Skip to main content

Cyware Threat Intelligence eXchange

CrowdStrike EDR

Connector Category: Endpoint Detection Response (EDR)

About Integration

CrowdStrike EDR is an endpoint detection and response tool that continuously monitors end-user devices to detect and respond to cyber threats such as ransomware and malware. This integration enables you to upload and delete indicators in the CrowdStrike EDR application with CTIX data (as an internal application).

The CrowdStrike EDR internal application in Intel Exchange supports the following actions:

Action Name

Description

Delete Indicators

This action deletes indicators from the CrowdStrike EDR application.

Upload Indicators

This action uploads indicators to the CrowdStrike EDR application that are retrieved from Intel Exchange.

To configure CrowdStrike EDR as an internal application, follow these steps:

  1. Configure CrowdStrike EDR as an Internal Application 

  2. Enable App Actions 

  3. Create Rule to Upload Indicators in CrowdStrike EDR 

Configure CrowdStrike EDR as an Internal Application

Configure CrowdStrike EDR as an internal application to upload and delete indicators.

Before you Start 

  • You must have the base URL, API ID, and API key of your CrowdStrike EDR account.

  • You must have the view and update tool integration permissions.

Steps 

  1. Go to Administration > Integration Management > Tool Integrations > Internal Applications and select Endpoint Detection Response.

  2. Search and select CrowdStrike EDR.

  3. Click Add Instance and enter the following details:

    • Instance Name: Enter a unique instance name to identify.

    • Base URL: Enter the base URL of your CrowdStrike EDR instance.

    • API ID: Enter the API ID of your CrowdStrike EDR account.

    • API Key: Enter the API key of your CrowdStrike EDR account.

    • Verify SSL: Enable this option to verify the SSL certificate and secure the connection between the CTIX and CrowdStrike EDR servers. By default, Verify SSL is selected.

      Note

      Cyware recommends you select Verify SSL. If you disable this option, CTIX may configure an instance for an expired SSL certificate. This may not establish the connection properly and CTIX will not be able to notify you in case of a broken or improper connection.

  4. Click Save.

The CrowdStrike EDR instance is configured and you can view the actions provided by the CrowdStrike EDR tool. You can configure multiple instances of this integration by clicking Manage > Add More.

Enable App Actions

After configuring the CrowdStrike EDR application on CTIX, enable the actions to upload and delete indicators.

  1. Go to Administration > Integration Management > Tool Integrations > Internal Applications and select Endpoint Detection Response.

  2. Search and select CrowdStrike EDR.

  3. On the upper-right corner, click the vertical ellipsis and click Manage.

  4. Click Manage Action(s).

  5. Select the actions and turn on the toggles to enable.

  6. Click Save.

The actions are enabled and are now ready to use.

Create Rule to Upload Indicators in CrowdStrike EDR

Create a rule to upload specific indicators from CTIX to the CrowdStrike EDR application.

Before you Start 

You must have the View Rules, Create Rules, and Update Rules permissions.

Steps 

To create a rule to upload indicators to the CrowdStrike EDR application, do the following:

  1. Go to  Main Menu > Actions > Rules.

  2. Click New Rule.

  3. Enter a rule name and click Submit.

  4. In Source, select the source and collection from which you want to upload indicators.

  5. In Condition, enter the following details:

    1. Intent Type: Select the intent type as Indicator.

    2. Rule Type: Select a rule type to apply specific conditions.

  6. In Actions, enter the following details:

    1. Actions: Select Upload Indicators.

    2. Application: Select CrowdStrike EDR.

    3. Account: Select a CrowdStrike EDR instance you have configured.

    4. Platform: Select the operating system platforms.

    5. Action to be Taken: Select No Action.

    6. Severity: Select the severity of indicators to be uploaded.

  7. Set the global conditions from Additional Actions. For more information, see Additional Actions for Rules.

  8. Click Save.

The rule is created and indicators will be uploaded to CrowdStrike EDR based on the configured sources and conditions when you run the rule.

Similarly, you can create a rule to delete indicators from CrowdStrike EDR.