ui": [ + { + "type": "objects", + "name": "scope", + "label": "Host or Host Group (optional)", + "matches": { + "sourceType": { + "type": "oneOf", + "values": [ + "CrowdStrike Host", + "CrowdStrike Host Group" + ] + } + } + } + ], + "metadata": [ + { + "name": "device_id", + "displayName": "Device ID", + "shape": "string", + "visible": false + }, + { + "name": "hostname", + "displayName": "Hostname", + "shape": "string", + "role": "label" + }, + { + "name": "platform_name", + "displayName": "Platform", + "shape": "string" + }, + { + "name": "os_version", + "displayName": "OS Version", + "shape": "string" + }, + { + "name": "product_type_desc", + "displayName": "Product Type", + "shape": "string" + }, + { + "name": "agent_version", + "displayName": "Sensor Version", + "shape": "string" + }, + { + "name": "status", + "displayName": "Containment Status", + "shape": [ + "state", + { + "map": { + "success": [ + "normal" + ], + "warning": [ + "containment_pending", + "lift_containment_pending" + ], + "error": [ + "contained" + ] + } + } + ] + }, + { + "name": "reduced_functionality_mode", + "displayName": "Reduced Functionality Mode", + "shape": "string" + }, + { + "name": "first_seen", + "displayName": "First Seen", + "shape": "date" + }, + { + "name": "last_seen", + "displayName": "Last Seen", + "shape": "date" + }, + { + "name": "local_ip", + "displayName": "Local IP", + "shape": "string" + }, + { + "name": "external_ip", + "displayName": "External IP", + "shape": "string" + }, + { + "name": "mac_address", + "displayName": "MAC Address", + "shape": "string" + }, + { + "name": "machine_domain", + "displayName": "Domain", + "shape": "string" + }, + { + "name": "site_name", + "displayName": "Site", + "shape": "string" + }, + { + "name": "serial_number", + "displayName": "Serial Number", + "shape": "string" + }, + { + "name": "system_manufacturer", + "displayName": "Manufacturer", + "shape": "string" + }, + { + "name": "system_product_name", + "displayName": "Model", + "shape": "string" + }, + { + "name": "groups", + "displayName": "Host Group IDs", + "shape": "string", + "visible": false + }, + { + "name": "tags", + "displayName": "Tags", + "shape": "string" + }, + { + "name": "device_policies.prevention.applied", + "displayName": "Prevention Policy Applied", + "shape": "boolean" + }, + { + "name": "device_policies.sensor_update.applied", + "displayName": "Sensor Update Policy Applied", + "shape": "boolean" + } + ], + "timeframes": false +} diff --git a/plugins/CrowdStrike/v1/dataStreams/hostCount.json b/plugins/CrowdStrike/v1/dataStreams/hostCount.json new file mode 100644 index 00000000..ca740a27 --- /dev/null +++ b/plugins/CrowdStrike/v1/dataStreams/hostCount.json @@ -0,0 +1,86 @@ +{ + "name": "hostCount", + "displayName": "Host Count", + "description": "Number of hosts, optionally filtered by platform or containment status, from a single request so it stays fast on large tenants", + "tags": [ + "Security" + ], + "baseDataSourceName": "httpRequestUnscoped", + "config": { + "httpMethod": "get", + "endpointPath": "/devices/queries/devices/v1", + "getArgs": [ + { + "key": "limit", + "value": "1" + }, + { + "key": "filter", + "value": "{{ [ (typeof platform === 'undefined' || !platform ? [] : [].concat(platform).map(x => String(x && x.value !== undefined ? x.value : x))).map(v => \"platform_name:'\" + v + \"'\").join(\",\"), (typeof hostStatus === 'undefined' || !hostStatus ? [] : [].concat(hostStatus).map(x => String(x && x.value !== undefined ? x.value : x))).map(v => \"status:'\" + v + \"'\").join(\",\") ].filter(s => s).join(\"+\") || null }}" + } + ], + "paging": { + "mode": "none" + }, + "pathToData": "meta.pagination.total", + "errorHandling": { + "type": "script", + "script": "errorHandling/falconApiError.js" + } + }, + "matches": "none", + "ui": [ + { + "type": "choiceChips", + "name": "platform", + "label": "Platform", + "isMulti": false, + "options": [ + { + "value": "Windows", + "label": "Windows" + }, + { + "value": "Mac", + "label": "Mac" + }, + { + "value": "Linux", + "label": "Linux" + } + ] + }, + { + "type": "choiceChips", + "name": "hostStatus", + "label": "Containment status", + "isMulti": false, + "options": [ + { + "value": "normal", + "label": "Normal" + }, + { + "value": "contained", + "label": "Contained" + }, + { + "value": "containment_pending", + "label": "Containment pending" + }, + { + "value": "lift_containment_pending", + "label": "Lift containment pending" + } + ] + } + ], + "metadata": [ + { + "name": "result", + "displayName": "Hosts", + "shape": "number" + } + ], + "timeframes": false +} diff --git a/plugins/CrowdStrike/v1/dataStreams/hostGroups.json b/plugins/CrowdStrike/v1/dataStreams/hostGroups.json new file mode 100644 index 00000000..f079b79f --- /dev/null +++ b/plugins/CrowdStrike/v1/dataStreams/hostGroups.json @@ -0,0 +1,29 @@ +{ + "name": "hostGroups", + "displayName": "Host Groups", + "description": "All Host Groups (agencies) in the Falcon tenant", + "tags": ["Security"], + "baseDataSourceName": "httpRequestUnscoped", + "config": { + "httpMethod": "get", + "endpointPath": "/devices/combined/host-groups/v1", + "getArgs": [{ "key": "limit", "value": "500" }], + "paging": { "mode": "none" }, + "pathToData": "resources" + }, + "matches": "none", + "visibility": { "type": "hidden" }, + "metadata": [ + { "name": "id", "displayName": "ID", "shape": "string", "visible": false }, + { "name": "name", "displayName": "Name", "shape": "string", "role": "label" }, + { "name": "description", "displayName": "Description", "shape": "string" }, + { "name": "group_type", "displayName": "Group Type", "shape": "string" }, + { "name": "assignment_rule", "displayName": "Assignment Rule", "shape": "string" }, + { "name": "created_by", "displayName": "Created By", "shape": "string" }, + { "name": "created_timestamp", "displayName": "Created", "shape": "date" }, + { "name": "modified_by", "displayName": "Modified By", "shape": "string" }, + { "name": "modified_timestamp", "displayName": "Last Modified", "shape": "date" }, + { "pattern": ".*" } + ], + "timeframes": false +} diff --git a/plugins/CrowdStrike/v1/dataStreams/hostsIndex.json b/plugins/CrowdStrike/v1/dataStreams/hostsIndex.json new file mode 100644 index 00000000..4d3b03cd --- /dev/null +++ b/plugins/CrowdStrike/v1/dataStreams/hostsIndex.json @@ -0,0 +1,131 @@ +{ + "name": "hostsIndex", + "displayName": "Hosts (index)", + "description": "Lean host list used only to import Host objects", + "tags": [ + "Security" + ], + "baseDataSourceName": "httpRequestUnscoped", + "config": { + "httpMethod": "get", + "endpointPath": "/devices/combined/devices/v1", + "getArgs": [ + { + "key": "sort", + "value": "device_id.asc" + }, + { + "key": "fields", + "value": "device_id,hostname,platform_name,os_version,product_type_desc,agent_version,status,first_seen,last_seen,local_ip,external_ip,site_name,groups" + } + ], + "paging": { + "mode": "token", + "pageSize": { + "realm": "queryArg", + "path": "limit", + "value": "500" + }, + "in": { + "realm": "payload", + "path": "meta.pagination.next" + }, + "out": { + "realm": "queryArg", + "path": "offset" + } + }, + "pathToData": "resources" + }, + "matches": "none", + "visibility": { + "type": "hidden" + }, + "metadata": [ + { + "name": "device_id", + "displayName": "Device ID", + "shape": "string", + "visible": false + }, + { + "name": "hostname", + "displayName": "Hostname", + "shape": "string", + "role": "label" + }, + { + "name": "platform_name", + "displayName": "Platform", + "shape": "string" + }, + { + "name": "os_version", + "displayName": "OS Version", + "shape": "string" + }, + { + "name": "product_type_desc", + "displayName": "Product Type", + "shape": "string" + }, + { + "name": "agent_version", + "displayName": "Sensor Version", + "shape": "string" + }, + { + "name": "status", + "displayName": "Containment Status", + "shape": [ + "state", + { + "map": { + "success": [ + "normal" + ], + "warning": [ + "containment_pending", + "lift_containment_pending" + ], + "error": [ + "contained" + ] + } + } + ] + }, + { + "name": "first_seen", + "displayName": "First Seen", + "shape": "date" + }, + { + "name": "last_seen", + "displayName": "Last Seen", + "shape": "date" + }, + { + "name": "local_ip", + "displayName": "Local IP", + "shape": "string" + }, + { + "name": "external_ip", + "displayName": "External IP", + "shape": "string" + }, + { + "name": "site_name", + "displayName": "Site", + "shape": "string" + }, + { + "name": "groups", + "displayName": "Host Group IDs", + "shape": "string", + "visible": false + } + ], + "timeframes": false +} diff --git a/plugins/CrowdStrike/v1/dataStreams/preventionPolicies.json b/plugins/CrowdStrike/v1/dataStreams/preventionPolicies.json new file mode 100644 index 00000000..af54ad07 --- /dev/null +++ b/plugins/CrowdStrike/v1/dataStreams/preventionPolicies.json @@ -0,0 +1,29 @@ +{ + "name": "preventionPolicies", + "displayName": "Prevention Policies", + "description": "Prevention policies assigned to a Host Group, one row per policy", + "tags": ["Security", "Policies"], + "baseDataSourceName": "httpRequestScopedSingle", + "config": { + "httpMethod": "get", + "endpointPath": "/policy/combined/prevention/v1", + "getArgs": [ + { "key": "limit", "value": "100" }, + { "key": "filter", "value": "groups:'{{object.rawId}}'" } + ], + "pathToData": "resources", + "expandInnerObjects": true + }, + "matches": { "sourceType": { "type": "oneOf", "values": ["CrowdStrike Host Group"] } }, + "metadata": [ + { "name": "id", "displayName": "ID", "shape": "string", "role": "id", "visible": false }, + { "name": "name", "displayName": "Policy Name", "shape": "string", "role": "label" }, + { "name": "description", "displayName": "Description", "shape": "string" }, + { "name": "platform_name", "displayName": "Platform", "shape": "string" }, + { "name": "enabled", "displayName": "Enabled", "shape": "boolean" }, + { "name": "created_timestamp", "displayName": "Created", "shape": "date" }, + { "name": "modified_timestamp", "displayName": "Last Modified", "shape": "date" }, + { "pattern": ".*" } + ], + "timeframes": false +} diff --git a/plugins/CrowdStrike/v1/dataStreams/recentHosts.json b/plugins/CrowdStrike/v1/dataStreams/recentHosts.json new file mode 100644 index 00000000..59c69a70 --- /dev/null +++ b/plugins/CrowdStrike/v1/dataStreams/recentHosts.json @@ -0,0 +1,119 @@ +{ + "name": "recentHosts", + "displayName": "Recently Seen Hosts", + "description": "The 100 most recently seen hosts, from a single request so it stays fast on large tenants", + "tags": [ + "Security" + ], + "baseDataSourceName": "httpRequestUnscoped", + "config": { + "httpMethod": "get", + "endpointPath": "/devices/combined/devices/v1", + "getArgs": [ + { + "key": "limit", + "value": "100" + }, + { + "key": "sort", + "value": "last_seen.desc" + }, + { + "key": "fields", + "value": "device_id,hostname,platform_name,os_version,product_type_desc,agent_version,status,first_seen,last_seen,local_ip,external_ip,site_name,groups" + } + ], + "paging": { + "mode": "none" + }, + "pathToData": "resources" + }, + "matches": "none", + "metadata": [ + { + "name": "device_id", + "displayName": "Device ID", + "shape": "string", + "visible": false + }, + { + "name": "hostname", + "displayName": "Hostname", + "shape": "string", + "role": "label" + }, + { + "name": "platform_name", + "displayName": "Platform", + "shape": "string" + }, + { + "name": "os_version", + "displayName": "OS Version", + "shape": "string" + }, + { + "name": "product_type_desc", + "displayName": "Product Type", + "shape": "string" + }, + { + "name": "agent_version", + "displayName": "Sensor Version", + "shape": "string" + }, + { + "name": "status", + "displayName": "Containment Status", + "shape": [ + "state", + { + "map": { + "success": [ + "normal" + ], + "warning": [ + "containment_pending", + "lift_containment_pending" + ], + "error": [ + "contained" + ] + } + } + ] + }, + { + "name": "first_seen", + "displayName": "First Seen", + "shape": "date" + }, + { + "name": "last_seen", + "displayName": "Last Seen", + "shape": "date" + }, + { + "name": "local_ip", + "displayName": "Local IP", + "shape": "string" + }, + { + "name": "external_ip", + "displayName": "External IP", + "shape": "string" + }, + { + "name": "site_name", + "displayName": "Site", + "shape": "string" + }, + { + "name": "groups", + "displayName": "Host Group IDs", + "shape": "string", + "visible": false + } + ], + "timeframes": false +} diff --git a/plugins/CrowdStrike/v1/dataStreams/scripts/errorHandling/falconApiError.js b/plugins/CrowdStrike/v1/dataStreams/scripts/errorHandling/falconApiError.js new file mode 100644 index 00000000..bb83e2c1 --- /dev/null +++ b/plugins/CrowdStrike/v1/dataStreams/scripts/errorHandling/falconApiError.js @@ -0,0 +1,3 @@ +const e = data && data.errors && data.errors[0]; + +result = (e && e.message) || (data && data.message) || ('Request failed with HTTP ' + response.status); diff --git a/plugins/CrowdStrike/v1/dataStreams/sensorUpdatePolicies.json b/plugins/CrowdStrike/v1/dataStreams/sensorUpdatePolicies.json new file mode 100644 index 00000000..cf6596a7 --- /dev/null +++ b/plugins/CrowdStrike/v1/dataStreams/sensorUpdatePolicies.json @@ -0,0 +1,30 @@ +{ + "name": "sensorUpdatePolicies", + "displayName": "Sensor Update Policies", + "description": "Sensor update policies assigned to a Host Group, one row per policy", + "tags": ["Security", "Policies"], + "baseDataSourceName": "httpRequestScopedSingle", + "config": { + "httpMethod": "get", + "endpointPath": "/policy/combined/sensor-update/v2", + "getArgs": [ + { "key": "limit", "value": "100" }, + { "key": "filter", "value": "groups:'{{object.rawId}}'" } + ], + "pathToData": "resources", + "expandInnerObjects": true + }, + "matches": { "sourceType": { "type": "oneOf", "values": ["CrowdStrike Host Group"] } }, + "metadata": [ + { "name": "id", "displayName": "ID", "shape": "string", "role": "id", "visible": false }, + { "name": "name", "displayName": "Policy Name", "shape": "string", "role": "label" }, + { "name": "description", "displayName": "Description", "shape": "string" }, + { "name": "platform_name", "displayName": "Platform", "shape": "string" }, + { "name": "enabled", "displayName": "Enabled", "shape": "boolean" }, + { "name": "settings.build", "displayName": "Sensor Build", "shape": "string" }, + { "name": "created_timestamp", "displayName": "Created", "shape": "date" }, + { "name": "modified_timestamp", "displayName": "Last Modified", "shape": "date" }, + { "pattern": ".*" } + ], + "timeframes": false +} diff --git a/plugins/CrowdStrike/v1/dataStreams/sensorUsage.json b/plugins/CrowdStrike/v1/dataStreams/sensorUsage.json new file mode 100644 index 00000000..a1845b94 --- /dev/null +++ b/plugins/CrowdStrike/v1/dataStreams/sensorUsage.json @@ -0,0 +1,16 @@ +{ + "name": "sensorUsage", + "displayName": "Sensor Usage", + "description": "Weekly average of unique sensors seen reporting, account-wide", + "tags": ["Security", "Usage"], + "baseDataSourceName": "httpRequestUnscoped", + "config": { + "httpMethod": "get", + "endpointPath": "/billing-dashboards-usage/aggregates/weekly-average/v1", + "pathToData": "resources", + "expandInnerObjects": true + }, + "matches": "none", + "metadata": [{ "pattern": ".*" }], + "timeframes": false +} diff --git a/plugins/CrowdStrike/v1/dataStreams/vulnerabilities.json b/plugins/CrowdStrike/v1/dataStreams/vulnerabilities.json new file mode 100644 index 00000000..6c45fde0 --- /dev/null +++ b/plugins/CrowdStrike/v1/dataStreams/vulnerabilities.json @@ -0,0 +1,185 @@ +{ + "name": "vulnerabilities", + "displayName": "Vulnerabilities", + "description": "Open Spotlight vulnerabilities with CVE, severity and remediation detail, one row per vulnerability finding", + "tags": [ + "Security", + "Vulnerabilities" + ], + "baseDataSourceName": "httpRequestUnscoped", + "config": { + "httpMethod": "get", + "endpointPath": "/spotlight/combined/vulnerabilities/v1", + "getArgs": [ + { + "key": "facet", + "value": "host_info" + }, + { + "key": "filter", + "value": "{{ ((S => S.length > 1 ? [ \"(\" + S.join(\",\") + \")\" ] : S)((typeof scope === 'undefined' || !scope ? [] : [ [\"aid\", scope.filter(o => (typeof o.type === 'string' ? o.type : JSON.stringify(o)).indexOf('Host Group') < 0)], [\"host_info.groups\", scope.filter(o => (typeof o.type === 'string' ? o.type : JSON.stringify(o)).indexOf('Host Group') >= 0)] ].filter(p => p[1].length).map(p => p[0] + \":[\" + p[1].map(o => \"'\" + String([].concat(o.rawId !== undefined ? o.rawId : (o.sourceId || o.id))[0]).split('~').pop() + \"'\").join(\",\") + \"]\")))).concat((typeof status === 'undefined' || !status || !status.length ? [ \"status:['open','reopen']\" ] : [ \"status:[\" + status.map(s => \"'\" + (s.value || s) + \"'\").join(\",\") + \"]\" ])).join(\"+\") }}" + } + ], + "paging": { + "mode": "token", + "pageSize": { + "realm": "queryArg", + "path": "limit", + "value": "200" + }, + "in": { + "realm": "payload", + "path": "meta.pagination.after" + }, + "out": { + "realm": "queryArg", + "path": "after" + } + }, + "pathToData": "resources", + "expandInnerObjects": true, + "errorHandling": { + "type": "script", + "script": "errorHandling/falconApiError.js" + } + }, + "matches": "none", + "ui": [ + { + "type": "objects", + "name": "scope", + "label": "Host or Host Group (optional)", + "matches": { + "sourceType": { + "type": "oneOf", + "values": [ + "CrowdStrike Host", + "CrowdStrike Host Group" + ] + } + } + }, + { + "type": "choiceChips", + "name": "status", + "label": "Status", + "isMulti": true, + "options": [ + { + "value": "open", + "label": "Open" + }, + { + "value": "closed", + "label": "Closed" + }, + { + "value": "reopen", + "label": "Reopened" + }, + { + "value": "expired", + "label": "Expired" + } + ] + } + ], + "metadata": [ + { + "name": "id", + "displayName": "ID", + "shape": "string", + "role": "id", + "visible": false + }, + { + "name": "aid", + "displayName": "Device ID", + "shape": "string", + "visible": false + }, + { + "name": "cve.id", + "displayName": "CVE", + "shape": "string", + "role": "label" + }, + { + "name": "cve.severity", + "displayName": "CVE Severity", + "shape": "string" + }, + { + "name": "cve.base_score", + "displayName": "CVSS Score", + "shape": "number" + }, + { + "name": "cve.exploit_status", + "displayName": "Exploit Status", + "shape": "string" + }, + { + "name": "cve.published_date", + "displayName": "CVE Published", + "shape": "date" + }, + { + "name": "status", + "displayName": "Status", + "shape": "string" + }, + { + "name": "host_info.hostname", + "displayName": "Hostname", + "shape": "string" + }, + { + "name": "host_info.platform", + "displayName": "Platform", + "shape": "string" + }, + { + "name": "host_info.local_ip", + "displayName": "Local IP", + "shape": "string" + }, + { + "name": "app.product_name_version", + "displayName": "Affected Product", + "shape": "string" + }, + { + "name": "created_timestamp", + "displayName": "First Found", + "shape": "date", + "role": "timestamp" + }, + { + "name": "updated_timestamp", + "displayName": "Last Updated", + "shape": "date" + }, + { + "name": "closed_timestamp", + "displayName": "Closed", + "shape": "date" + }, + { + "name": "daysOpen", + "displayName": "Days Open", + "computed": true, + "valueExpression": "{{ $['created_timestamp'] ? Math.max(0, Math.floor((($['status'] === 'closed' && $['closed_timestamp'] ? new Date($['closed_timestamp']) : Date.now()) - new Date($['created_timestamp'])) / 86400000)) : null }}", + "shape": "number" + }, + { + "sourceId": "aid", + "sourceType": "CrowdStrike Host", + "name": "host_info.hostname" + }, + { + "pattern": ".*" + } + ], + "timeframes": false +} diff --git a/plugins/CrowdStrike/v1/dataStreams/vulnerabilityCount.json b/plugins/CrowdStrike/v1/dataStreams/vulnerabilityCount.json new file mode 100644 index 00000000..e05320bd --- /dev/null +++ b/plugins/CrowdStrike/v1/dataStreams/vulnerabilityCount.json @@ -0,0 +1,105 @@ +{ + "name": "vulnerabilityCount", + "displayName": "Vulnerability Count", + "description": "Number of Spotlight vulnerabilities, optionally filtered by host, host group, severity and status, from a single request so it stays fast on large tenants", + "tags": [ + "Security", + "Vulnerabilities" + ], + "baseDataSourceName": "httpRequestUnscoped", + "config": { + "httpMethod": "get", + "endpointPath": "/spotlight/combined/vulnerabilities/v1", + "getArgs": [ + { + "key": "limit", + "value": "1" + }, + { + "key": "filter", + "value": "{{ ((S => S.length > 1 ? [ \"(\" + S.join(\",\") + \")\" ] : S)((typeof scope === 'undefined' || !scope ? [] : [ [\"aid\", scope.filter(o => (typeof o.type === 'string' ? o.type : JSON.stringify(o)).indexOf('Host Group') < 0)], [\"host_info.groups\", scope.filter(o => (typeof o.type === 'string' ? o.type : JSON.stringify(o)).indexOf('Host Group') >= 0)] ].filter(p => p[1].length).map(p => p[0] + \":[\" + p[1].map(o => \"'\" + String([].concat(o.rawId !== undefined ? o.rawId : (o.sourceId || o.id))[0]).split('~').pop() + \"'\").join(\",\") + \"]\")))).concat((typeof severity === 'undefined' || !severity ? [] : [].concat(severity).map(x => String(x && x.value !== undefined ? x.value : x))).length ? [ \"cve.severity:[\" + (typeof severity === 'undefined' || !severity ? [] : [].concat(severity).map(x => String(x && x.value !== undefined ? x.value : x))).map(v => \"'\" + v + \"'\").join(\",\") + \"]\" ] : []).concat((typeof status === 'undefined' || !status ? [] : [].concat(status).map(x => String(x && x.value !== undefined ? x.value : x))).length ? [ \"status:[\" + (typeof status === 'undefined' || !status ? [] : [].concat(status).map(x => String(x && x.value !== undefined ? x.value : x))).map(v => \"'\" + v + \"'\").join(\",\") + \"]\" ] : [ \"status:['open','reopen']\" ]).join(\"+\") }}" + } + ], + "paging": { + "mode": "none" + }, + "pathToData": "meta.pagination.total", + "errorHandling": { + "type": "script", + "script": "errorHandling/falconApiError.js" + } + }, + "matches": "none", + "ui": [ + { + "type": "objects", + "name": "scope", + "label": "Host or Host Group (optional)", + "matches": { + "sourceType": { + "type": "oneOf", + "values": [ + "CrowdStrike Host", + "CrowdStrike Host Group" + ] + } + } + }, + { + "type": "choiceChips", + "name": "severity", + "label": "Severity", + "isMulti": true, + "options": [ + { + "value": "CRITICAL", + "label": "Critical" + }, + { + "value": "HIGH", + "label": "High" + }, + { + "value": "MEDIUM", + "label": "Medium" + }, + { + "value": "LOW", + "label": "Low" + } + ] + }, + { + "type": "choiceChips", + "name": "status", + "label": "Status", + "isMulti": true, + "options": [ + { + "value": "open", + "label": "Open" + }, + { + "value": "closed", + "label": "Closed" + }, + { + "value": "reopen", + "label": "Reopened" + }, + { + "value": "expired", + "label": "Expired" + } + ] + } + ], + "metadata": [ + { + "name": "result", + "displayName": "Vulnerabilities", + "shape": "number" + } + ], + "timeframes": false +} diff --git a/plugins/CrowdStrike/v1/defaultContent/hostGroupPerspective.dash.json b/plugins/CrowdStrike/v1/defaultContent/hostGroupPerspective.dash.json new file mode 100644 index 00000000..05d28937 --- /dev/null +++ b/plugins/CrowdStrike/v1/defaultContent/hostGroupPerspective.dash.json @@ -0,0 +1,1055 @@ +{ + "name": "Host Group", + "schemaVersion": "1.5", + "timeframe": "last7days", + "variables": [ + "{{variables.[Host Group]}}" + ], + "dashboard": { + "_type": "layout/grid", + "columns": 4, + "version": 1, + "contents": [ + { + "i": "f981efd7-e832-4a4a-9c4f-3d1697673732", + "x": 0, + "y": 0, + "w": 1, + "h": 2, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Hosts", + "description": "", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "variables": [ + "{{variables.[Host Group]}}" + ], + "dataStream": { + "id": "{{dataStreams.[devices]}}", + "name": "devices", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "scope": { + "variable": "{{variables.[Host Group]}}", + "workspace": "{{workspaceId}}", + "scope": "{{scopes.[Host Groups]}}" + } + }, + "group": { + "by": [], + "aggregate": [ + { + "type": "count" + } + ] + } + }, + "visualisation": { + "type": "data-stream-scalar", + "config": { + "data-stream-scalar": { + "value": "count", + "comparisonColumn": "none" + } + } + } + } + }, + { + "i": "b6fad726-680e-4998-93ca-d8df9117560b", + "x": 1, + "y": 0, + "w": 1, + "h": 2, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Prevention Policy Applied", + "description": "Hosts with a prevention policy applied", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "variables": [ + "{{variables.[Host Group]}}" + ], + "dataStream": { + "id": "{{dataStreams.[devices]}}", + "name": "devices", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "scope": { + "variable": "{{variables.[Host Group]}}", + "workspace": "{{workspaceId}}", + "scope": "{{scopes.[Host Groups]}}" + } + }, + "filter": { + "multiOperation": "and", + "filters": [ + { + "column": "device_policies.prevention.applied", + "operation": "equals", + "value": "true" + } + ] + }, + "group": { + "by": [], + "aggregate": [ + { + "type": "count" + } + ] + } + }, + "visualisation": { + "type": "data-stream-scalar", + "config": { + "data-stream-scalar": { + "value": "count", + "comparisonColumn": "none" + } + } + } + } + }, + { + "i": "4d4fd992-1fca-4f5d-88fc-be3b8796c202", + "x": 2, + "y": 0, + "w": 1, + "h": 2, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Sensor Update Policy Applied", + "description": "Hosts with a sensor update policy applied", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "variables": [ + "{{variables.[Host Group]}}" + ], + "dataStream": { + "id": "{{dataStreams.[devices]}}", + "name": "devices", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "scope": { + "variable": "{{variables.[Host Group]}}", + "workspace": "{{workspaceId}}", + "scope": "{{scopes.[Host Groups]}}" + } + }, + "filter": { + "multiOperation": "and", + "filters": [ + { + "column": "device_policies.sensor_update.applied", + "operation": "equals", + "value": "true" + } + ] + }, + "group": { + "by": [], + "aggregate": [ + { + "type": "count" + } + ] + } + }, + "visualisation": { + "type": "data-stream-scalar", + "config": { + "data-stream-scalar": { + "value": "count", + "comparisonColumn": "none" + } + } + } + } + }, + { + "i": "251a78d2-e3f8-456f-9b41-1f5e60cc95db", + "x": 3, + "y": 0, + "w": 1, + "h": 2, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Open Vulnerabilities", + "description": "Open vulnerabilities on hosts in this group", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "variables": [ + "{{variables.[Host Group]}}" + ], + "dataStream": { + "id": "{{dataStreams.[vulnerabilityCount]}}", + "name": "vulnerabilityCount", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "scope": { + "variable": "{{variables.[Host Group]}}", + "workspace": "{{workspaceId}}", + "scope": "{{scopes.[Host Groups]}}" + }, + "status": [ + "open" + ] + } + }, + "visualisation": { + "type": "data-stream-scalar", + "config": { + "data-stream-scalar": { + "value": "result", + "comparisonColumn": "none" + } + } + } + } + }, + { + "i": "7a3911ff-6ab8-4784-ba84-8b588853f49b", + "x": 0, + "y": 2, + "w": 2, + "h": 3, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "OS / Platform Breakdown", + "description": "", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "variables": [ + "{{variables.[Host Group]}}" + ], + "dataStream": { + "id": "{{dataStreams.[devices]}}", + "name": "devices", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "scope": { + "variable": "{{variables.[Host Group]}}", + "workspace": "{{workspaceId}}", + "scope": "{{scopes.[Host Groups]}}" + } + }, + "group": { + "by": [ + [ + "platform_name", + "uniqueValues" + ] + ], + "aggregate": [ + { + "type": "count" + } + ] + } + }, + "visualisation": { + "type": "data-stream-donut-chart", + "config": { + "data-stream-donut-chart": { + "valueColumn": "count", + "labelColumn": "platform_name_uniqueValues", + "showValuesAsPercentage": true, + "legendPosition": "auto", + "legendMode": "table" + } + } + } + } + }, + { + "i": "4a955419-a6f1-4c80-93dc-36fd5970f5a8", + "x": 2, + "y": 2, + "w": 2, + "h": 3, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Sensor Version Distribution", + "description": "", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "variables": [ + "{{variables.[Host Group]}}" + ], + "dataStream": { + "id": "{{dataStreams.[devices]}}", + "name": "devices", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "scope": { + "variable": "{{variables.[Host Group]}}", + "workspace": "{{workspaceId}}", + "scope": "{{scopes.[Host Groups]}}" + } + }, + "group": { + "by": [ + [ + "agent_version", + "uniqueValues" + ] + ], + "aggregate": [ + { + "type": "count" + } + ] + } + }, + "visualisation": { + "type": "data-stream-donut-chart", + "config": { + "data-stream-donut-chart": { + "valueColumn": "count", + "labelColumn": "agent_version_uniqueValues", + "showValuesAsPercentage": true, + "legendPosition": "auto", + "legendMode": "table" + } + } + } + } + }, + { + "i": "2dbd1817-b505-466d-ae56-9dcd5a639572", + "x": 0, + "y": 5, + "w": 2, + "h": 4, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Prevention Policies", + "description": "", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "variables": [ + "{{variables.[Host Group]}}" + ], + "dataStream": { + "id": "{{dataStreams.[preventionPolicies]}}", + "name": "preventionPolicies", + "pluginConfigId": "{{configId}}" + }, + "scope": { + "scope": "{{scopes.[Host Groups]}}", + "workspace": "{{workspaceId}}", + "variable": "{{variables.[Host Group]}}" + }, + "visualisation": { + "type": "data-stream-table", + "config": { + "data-stream-table": { + "transpose": false, + "columnOrder": [ + "name", + "platform_name", + "enabled", + "description", + "modified_timestamp" + ], + "hiddenColumns": [ + "id", + "created_timestamp" + ] + } + } + } + } + }, + { + "i": "269c103b-cd25-4d0e-bd48-4adf52925f59", + "x": 2, + "y": 5, + "w": 2, + "h": 4, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Sensor Update Policies", + "description": "", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "variables": [ + "{{variables.[Host Group]}}" + ], + "dataStream": { + "id": "{{dataStreams.[sensorUpdatePolicies]}}", + "name": "sensorUpdatePolicies", + "pluginConfigId": "{{configId}}" + }, + "scope": { + "scope": "{{scopes.[Host Groups]}}", + "workspace": "{{workspaceId}}", + "variable": "{{variables.[Host Group]}}" + }, + "visualisation": { + "type": "data-stream-table", + "config": { + "data-stream-table": { + "transpose": false, + "columnOrder": [ + "name", + "platform_name", + "enabled", + "settings.build", + "modified_timestamp" + ], + "hiddenColumns": [ + "id", + "description", + "created_timestamp" + ] + } + } + } + } + }, + { + "i": "5f770e25-522c-45a7-9a30-00a61d60bf8f", + "x": 0, + "y": 9, + "w": 1, + "h": 2, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Alerts", + "description": "Alerts created within the dashboard timeframe", + "activePluginConfigIds": [ + "{{configId}}" + ], + "variables": [ + "{{variables.[Host Group]}}" + ], + "dataStream": { + "id": "{{dataStreams.[alerts]}}", + "name": "alerts", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "scope": { + "variable": "{{variables.[Host Group]}}", + "workspace": "{{workspaceId}}", + "scope": "{{scopes.[Host Groups]}}" + } + }, + "group": { + "by": [], + "aggregate": [ + { + "type": "count" + } + ] + } + }, + "visualisation": { + "type": "data-stream-scalar", + "config": { + "data-stream-scalar": { + "value": "count", + "comparisonColumn": "none" + } + } + } + } + }, + { + "i": "58019020-2915-4a38-b2d4-aa9dcc543683", + "x": 1, + "y": 9, + "w": 1, + "h": 2, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Avg Detection Latency", + "description": "Average time between first behavior and alert creation", + "activePluginConfigIds": [ + "{{configId}}" + ], + "variables": [ + "{{variables.[Host Group]}}" + ], + "dataStream": { + "id": "{{dataStreams.[alerts]}}", + "name": "alerts", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "scope": { + "variable": "{{variables.[Host Group]}}", + "workspace": "{{workspaceId}}", + "scope": "{{scopes.[Host Groups]}}" + } + }, + "group": { + "by": [], + "aggregate": [ + { + "type": "mean", + "names": [ + "detectionLatencySeconds" + ] + } + ] + } + }, + "visualisation": { + "type": "data-stream-scalar", + "config": { + "data-stream-scalar": { + "value": "detectionLatencySeconds_mean", + "comparisonColumn": "none" + } + } + } + } + }, + { + "i": "057ad2f6-b966-4db4-a7b7-89aa91ff1443", + "x": 2, + "y": 9, + "w": 1, + "h": 2, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Avg Response Latency", + "description": "Average time between alert creation and closure", + "activePluginConfigIds": [ + "{{configId}}" + ], + "variables": [ + "{{variables.[Host Group]}}" + ], + "dataStream": { + "id": "{{dataStreams.[alerts]}}", + "name": "alerts", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "scope": { + "variable": "{{variables.[Host Group]}}", + "workspace": "{{workspaceId}}", + "scope": "{{scopes.[Host Groups]}}" + } + }, + "group": { + "by": [], + "aggregate": [ + { + "type": "mean", + "names": [ + "responseLatencySeconds" + ] + } + ] + } + }, + "visualisation": { + "type": "data-stream-scalar", + "config": { + "data-stream-scalar": { + "value": "responseLatencySeconds_mean", + "comparisonColumn": "none" + } + } + } + } + }, + { + "i": "ba1b75ab-b5b2-4399-82b1-60e83a2f5933", + "x": 0, + "y": 11, + "w": 2, + "h": 3, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Alerts by Severity", + "description": "", + "activePluginConfigIds": [ + "{{configId}}" + ], + "variables": [ + "{{variables.[Host Group]}}" + ], + "dataStream": { + "id": "{{dataStreams.[alerts]}}", + "name": "alerts", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "scope": { + "variable": "{{variables.[Host Group]}}", + "workspace": "{{workspaceId}}", + "scope": "{{scopes.[Host Groups]}}" + } + }, + "group": { + "by": [ + [ + "severity_name", + "uniqueValues" + ] + ], + "aggregate": [ + { + "type": "count" + } + ] + } + }, + "visualisation": { + "type": "data-stream-donut-chart", + "config": { + "data-stream-donut-chart": { + "valueColumn": "count", + "labelColumn": "severity_name_uniqueValues", + "showValuesAsPercentage": true, + "legendPosition": "auto", + "legendMode": "table" + } + } + } + } + }, + { + "i": "7dd1e2c3-2fd5-44f6-b4bd-8906734381c6", + "x": 2, + "y": 11, + "w": 2, + "h": 3, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Alerts by Status", + "description": "", + "activePluginConfigIds": [ + "{{configId}}" + ], + "variables": [ + "{{variables.[Host Group]}}" + ], + "dataStream": { + "id": "{{dataStreams.[alerts]}}", + "name": "alerts", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "scope": { + "variable": "{{variables.[Host Group]}}", + "workspace": "{{workspaceId}}", + "scope": "{{scopes.[Host Groups]}}" + } + }, + "group": { + "by": [ + [ + "status", + "uniqueValues" + ] + ], + "aggregate": [ + { + "type": "count" + } + ] + }, + "sort": { + "by": [ + [ + "count", + "desc" + ] + ] + } + }, + "visualisation": { + "type": "data-stream-bar-chart", + "config": { + "data-stream-bar-chart": { + "xAxisData": "status_uniqueValues", + "yAxisData": [ + "count" + ], + "xAxisGroup": "none", + "xAxisLabel": "", + "yAxisLabel": "Alerts", + "showXAxisLabel": false, + "showYAxisLabel": true, + "showLegend": false, + "legendPosition": "bottom", + "showGrid": true, + "horizontalLayout": "vertical", + "displayMode": "actual", + "showTotals": false, + "showValue": true, + "grouping": false, + "range": { + "type": "auto" + } + } + } + } + } + }, + { + "i": "1f63766e-2731-4b7a-86f8-212928ffb45f", + "x": 0, + "y": 14, + "w": 4, + "h": 4, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Recent Alerts", + "description": "", + "activePluginConfigIds": [ + "{{configId}}" + ], + "variables": [ + "{{variables.[Host Group]}}" + ], + "dataStream": { + "id": "{{dataStreams.[alerts]}}", + "name": "alerts", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "scope": { + "variable": "{{variables.[Host Group]}}", + "workspace": "{{workspaceId}}", + "scope": "{{scopes.[Host Groups]}}" + } + }, + "sort": { + "by": [ + [ + "created_timestamp", + "desc" + ] + ], + "top": 15 + } + }, + "visualisation": { + "type": "data-stream-table", + "config": { + "data-stream-table": { + "transpose": false, + "columnOrder": [ + "name", + "severity_name", + "status", + "device.hostname", + "tactic", + "technique", + "created_timestamp" + ], + "hiddenColumns": [ + "composite_id", + "device.device_id", + "device.platform_name", + "filename", + "filepath", + "cmdline", + "user_name", + "tags", + "description", + "product", + "type", + "confidence", + "severity", + "updated_timestamp", + "first_behavior", + "last_behavior", + "detectionLatencySeconds", + "responseLatencySeconds" + ] + } + } + } + } + }, + { + "i": "5f9f216f-f344-4450-8d07-ed382e3bf9d7", + "x": 0, + "y": 18, + "w": 2, + "h": 4, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Vulnerabilities by Severity", + "description": "Open vulnerabilities only", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "variables": [ + "{{variables.[Host Group]}}" + ], + "dataStream": { + "id": "{{dataStreams.[vulnerabilities]}}", + "name": "vulnerabilities", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "scope": { + "variable": "{{variables.[Host Group]}}", + "workspace": "{{workspaceId}}", + "scope": "{{scopes.[Host Groups]}}" + } + }, + "filter": { + "multiOperation": "and", + "filters": [ + { + "column": "status", + "operation": "equals", + "value": "open" + } + ] + }, + "group": { + "by": [ + [ + "cve.severity", + "uniqueValues" + ] + ], + "aggregate": [ + { + "type": "count" + } + ] + } + }, + "visualisation": { + "type": "data-stream-donut-chart", + "config": { + "data-stream-donut-chart": { + "valueColumn": "count", + "labelColumn": "cve.severity_uniqueValues", + "showValuesAsPercentage": true, + "legendPosition": "auto", + "legendMode": "table" + } + } + } + } + }, + { + "i": "cd0b6171-831f-4803-8de4-2718499dbfb9", + "x": 2, + "y": 18, + "w": 2, + "h": 4, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Top Vulnerable Hosts", + "description": "Open vulnerabilities with the highest CVSS score, in this group", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "variables": [ + "{{variables.[Host Group]}}" + ], + "dataStream": { + "id": "{{dataStreams.[vulnerabilities]}}", + "name": "vulnerabilities", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "scope": { + "variable": "{{variables.[Host Group]}}", + "workspace": "{{workspaceId}}", + "scope": "{{scopes.[Host Groups]}}" + } + }, + "filter": { + "multiOperation": "and", + "filters": [ + { + "column": "status", + "operation": "equals", + "value": "open" + } + ] + }, + "sort": { + "by": [ + [ + "cve.base_score", + "desc" + ] + ], + "top": 10 + } + }, + "visualisation": { + "type": "data-stream-table", + "config": { + "data-stream-table": { + "transpose": false, + "columnOrder": [ + "cve.id", + "cve.severity", + "cve.base_score", + "host_info.hostname", + "app.product_name_version", + "created_timestamp" + ], + "hiddenColumns": [ + "id", + "aid", + "host_info.platform", + "host_info.local_ip", + "cve.exploit_status", + "cve.published_date", + "status", + "updated_timestamp", + "closed_timestamp", + "daysOpen" + ] + } + } + } + } + }, + { + "i": "0aff3eaf-1e0b-413b-bd5b-83c93012f193", + "x": 0, + "y": 22, + "w": 4, + "h": 4, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Member Devices", + "description": "", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "variables": [ + "{{variables.[Host Group]}}" + ], + "dataStream": { + "id": "{{dataStreams.[devices]}}", + "name": "devices", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "scope": { + "variable": "{{variables.[Host Group]}}", + "workspace": "{{workspaceId}}", + "scope": "{{scopes.[Host Groups]}}" + } + }, + "sort": { + "by": [ + [ + "last_seen", + "desc" + ] + ] + } + }, + "visualisation": { + "type": "data-stream-table", + "config": { + "data-stream-table": { + "transpose": false, + "columnOrder": [ + "hostname", + "platform_name", + "os_version", + "agent_version", + "status", + "local_ip", + "last_seen" + ], + "hiddenColumns": [ + "device_id", + "groups", + "mac_address", + "external_ip", + "machine_domain", + "serial_number", + "system_manufacturer", + "system_product_name", + "first_seen", + "tags", + "site_name", + "product_type_desc", + "reduced_functionality_mode", + "device_policies.prevention.applied", + "device_policies.sensor_update.applied" + ] + } + } + } + } + } + ] + } +} diff --git a/plugins/CrowdStrike/v1/defaultContent/hostPerspective.dash.json b/plugins/CrowdStrike/v1/defaultContent/hostPerspective.dash.json new file mode 100644 index 00000000..8f97fbc9 --- /dev/null +++ b/plugins/CrowdStrike/v1/defaultContent/hostPerspective.dash.json @@ -0,0 +1,231 @@ +{ + "name": "Host", + "schemaVersion": "1.5", + "timeframe": "last7days", + "variables": ["{{variables.[Host]}}"], + "dashboard": { + "_type": "layout/grid", + "columns": 4, + "version": 1, + "contents": [ + { + "i": "5a326895-b8cd-4f69-9859-58207ff7fe38", + "x": 0, + "y": 0, + "w": 2, + "h": 4, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Device Properties", + "description": "", + "activePluginConfigIds": ["{{configId}}"], + "timeframe": "none", + "variables": ["{{variables.[Host]}}"], + "dataStream": { + "id": "datastream-properties", + "name": "properties" + }, + "scope": { + "scope": "{{scopes.[Hosts]}}", + "workspace": "{{workspaceId}}", + "variable": "{{variables.[Host]}}" + }, + "visualisation": { + "type": "data-stream-table", + "config": { "data-stream-table": { "transpose": true } } + } + } + }, + { + "i": "a5ce7ce3-c43c-4713-9b55-468a6abbd363", + "x": 2, + "y": 0, + "w": 2, + "h": 4, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Alert Volume Over Time", + "description": "", + "activePluginConfigIds": ["{{configId}}"], + "variables": ["{{variables.[Host]}}"], + "dataStream": { + "id": "{{dataStreams.[alerts]}}", + "name": "alerts", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "scope": { + "variable": "{{variables.[Host]}}", + "workspace": "{{workspaceId}}", + "scope": "{{scopes.[Hosts]}}" + } + }, + "group": { + "by": [["created_timestamp", "byDay"]], + "aggregate": [{ "type": "count" }] + }, + "sort": { "by": [["created_timestamp_byDay", "asc"]] } + }, + "visualisation": { + "type": "data-stream-bar-chart", + "config": { + "data-stream-bar-chart": { + "xAxisData": "created_timestamp_byDay", + "yAxisData": ["count"], + "xAxisGroup": "none", + "xAxisLabel": "", + "yAxisLabel": "Alerts", + "showXAxisLabel": false, + "showYAxisLabel": true, + "showLegend": false, + "legendPosition": "bottom", + "showGrid": true, + "horizontalLayout": "vertical", + "displayMode": "actual", + "showTotals": false, + "showValue": false, + "grouping": false, + "range": { "type": "auto" } + } + } + } + } + }, + { + "i": "9dd38206-119e-42f7-8859-2465170f4c77", + "x": 0, + "y": 4, + "w": 4, + "h": 4, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Alert Timeline", + "description": "", + "activePluginConfigIds": ["{{configId}}"], + "variables": ["{{variables.[Host]}}"], + "dataStream": { + "id": "{{dataStreams.[alerts]}}", + "name": "alerts", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "scope": { + "variable": "{{variables.[Host]}}", + "workspace": "{{workspaceId}}", + "scope": "{{scopes.[Hosts]}}" + } + }, + "sort": { "by": [["created_timestamp", "desc"]], "top": 20 } + }, + "visualisation": { + "type": "data-stream-table", + "config": { + "data-stream-table": { + "transpose": false, + "columnOrder": [ + "name", + "severity_name", + "status", + "tactic", + "technique", + "filename", + "user_name", + "created_timestamp" + ], + "hiddenColumns": [ + "composite_id", + "device.device_id", + "device.hostname", + "device.platform_name", + "filepath", + "cmdline", + "tags", + "description", + "product", + "type", + "confidence", + "severity", + "updated_timestamp", + "first_behavior", + "last_behavior", + "detectionLatencySeconds", + "responseLatencySeconds" + ] + } + } + } + } + }, + { + "i": "98877648-d423-4ad4-8aa7-c7d4ffc28d32", + "x": 0, + "y": 8, + "w": 4, + "h": 4, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Vulnerabilities", + "description": "Open vulnerabilities for this device", + "activePluginConfigIds": ["{{configId}}"], + "timeframe": "none", + "variables": ["{{variables.[Host]}}"], + "dataStream": { + "id": "{{dataStreams.[vulnerabilities]}}", + "name": "vulnerabilities", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "scope": { + "variable": "{{variables.[Host]}}", + "workspace": "{{workspaceId}}", + "scope": "{{scopes.[Hosts]}}" + } + }, + "filter": { + "multiOperation": "and", + "filters": [{ "column": "status", "operation": "equals", "value": "open" }] + }, + "sort": { "by": [["cve.base_score", "desc"]] } + }, + "visualisation": { + "type": "data-stream-table", + "config": { + "data-stream-table": { + "transpose": false, + "columnOrder": [ + "cve.id", + "cve.severity", + "cve.base_score", + "app.product_name_version", + "cve.exploit_status", + "created_timestamp", + "daysOpen" + ], + "hiddenColumns": [ + "id", + "aid", + "host_info.hostname", + "host_info.platform", + "host_info.local_ip", + "cve.published_date", + "status", + "updated_timestamp", + "closed_timestamp" + ] + } + } + } + } + } + ] + } +} diff --git a/plugins/CrowdStrike/v1/defaultContent/manifest.json b/plugins/CrowdStrike/v1/defaultContent/manifest.json new file mode 100644 index 00000000..04688a6c --- /dev/null +++ b/plugins/CrowdStrike/v1/defaultContent/manifest.json @@ -0,0 +1,7 @@ +{ + "items": [ + { "name": "overview", "type": "dashboard" }, + { "name": "hostGroupPerspective", "type": "dashboard" }, + { "name": "hostPerspective", "type": "dashboard" } + ] +} diff --git a/plugins/CrowdStrike/v1/defaultContent/overview.dash.json b/plugins/CrowdStrike/v1/defaultContent/overview.dash.json new file mode 100644 index 00000000..710d7ca4 --- /dev/null +++ b/plugins/CrowdStrike/v1/defaultContent/overview.dash.json @@ -0,0 +1,656 @@ +{ + "name": "Overview", + "schemaVersion": "1.5", + "timeframe": "last7days", + "dashboard": { + "_type": "layout/grid", + "columns": 4, + "version": 1, + "contents": [ + { + "i": "79e6e308-ec60-435d-9530-a21ddf4d87e7", + "x": 0, + "y": 0, + "w": 1, + "h": 2, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Total Hosts", + "description": "", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "dataStream": { + "id": "{{dataStreams.[hostCount]}}", + "name": "hostCount", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": {} + }, + "visualisation": { + "type": "data-stream-scalar", + "config": { + "data-stream-scalar": { + "value": "result", + "comparisonColumn": "none" + } + } + } + } + }, + { + "i": "2d58c72d-1007-4ceb-9545-3b9e676eed1e", + "x": 1, + "y": 0, + "w": 1, + "h": 2, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Active Alerts", + "description": "Alerts not yet closed, created within the dashboard timeframe", + "activePluginConfigIds": [ + "{{configId}}" + ], + "dataStream": { + "id": "{{dataStreams.[alerts]}}", + "name": "alerts", + "pluginConfigId": "{{configId}}", + "filter": { + "multiOperation": "and", + "filters": [ + { + "column": "status", + "operation": "notequals", + "value": "closed" + } + ] + }, + "group": { + "by": [], + "aggregate": [ + { + "type": "count" + } + ] + } + }, + "visualisation": { + "type": "data-stream-scalar", + "config": { + "data-stream-scalar": { + "value": "count", + "comparisonColumn": "none" + } + } + } + } + }, + { + "i": "772c85e8-9199-4db4-8c86-cb9a4a21182d", + "x": 2, + "y": 0, + "w": 1, + "h": 2, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Open Critical/High Vulnerabilities", + "description": "Open vulnerabilities with Critical or High severity", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "dataStream": { + "id": "{{dataStreams.[vulnerabilityCount]}}", + "name": "vulnerabilityCount", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "severity": [ + "CRITICAL", + "HIGH" + ], + "status": [ + "open" + ] + } + }, + "visualisation": { + "type": "data-stream-scalar", + "config": { + "data-stream-scalar": { + "value": "result", + "comparisonColumn": "none" + } + } + } + } + }, + { + "i": "6dc453e5-358f-439f-9a15-36a06444d52d", + "x": 3, + "y": 0, + "w": 1, + "h": 2, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Contained Hosts", + "description": "Hosts currently network-contained", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "dataStream": { + "id": "{{dataStreams.[hostCount]}}", + "name": "hostCount", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "hostStatus": [ + "contained" + ] + } + }, + "visualisation": { + "type": "data-stream-scalar", + "config": { + "data-stream-scalar": { + "value": "result", + "comparisonColumn": "none" + } + } + } + } + }, + { + "i": "d34b48d7-a07a-434a-a86c-e94cf26beaa6", + "x": 0, + "y": 6, + "w": 2, + "h": 3, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Alerts by Severity", + "description": "", + "activePluginConfigIds": [ + "{{configId}}" + ], + "dataStream": { + "id": "{{dataStreams.[alerts]}}", + "name": "alerts", + "pluginConfigId": "{{configId}}", + "group": { + "by": [ + [ + "severity_name", + "uniqueValues" + ] + ], + "aggregate": [ + { + "type": "count" + } + ] + } + }, + "visualisation": { + "type": "data-stream-donut-chart", + "config": { + "data-stream-donut-chart": { + "valueColumn": "count", + "labelColumn": "severity_name_uniqueValues", + "showValuesAsPercentage": true, + "legendPosition": "auto", + "legendMode": "table" + } + } + } + } + }, + { + "i": "bd32d0d4-022a-4c24-8683-f29c2d473cc3", + "x": 2, + "y": 6, + "w": 2, + "h": 3, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Alerts by Status", + "description": "", + "activePluginConfigIds": [ + "{{configId}}" + ], + "dataStream": { + "id": "{{dataStreams.[alerts]}}", + "name": "alerts", + "pluginConfigId": "{{configId}}", + "group": { + "by": [ + [ + "status", + "uniqueValues" + ] + ], + "aggregate": [ + { + "type": "count" + } + ] + }, + "sort": { + "by": [ + [ + "count", + "desc" + ] + ] + } + }, + "visualisation": { + "type": "data-stream-bar-chart", + "config": { + "data-stream-bar-chart": { + "xAxisData": "status_uniqueValues", + "yAxisData": [ + "count" + ], + "xAxisGroup": "none", + "xAxisLabel": "", + "yAxisLabel": "Alerts", + "showXAxisLabel": false, + "showYAxisLabel": true, + "showLegend": false, + "legendPosition": "bottom", + "showGrid": true, + "horizontalLayout": "vertical", + "displayMode": "actual", + "showTotals": false, + "showValue": true, + "grouping": false, + "range": { + "type": "auto" + } + } + } + } + } + }, + { + "i": "fc1918d4-3d62-4fe9-aa54-e206e12b1130", + "x": 0, + "y": 9, + "w": 4, + "h": 4, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Recently Seen Hosts", + "description": "The 100 most recently seen hosts", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "dataStream": { + "id": "{{dataStreams.[recentHosts]}}", + "name": "recentHosts", + "pluginConfigId": "{{configId}}" + }, + "visualisation": { + "type": "data-stream-table", + "config": { + "data-stream-table": { + "transpose": false, + "columnOrder": [ + "hostname", + "platform_name", + "os_version", + "agent_version", + "status", + "last_seen", + "site_name" + ], + "hiddenColumns": [ + "device_id", + "groups", + "mac_address", + "external_ip", + "machine_domain", + "serial_number", + "system_manufacturer", + "system_product_name", + "first_seen", + "tags", + "product_type_desc", + "reduced_functionality_mode", + "device_policies.prevention.applied", + "device_policies.sensor_update.applied" + ] + } + } + } + } + }, + { + "i": "34f983b0-6cc3-4091-8e04-1870ade28cda", + "x": 0, + "y": 13, + "w": 4, + "h": 4, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Sensor Usage", + "description": "Weekly average of unique sensors seen reporting", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "last30days", + "dataStream": { + "id": "{{dataStreams.[sensorUsage]}}", + "name": "sensorUsage", + "pluginConfigId": "{{configId}}" + }, + "visualisation": { + "type": "data-stream-table", + "config": { + "data-stream-table": { + "transpose": false + } + } + } + } + }, + { + "i": "05e64ee9-4701-4f45-8096-115643dee6f1", + "x": 0, + "y": 2, + "w": 1, + "h": 2, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Windows Hosts", + "description": "", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "dataStream": { + "id": "{{dataStreams.[hostCount]}}", + "name": "hostCount", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "platform": "Windows" + } + }, + "visualisation": { + "type": "data-stream-scalar", + "config": { + "data-stream-scalar": { + "value": "result", + "comparisonColumn": "none" + } + } + } + } + }, + { + "i": "094b40d1-c2dc-4324-b9bb-12404a56be1d", + "x": 1, + "y": 2, + "w": 1, + "h": 2, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Linux Hosts", + "description": "", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "dataStream": { + "id": "{{dataStreams.[hostCount]}}", + "name": "hostCount", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "platform": "Linux" + } + }, + "visualisation": { + "type": "data-stream-scalar", + "config": { + "data-stream-scalar": { + "value": "result", + "comparisonColumn": "none" + } + } + } + } + }, + { + "i": "2fea90b6-fe56-40cf-82c9-d19a915fd4a7", + "x": 2, + "y": 2, + "w": 1, + "h": 2, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Mac Hosts", + "description": "", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "dataStream": { + "id": "{{dataStreams.[hostCount]}}", + "name": "hostCount", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "platform": "Mac" + } + }, + "visualisation": { + "type": "data-stream-scalar", + "config": { + "data-stream-scalar": { + "value": "result", + "comparisonColumn": "none" + } + } + } + } + }, + { + "i": "a70a7c9e-13c4-4ab9-a08a-33f65df11770", + "x": 0, + "y": 4, + "w": 1, + "h": 2, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Critical Vulnerabilities", + "description": "Open vulnerabilities", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "dataStream": { + "id": "{{dataStreams.[vulnerabilityCount]}}", + "name": "vulnerabilityCount", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "severity": [ + "CRITICAL" + ], + "status": [ + "open" + ] + } + }, + "visualisation": { + "type": "data-stream-scalar", + "config": { + "data-stream-scalar": { + "value": "result", + "comparisonColumn": "none" + } + } + } + } + }, + { + "i": "316c45be-3af0-432e-8a04-0cbed91ee3f1", + "x": 1, + "y": 4, + "w": 1, + "h": 2, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "High Vulnerabilities", + "description": "Open vulnerabilities", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "dataStream": { + "id": "{{dataStreams.[vulnerabilityCount]}}", + "name": "vulnerabilityCount", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "severity": [ + "HIGH" + ], + "status": [ + "open" + ] + } + }, + "visualisation": { + "type": "data-stream-scalar", + "config": { + "data-stream-scalar": { + "value": "result", + "comparisonColumn": "none" + } + } + } + } + }, + { + "i": "1a1cda51-d119-471e-889d-a24a7d324492", + "x": 2, + "y": 4, + "w": 1, + "h": 2, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Medium Vulnerabilities", + "description": "Open vulnerabilities", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "dataStream": { + "id": "{{dataStreams.[vulnerabilityCount]}}", + "name": "vulnerabilityCount", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "severity": [ + "MEDIUM" + ], + "status": [ + "open" + ] + } + }, + "visualisation": { + "type": "data-stream-scalar", + "config": { + "data-stream-scalar": { + "value": "result", + "comparisonColumn": "none" + } + } + } + } + }, + { + "i": "7285d9e4-db98-479f-8e6a-5e3bee7f3975", + "x": 3, + "y": 4, + "w": 1, + "h": 2, + "moved": false, + "static": false, + "z": 0, + "config": { + "_type": "tile/data-stream", + "title": "Low Vulnerabilities", + "description": "Open vulnerabilities", + "activePluginConfigIds": [ + "{{configId}}" + ], + "timeframe": "none", + "dataStream": { + "id": "{{dataStreams.[vulnerabilityCount]}}", + "name": "vulnerabilityCount", + "pluginConfigId": "{{configId}}", + "dataSourceConfig": { + "severity": [ + "LOW" + ], + "status": [ + "open" + ] + } + }, + "visualisation": { + "type": "data-stream-scalar", + "config": { + "data-stream-scalar": { + "value": "result", + "comparisonColumn": "none" + } + } + } + } + } + ] + } +} diff --git a/plugins/CrowdStrike/v1/defaultContent/scopes.json b/plugins/CrowdStrike/v1/defaultContent/scopes.json new file mode 100644 index 00000000..aebb5dd4 --- /dev/null +++ b/plugins/CrowdStrike/v1/defaultContent/scopes.json @@ -0,0 +1,26 @@ +[ + { + "name": "Host Groups", + "matches": { + "sourceType": { "type": "oneOf", "values": ["CrowdStrike Host Group"] } + }, + "variable": { + "name": "Host Group", + "allowMultipleSelection": false, + "default": "none", + "type": "object" + } + }, + { + "name": "Hosts", + "matches": { + "sourceType": { "type": "oneOf", "values": ["CrowdStrike Host"] } + }, + "variable": { + "name": "Host", + "allowMultipleSelection": false, + "default": "none", + "type": "object" + } + } +] diff --git a/plugins/CrowdStrike/v1/docs/README.md b/plugins/CrowdStrike/v1/docs/README.md new file mode 100644 index 00000000..b4a7adfd --- /dev/null +++ b/plugins/CrowdStrike/v1/docs/README.md @@ -0,0 +1,63 @@ +Monitor [CrowdStrike Falcon](https://www.crowdstrike.com) host coverage, detections & incidents, vulnerabilities, and policy compliance in SquaredUp, via the [CrowdStrike Falcon API](https://developer.crowdstrike.com). + +## Setup + +You will need a CrowdStrike Falcon **API client** with read scopes for Hosts, Alerts, Spotlight Vulnerabilities, and Sensor Update/Prevention Policies. + +1. Sign in to the [Falcon console](https://falcon.crowdstrike.com). +2. Go to **Support and resources → API clients and keys** and click **Add new API client**. +3. Give the client a name, and grant it **Read** scope for: **Hosts**, **Host Groups**, **Alerts**, **Spotlight Vulnerabilities**, **Sensor Update Policies**, **Prevention Policies**, and **Sensor Usage**. +4. Copy the generated **Client ID** and **Client Secret** — the secret is shown only once. +5. Note the **Cloud** your Falcon tenant runs in (US-1, US-2, EU-1 or US-GOV-1 / GovCloud) and select it in the form below, then enter the Client ID and Client Secret. + +## Configuration fields + +| Field | What it is | Where to find it | Required | +| ----- | ---------- | ----------------- | -------- | +| **CrowdStrike Cloud** | The regional API host your Falcon tenant is hosted in. | **Support and resources → API clients and keys** in the Falcon console. | Yes | +| **Client ID** | Identifies the API client used to authenticate requests. | **Support and resources → API clients and keys**. | Yes | +| **Client Secret** | Authenticates the API client via OAuth2 client-credentials. | Shown once when the API client is created. | Yes | + +On save, the plugin checks the credentials with a minimal Hosts query (`GET /devices/queries/devices/v1`); an invalid Client ID/Secret, wrong Cloud region, or missing Hosts scope fails setup with an authentication error. This check does not test the other scopes, so a missing Alerts, Spotlight Vulnerabilities, policy or Sensor Usage scope only shows up on the tiles that use it. + +## What this plugin monitors + +- **Host coverage** — enrolled endpoints, platform/OS breakdown, sensor version, containment status, and Host Group membership. +- **Detections and incidents** — a unified view of Falcon Alerts (severity, status, tactic/technique, affected host), with computed detection and response latency. +- **Vulnerabilities** — open Spotlight findings per host, with CVE, CVSS score, exploit status and days-open. +- **Policy coverage** — Prevention and Sensor Update policies assigned to each Host Group. +- **Sensor usage** — account-wide weekly average of unique sensors reporting. + +The out-of-the-box dashboards include an account-wide **Overview**, a **Host Group** perspective (select a Host Group/agency to see its coverage, alerts, vulnerabilities and policy compliance), and a **Host** perspective for a single device. + +## Data streams + +- **Host Count** — number of hosts, optionally by platform or containment status, from a single request (fast on large tenants). +- **Vulnerability Count** — number of Spotlight vulnerabilities by host/group, severity and status, from a single request. +- **Recently Seen Hosts** — the 100 most recently seen hosts. +- **Devices** — host inventory (platform, OS, sensor version, network, group membership, policy applied state), account-wide or scoped to a Host or Host Group. +- **Alerts** — detections and incidents from the unified Falcon Alerts API, account-wide or scoped to a Host or Host Group, with a Status filter. +- **Vulnerabilities** — open Spotlight vulnerability findings, account-wide or scoped to a Host or Host Group, with a Status filter. +- **Prevention Policies** — Prevention policies assigned to a Host Group. +- **Sensor Update Policies** — Sensor Update policies assigned to a Host Group. +- **Sensor Usage** — weekly average unique sensor count, account-wide. + +## What gets indexed + +| Object type | API source | Represents | +| ----------- | ---------- | ---------- | +| **CrowdStrike Host Group** | `GET /devices/combined/host-groups/v1` | A Falcon Host Group (used here to represent an agency). | +| **CrowdStrike Host** | `GET /devices/combined/devices/v1` | An enrolled endpoint (workstation, server, etc.). | + +**Relationships:** each Host's `groups` property references the Host Group(s) it belongs to (a host can belong to more than one group). + +## Known limitations + +- **Large tenants** — streams that list hosts, alerts or vulnerabilities page through every result, and one query can make at most 220 requests. Use the count streams for whole-tenant totals and scope list streams to a Host Group. +- **Incidents API not used** — the legacy `/incidents/*` API is deprecated (removed as of March 2026); this plugin uses the unified `/alerts/*` API for both detections and incidents. +- **Time-to-containment is not surfaced** — CrowdStrike's API exposes containment actions but not a completed-containment timestamp, so Response Latency here is the alert's `seconds_to_triaged` (time from creation to triage), not true time-to-containment. It is empty for alerts that haven't been triaged. +- **Host Group scoping for Alerts and Vulnerabilities is unverified** — filtering these by Host Group assumes the alert/vulnerability payload embeds the host's group membership (`device.groups` / `host_info.groups`); if CrowdStrike's response doesn't expose that field, Host-Group-scoped Alerts/Vulnerabilities tiles will need an alternate filter approach. +- **Sensor Usage column names are unverified** — the billing-dashboards-usage endpoint's exact response shape wasn't confirmed against live data; the stream surfaces whatever columns the API returns via a catch-all, so the default table tile may need column renaming once real data is seen. +- **Dashboard filters use assumed raw values** — the Overview tiles filter on assumed raw API values (alert `status` of `new`/`in_progress`/`closed`/`reopened`, host `status` of `contained`, and Spotlight severity values `CRITICAL`/`HIGH`/`MEDIUM`/`LOW` with status `open`); these should be checked against real payloads and adjusted if CrowdStrike's actual values differ. +- **Read-only** — the plugin never creates, modifies, or deletes anything in CrowdStrike Falcon. +- **Requires a paid Falcon subscription with API access** — a trial account may not expose all the scopes this plugin requests (Hosts, Host Groups, Alerts, Spotlight Vulnerabilities, Sensor Update Policies, Prevention Policies, Sensor Usage). diff --git a/plugins/CrowdStrike/v1/icon.svg b/plugins/CrowdStrike/v1/icon.svg new file mode 100644 index 00000000..e05fdf5b --- /dev/null +++ b/plugins/CrowdStrike/v1/icon.svg @@ -0,0 +1,7 @@ + + + + + + + diff --git a/plugins/CrowdStrike/v1/indexDefinitions/default.json b/plugins/CrowdStrike/v1/indexDefinitions/default.json new file mode 100644 index 00000000..8063aedb --- /dev/null +++ b/plugins/CrowdStrike/v1/indexDefinitions/default.json @@ -0,0 +1,39 @@ +{ + "steps": [ + { + "name": "hostGroups", + "dataStream": { "name": "hostGroups", "config": {} }, + "timeframe": "none", + "optional": true, + "objectMapping": { + "id": "id", + "name": "name", + "type": { "value": "CrowdStrike Host Group" }, + "properties": ["description", "group_type", "assignment_rule", "created_timestamp", "modified_timestamp"] + } + }, + { + "name": "devices", + "dataStream": { "name": "hostsIndex", "config": {} }, + "timeframe": "none", + "objectMapping": { + "id": "device_id", + "name": "hostname", + "type": { "value": "CrowdStrike Host" }, + "properties": [ + "platform_name", + "os_version", + "product_type_desc", + "agent_version", + "status", + "first_seen", + "last_seen", + "local_ip", + "external_ip", + "site_name", + "groups" + ] + } + } + ] +} diff --git a/plugins/CrowdStrike/v1/metadata.json b/plugins/CrowdStrike/v1/metadata.json new file mode 100644 index 00000000..ee251d44 --- /dev/null +++ b/plugins/CrowdStrike/v1/metadata.json @@ -0,0 +1,34 @@ +{ + "name": "crowdstrike", + "displayName": "CrowdStrike", + "version": "1.0.14", + "author": { "name": "@JackTSquppy", "type": "community" }, + "description": "Monitor CrowdStrike Falcon host coverage, detections & incidents, vulnerabilities, and policy compliance in SquaredUp.", + "category": "Security", + "type": "hybrid", + "schemaVersion": "2.1", + "importNotSupported": false, + "restrictedToPlatforms": [], + "keywords": ["crowdstrike", "falcon", "edr", "endpoint", "security", "detections", "vulnerabilities", "host group"], + "objectTypes": ["CrowdStrike Host Group", "CrowdStrike Host"], + "links": [ + { + "category": "documentation", + "url": "https://github.com/squaredup/plugins/blob/main/plugins/CrowdStrike/v1/docs/README.md", + "label": "Help adding this plugin" + } + ], + "base": { + "plugin": "WebAPI", + "majorVersion": "1", + "config": { + "baseUrl": "{{ typeof cloudRegion === 'string' ? cloudRegion : (cloudRegion.value || cloudRegion[0].value) }}", + "authMode": "oauth2", + "oauth2GrantType": "clientCredentials", + "oauth2TokenUrl": "{{ typeof cloudRegion === 'string' ? cloudRegion : (cloudRegion.value || cloudRegion[0].value) }}/oauth2/token", + "oauth2ClientId": "{{clientId}}", + "oauth2ClientSecret": "{{clientSecret}}", + "oauth2ClientSecretLocationDuringAuth": "body" + } + } +} diff --git a/plugins/CrowdStrike/v1/ui.json b/plugins/CrowdStrike/v1/ui.json new file mode 100644 index 00000000..67f63c8a --- /dev/null +++ b/plugins/CrowdStrike/v1/ui.json @@ -0,0 +1,35 @@ +[ + { + "type": "autocomplete", + "name": "cloudRegion", + "label": "CrowdStrike Cloud", + "help": "The CrowdStrike cloud your Falcon tenant is hosted in. Shown on the [API Clients and Keys](https://falcon.crowdstrike.com/support/api-clients-and-keys) page as the base URL.", + "validation": { "required": true }, + "isMulti": false, + "allowCustomValues": false, + "data": { + "source": "fixed", + "values": [ + { "value": "https://api.crowdstrike.com", "label": "US-1" }, + { "value": "https://api.us-2.crowdstrike.com", "label": "US-2" }, + { "value": "https://api.eu-1.crowdstrike.com", "label": "EU-1" }, + { "value": "https://api.laggar.gcw.crowdstrike.com", "label": "US-GOV-1" } + ] + } + }, + { + "type": "text", + "name": "clientId", + "label": "Client ID", + "placeholder": "Enter the CrowdStrike API client ID", + "help": "The Client ID of your CrowdStrike API client. [More info](https://falcon.crowdstrike.com/support/api-clients-and-keys)", + "validation": { "required": true } + }, + { + "type": "password", + "name": "clientSecret", + "label": "Client Secret", + "help": "The Client Secret of your CrowdStrike API client. [More info](https://falcon.crowdstrike.com/support/api-clients-and-keys)", + "validation": { "required": true } + } +]