Package: falcon-integration-gateway
falcon-integration-gatewayFalcon Integration Gateway (FIG) forwards threat detection findings and audit events from the CrowdStrike Falcon platform to thebackendof your choice.Detection findings and audit events generated by CrowdStrike Falcon platform inform you about suspicious files and behaviors in your environment. You will see detections on a range of activities from the presence of a bad file (indicator of compromise (IOC)) to a nuanced collection of suspicious behaviors (indicator of attack (IOA)) occurring on one of your hosts or containers. You can learn more about the individual detections inFalcon documentation.This project facilitates the export of the individual detections and audit events from CrowdStrike Falcon to third-party security dashboards (so called backends). The export is useful in cases where security operation team workflows are tied to given third-party solution to get early real-time heads-up about malicious activities or unusual user activities detected by CrowdStrike Falcon platform.API ScopesAPI clients are granted one or more API scopes. Scopes allow access to specific CrowdStrike APIs and describe the actions that an API client can perform.FIG requires the following API scopes at a minimum:Event streams: [Read]Hosts: [Read]Consult the backend guides for additional API scopes that may be required.Backends w/ Available Deployment Guide(s)BackendDescriptionDeployment Guide(s)General Guide(s)AWSPushes events to AWS Security HubManual DeploymentAWS backendAWS_SQSPushes events to AWS SQSComing SoonAWS SQS backendAzurePushes events to Azure Log AnalyticsDeployment to AKSAzure backendChroniclePushes events to Google ChronicleDeployment to GKE(usingmarketplace)Deployment to GKE(manual)Chronicle backendCloudTrail LakePushes events to AWS CloudTrail LakeDeployment to EKSManual DeploymentCloudTrail Lake backendGCPPushes events to GCP Security Command CenterDeployment to GKE(usingmarketplace)Deployment to GKE(manual)GCP backendWorkspace ONEPushes events to VMware Workspace ONE IntelligenceComing SoonWorkspace ONE backendGenericDisplays events to STDOUT (useful for dev/debugging)N/AGeneric BackendAlternative Deployment Options:exclamation: Prior to any deployment, ensure you refer to theconfiguration optionsavailable to the application :exclamation:Installation to Kubernetes using the helm chartPlease refer to theFIG helm chart documentationfor detailed instructions on deploying the FIG via helm chart for your respective backend(s).Manual Installation and RemovalWith Docker/PodmanTo install as a container:Pull the imagedockerpullquay.io/crowdstrike/falcon-integration-gateway:latestRun the application in the background passing in your backendCONFIGoptions as environment variablesdockerrun-d--rm\-eFALCON_CLIENT_ID="$FALCON_CLIENT_ID"\-eFALCON_CLIENT_SECRET="$FALCON_CLIENT_SECRET"\-eFALCON_CLOUD_REGION="us-1"\-eFIG_BACKENDS=<BACKEND>\-eCONFIG_OPTION=CONFIG_OPTION_VALUE\quay.io/crowdstrike/falcon-integration-gateway:latestConfirm deploymentdockerlogs<container>From Git RepositoryClone the repositorygitclonehttps://github.com/CrowdStrike/falcon-integration-gateway.gitInstall the python dependencies.pipinstall-rrequirements.txtModify the./config/config.inifile with your backend optionsRun the applicationpython3-mfigDevelopers GuideStatement of SupportFalcon Integration Gateway (FIG) is a community-driven, open source project designed to forward threat detection findings and audit events from the CrowdStrike Falcon platform to the backend of your choice. While not a formal CrowdStrike product, FIG is maintained by CrowdStrike and supported in partnership with the open source community.