Skip to main content

CollectorsCloud Collectors Administration Guide

CrowdStrike Falcon (via FDR) Cloud Collector

Migrate to the CrowdStrike Falcon (via FDR) Cloud Collector

With Exabeam Cloud Collectors, the CrowdStrike Falcon (via FDR) Cloud Collector is now available for the Exabeam Security Operations Platform. The new cloud collector enables you to ingest logs into the Exabeam Security Operations Platform and use the Exabeam Search to find specific events in those logs. Migration to the new app is recommended.

If you previously used the early access CrowdStrike Falcon (via S3) Cloud Connector, and want to take advantage of the new Cloud Collectors service, you must first migrate the SaaS cloud connector. Before you migrate, consider the following:

  • License Requirements: No additional license is required. The Cloud Collectors app is included with your existing license.

  • SaaS Cloud Connectors Support: Both the SaaS Cloud Connectors and the new Cloud Collectors environments can run in parallel.

The following table displays that the CrowdStrike Cloud Connector's FDR Items Explorer endpoint and endpoint-fdr are mapped to the new Cloud Collector CrowdStrike Falcon (via FDR).

Legacy Connector

Legacy Endpoint

New Collector

CrowdStrike

  • FDR Items Explorer

  • endpoint-fdr

CrowdStrike Falcon (via FDR)

To migrate to the CrowdStrike Falcon (via FDR) Cloud Collector, use the following steps:

  1. Log in to the Exabeam Security Operations Platform with your registered credentials as an administrator.

  2. Navigate to Collectors > SaaS Cloud Connectors.

    Migrate_to_Crowdstrike_CC.png

    Note

    To use the Migrate functionality, ensure that you have Exabeam Cloud Connectors version 2.5.483 or a later version.

  3. On the SaaS Cloud Connectors platform, navigate to Settings > Accounts.

  4. Click Migrate for the CrowdStrike account that you want to migrate to the Cloud Collectors service.

    Migrate_to_Crowdstrike_CC_2.png

  5. Click Migrate for the endpoint that you want to migrate: streaming-api or fdr.

    Migrate_to_Crowdstrike_CC_3.png

    After you click Migrate, a cloud connector is migrated to Cloud Collectors on  Exabeam Security Operations Platform .

  6. To view the migrated connector, click View Migrated Collector.

    Migrate_to_Crowdstrike_CC__4FDR.png

    The migrated CrowdStrike Cloud Collector is ready to ingest data.

    Migrate_to_Crowdstrike_CC_5_FDR.png

  7. Verify if the migrated CrowdStrike Cloud Collector instance is running smoothly by checking the status of the cloud collector.

    • If you see any errors, refer to the Error Messages section for resolution or contact Exabeam support. If errors persist and you want to use the old SaaS cloud connector, delete the newly migrated CrowdStrike Cloud Collector instance on the Exabeam Security Operations Platform and continue to use the SaaS cloud connector.

    • After successful migration, if the newly migrated CrowdStrike Cloud Collector runs smoothly, consider deleting the old CrowdStrike Cloud Connector on the SaaS Cloud Connectors platform to avoid event duplication.

      Migrate_to_Crowdstrike_CC_6-FDR.png

.

Prerequisites to Configure the CrowdStrike Falcon (via FDR) Cloud Collector

CrowdStrike supports Falcon Data Replicator (FDR) to retrieve events. FDR provides raw event data. Contact CrowdStrike support to obtain a managed AWS S3 bucket for storage for a short duration and Simple Queue Service (SQS) for notifications about newly created files. CrowdStrike support will provide you with Access Key, Access Secret, SQS region, and SQS URL.

Before you configure the CrowdStrike Falcon collector you must complete the following prerequisites:

  • Ensure that the https://*.crowdstrike.com service is open for communication with the Exabeam Security Operations Platform.

  • Make sure that you have Admin privileges for the Falcon platform and paid membership for Falcon Insight and Falcon Prevent products.

  • Contact CrowdStrike support to obtain the cloud endpoint API gateway assigned to your API client.

    Note

    CrowdStrike assigns a cloud endpoint, also called an API gateway, to each API client. For example: https://api.crowdstrike.com or https://api.us-2.crowdstrike.com.

  • Obtain Access Key, Access Secret, SQS region, and SQS URL. Contact CrowdStrike support to request a managed AWS S3 bucket for short-term storage and an SQS for new file notifications. Obtain the Access Key, Access Secret, SQS region, and SQS URL from the CrowdStrike support team.

Proceed to Configure the CrowdStrike Falcon (via FDR) Cloud Collector.

Configure the CrowdStrike Falcon (via FDR) Cloud Collector

The CrowdStrike Falcon (via FDR) Cloud Collector collects the data stored in S3 bucket to ingest data in the Exabeam Security Operations Platform.

To configure the CrowdStrike Falcon (via FDR) Cloud Collector:

  1. Complete the prerequisites to configure the CrowdStrike Falcon (via FDR) Cloud Collector.

  2. Log in to the Exabeam Security Operations Platform with your registered credentials as an administrator.

  3. Navigate to Collectors > Cloud Collectors.

  4. Click New Collector.

    Crowdstrike_collectors_page.png

  5. Click CrowdStrike Falcon (via FDR).

    Crowdstrike_FDR1.png

  6. Specify a name for the Cloud Collector instance.

  7. Enter the Access Key and Secret Key that you obtained from CrowdStrike support while completing the prerequisites.

  8. Select the SQS region. For example, us-west-1.

  9. In the Ingest From field, select the time and date to provide a threshold before which the collector will exclude events. If you leave this field blank and do not provide a threshold, all logs are ingested.

  10. (Optional) SITE – Select an existing site or to create a new site with a unique ID, click manage your sites. Adding a site name helps you to ensure efficient management of environments with overlapping IP addresses.

    By entering a site name, you associate the logs with a specific independent site. A sitename metadata field is automatically added to all the events that are going to be ingested via this collector. For more information about Site Management, see Define a Unique Site Name.

  11. (Optional) TIMEZONE – Select a time zone applicable to you for accurate detections and event monitoring.

    By entering a time zone, you override the default log time zone. A timezone metadata field is automatically added to all events ingested through this collector.

    Timezone_sitename_site_management_1.png

  12. (Optional) Add filter conditions using regex syntax to include and exempt logs.

    Note

    This feature is available as a part of the early access program. To participate, see Sign Up for the Early Access Program.

    Azure_Event_Hub_Regex_Egress_filtering.png

    • In the Allowed Conditions section, add conditions to include logs to be sent to the Exabeam Security Operations Platform.

      For example, for EventCode that matches 100X, use the Allowed Condition EventCode=100[0-9].

      Raw log:

      LogName=Application EventCode=1001 EventType=4 ComputerName=windows-splunk-forwarder-vp-23 SourceName=Windows Error Reporting Type=Information RecordNumber=168946846 Keywords=Classic TaskCategory=None OpCode=Info Message=Fault bucket , type 0 Event Name: APPCRASH Response: Not available Cab Id: 0

    • In the Deny Conditions section, add conditions for the logs that you don't want to send to the Exabeam Security Operations Platform.

      For example, if you don't want to include eventType between 1 and 5, use the Deny Condition EventType=[1-5].

      Raw log:

      LogName=Application EventCode=1001 EventType=4 ComputerName=windows-splunk-forwarder-vp-23 SourceName=Windows Error Reporting Type=Information RecordNumber=168946846 Keywords=Classic TaskCategory=None OpCode=Info Message=Fault bucket , type 0 Event Name: APPCRASH Response: Not available Cab Id: 0
      Azure_Event_Hub_Regex_Egress_filtering2.png

  13. Click Check Filters to verify if the filters are providing the correct results. Then, add log files or paste raw logs in the right pane to verify if the filters that you set are working appropriately.

    Azure_Event_Hub_Regex_Egress_filtering_3_1.png

  14. Click Import.

    If you specify the Allowed and Deny conditions, the cloud collector processes logs based on your conditions. Ensure that the regex pattern that you specify is valid.

    Refer to the following screenshot as an example of the logs that are processed based on the Allowed and Deny conditions.

    Azure_Event_Hub_Regex_Egress_filtering_3.png

    Note

    Using egress filters affects the performance of the collector and decreases overall EPS. The more you set complex filters, the bigger impact you will observe on the collector performance. For example with three filters, overall EPS can decrease approximately by 15% to 20% based on the filter complexity.

  15. To confirm that the Exabeam Security Operations Platform communicates with the service, click Test Connection. 

  16. Click Install.

    AWS_S3_2.png

    A confirmation message informs you that the new collector is created.