diff --git a/LICENSE b/LICENSE index 94b040f..271de55 100644 --- a/LICENSE +++ b/LICENSE @@ -186,7 +186,7 @@ same "printed page" as the copyright notice for easier identification within third-party archives. - Copyright (c) 2019-2023 Splunk Inc. + Copyright (c) 2019-2024 Splunk Inc. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. diff --git a/NOTICE b/NOTICE index 5e66cc5..35027ba 100644 --- a/NOTICE +++ b/NOTICE @@ -1,5 +1,5 @@ Splunk SOAR CrowdStrike OAuth API -Copyright (c) 2019-2023 Splunk Inc. +Copyright (c) 2019-2024 Splunk Inc. Third-party Software Attributions: diff --git a/README.md b/README.md index 260e95d..4f79966 100644 --- a/README.md +++ b/README.md @@ -2,16 +2,16 @@ # CrowdStrike OAuth API Publisher: Splunk -Connector Version: 4.1.0 +Connector Version: 4.2.0 Product Vendor: CrowdStrike Product Name: CrowdStrike Product Version Supported (regex): ".\*" -Minimum Product Version: 6.1.0 +Minimum Product Version: 6.1.1 This app integrates with CrowdStrike OAuth2 authentication standard to implement querying of endpoint security data [comment]: # " File: README.md" -[comment]: # " Copyright (c) 2019-2023 Splunk Inc." +[comment]: # " Copyright (c) 2019-2024 Splunk Inc." [comment]: # "" [comment]: # " Licensed under Apache 2.0 (https://www.apache.org/licenses/LICENSE-2.0.txt)" [comment]: # "" @@ -450,6 +450,16 @@ VARIABLE | REQUIRED | TYPE | DESCRIPTION [check status](#action-check-status) - To check detonation status of the provided resource id [get device scroll](#action-get-device-scroll) - Search for hosts in your environment by platform, hostname, IP, and other criteria with continuous pagination capability (based on offset pointer which expires after 2 minutes with no maximum limit) [get zta data](#action-get-zta-data) - Get Zero Trust Assessment data for one or more hosts by providing agent IDs (AID) +[create ioa rule group](#action-create-ioa-rule-group) - Create an empty IOA Rule Group +[update ioa rule group](#action-update-ioa-rule-group) - Modify an existing IOA Rule Group +[delete ioa rule group](#action-delete-ioa-rule-group) - Delete an existing IOA Rule Group +[list ioa platforms](#action-list-ioa-platforms) - List valid platforms for IOA Rule Groups +[list ioa rule groups](#action-list-ioa-rule-groups) - List IOA Rule Groups +[list ioa severities](#action-list-ioa-severities) - List valid severity values for IOA rules +[list ioa types](#action-list-ioa-types) - List valid types of IOA rules +[create ioa rule](#action-create-ioa-rule) - Create a new IOA Rule +[update ioa rule](#action-update-ioa-rule) - Update an existing IOA Rule +[delete ioa rule](#action-delete-ioa-rule) - Delete an existing IOA Rule ## action: 'test connectivity' Validate the asset configuration for connectivity. This action logs into the site to check the connection and credentials @@ -3377,4 +3387,452 @@ action_result.data.\*.system_serial_number | string | | VMware-42 2a 23 c9 7f action_result.summary | string | | action_result.message | string | | Zero Trust Assessment data fetched successfully summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 + +## action: 'create ioa rule group' +Create an empty IOA Rule Group + +Type: **contain** +Read only: **False** + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**name** | required | Name of the new Rule Group | string | +**description** | required | Longer description for the new Rule Group | string | +**platform** | required | Platform that this Rule Group applies to | string | +**enabled** | optional | Enable the new Rule Group immediately upon creation | boolean | +**policy_id** | optional | Prevention Policy ID to assign the new Rule Group to | string | `crowdstrike prevention policy id` + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.name | string | | my_rule_group +action_result.parameter.description | string | | Custom rule group +action_result.parameter.platform | string | | windows mac linux +action_result.parameter.enabled | boolean | | True False +action_result.parameter.policy_id | string | `crowdstrike prevention policy id` | 2018f9894359493cb756bfa7dd3357a6 +action_result.data.\*.errors | string | | +action_result.data.\*.meta.powered_by | string | | empower-api +action_result.data.\*.meta.query_time | numeric | | 5.917429897 +action_result.data.\*.meta.trace_id | string | | 6b7c63e1-0ebd-4121-90f3-cd53451be245 +action_result.data.\*.resources.\*.id | string | `crowdstrike ioa rule group id` | 3263801f7612424ba923f4e6e4bfe2f2 +action_result.data.\*.resources.\*.customer_id | string | `crowdstrike customer id` | 4061c7ff3b634e22b38274d4b586554r +action_result.data.\*.resources.\*.enabled | boolean | | True False +action_result.data.\*.resources.\*.name | string | | my_rule_group +action_result.data.\*.resources.\*.description | string | | Custom rule group +action_result.data.\*.resources.\*.platform | string | | windows mac linux +action_result.data.\*.resources.\*.deleted | boolean | | True False +action_result.data.\*.resources.\*.rule_ids.\* | string | `crowdstrike ioa rule id` | 6 +action_result.data.\*.resources.\*.comment | string | | Updated description +action_result.data.\*.resources.\*.version | numeric | | 1 +action_result.data.\*.resources.\*.created_by | string | `crowdstrike user id` | 65f616497d0d40d4b6e7a68389323605 +action_result.data.\*.resources.\*.created_on | string | | 2024-01-25T19:17:02.117884262Z +action_result.data.\*.resources.\*.modified_by | string | `crowdstrike user id` | 65f616497d0d40d4b6e7a68389323605 +action_result.data.\*.resources.\*.modified_on | string | | 2024-01-25T19:17:02.117884262Z +action_result.data.\*.resources.\*.committed_on | string | | 0001-01-01T00:00:00Z +action_result.data.\*.resources.\*.assigned_policy_ids.\* | string | `crowdstrike prevention policy id` | 2018f9894359493cb756bfa7dd3357a6 +action_result.summary.rule_group_id | string | | +action_result.message | string | | Rule Group created successfully +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 + +## action: 'update ioa rule group' +Modify an existing IOA Rule Group + +Type: **contain** +Read only: **False** + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**id** | required | Rule Group ID | string | `crowdstrike ioa rule group id` +**version** | required | Latest version of this Rule Group | numeric | +**name** | required | Name of the Rule Group | string | +**description** | required | Longer description for the Rule Group | string | +**enabled** | optional | Enable or disable the Rule Group | boolean | +**comment** | required | Comment for the audit log | string | +**assign_policy_id** | optional | Prevention Policy ID to assign the Rule Group to | string | `crowdstrike prevention policy id` +**remove_policy_id** | optional | Prevention Policy ID to remove the Rule Group from | string | `crowdstrike prevention policy id` + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.id | string | `crowdstrike ioa rule group id` | 3263801f7612424ba923f4e6e4bfe2f2 +action_result.parameter.version | numeric | | 1 +action_result.parameter.name | string | | my_rule_group +action_result.parameter.description | string | | Custom rule group +action_result.parameter.enabled | boolean | | True False +action_result.parameter.comment | boolean | | Updated rule description +action_result.parameter.assign_policy_id | string | `crowdstrike prevention policy id` | 2018f9894359493cb756bfa7dd3357a6 +action_result.parameter.remove_policy_id | string | `crowdstrike prevention policy id` | 2018f9894359493cb756bfa7dd3357a6 +action_result.data.\*.errors | string | | +action_result.data.\*.meta.powered_by | string | | empower-api +action_result.data.\*.meta.query_time | numeric | | 5.917429897 +action_result.data.\*.meta.trace_id | string | | 6b7c63e1-0ebd-4121-90f3-cd53451be245 +action_result.data.\*.resources.\*.id | string | `crowdstrike ioa rule group id` | 3263801f7612424ba923f4e6e4bfe2f2 +action_result.data.\*.resources.\*.customer_id | string | `crowdstrike customer id` | 4061c7ff3b634e22b38274d4b586554r +action_result.data.\*.resources.\*.enabled | boolean | | True False +action_result.data.\*.resources.\*.name | string | | my_rule_group +action_result.data.\*.resources.\*.description | string | | Custom rule group +action_result.data.\*.resources.\*.platform | string | | windows mac linux +action_result.data.\*.resources.\*.deleted | boolean | | True False +action_result.data.\*.resources.\*.rule_ids.\* | string | `crowdstrike ioa rule id` | 6 +action_result.data.\*.resources.\*.comment | string | | Updated description +action_result.data.\*.resources.\*.version | numeric | | 1 +action_result.data.\*.resources.\*.created_by | string | `crowdstrike user id` | 65f616497d0d40d4b6e7a68389323605 +action_result.data.\*.resources.\*.created_on | string | | 2024-01-25T19:17:02.117884262Z +action_result.data.\*.resources.\*.modified_by | string | `crowdstrike user id` | 65f616497d0d40d4b6e7a68389323605 +action_result.data.\*.resources.\*.modified_on | string | | 2024-01-25T19:17:02.117884262Z +action_result.data.\*.resources.\*.committed_on | string | | 0001-01-01T00:00:00Z +action_result.data.\*.resources.\*.assigned_policy_ids.\* | string | `crowdstrike prevention policy id` | 2018f9894359493cb756bfa7dd3357a6 +action_result.data.\*.resources.\*.removed_policy_ids.\* | string | `crowdstrike prevention policy id` | 2018f9894359493cb756bfa7dd3357a6 +action_result.summary.rule_group_id | string | | +action_result.message | string | | Rule Group updated successfully +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 + +## action: 'delete ioa rule group' +Delete an existing IOA Rule Group + +Type: **contain** +Read only: **False** + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**id** | required | Rule Group ID | string | `crowdstrike ioa rule group id` + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.id | string | `crowdstrike ioa rule group id` | 3263801f7612424ba923f4e6e4bfe2f2 +action_result.data.\*.errors | string | | +action_result.data.\*.meta.powered_by | string | | empower-api +action_result.data.\*.meta.query_time | numeric | | 5.917429897 +action_result.data.\*.meta.trace_id | string | | 6b7c63e1-0ebd-4121-90f3-cd53451be245 +action_result.data.\*.meta.writes.resources_affected | numeric | | 1 +action_result.summary.resources_affected | string | | +action_result.message | string | | Deleted 1 rule groups +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 + +## action: 'list ioa platforms' +List valid platforms for IOA Rule Groups + +Type: **investigate** +Read only: **True** + +#### Action Parameters +No parameters are required for this action + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.data.\*.errors | string | | +action_result.data.\*.meta.powered_by | string | | empower-api +action_result.data.\*.meta.query_time | numeric | | 5.917429897 +action_result.data.\*.meta.trace_id | string | | 6b7c63e1-0ebd-4121-90f3-cd53451be245 +action_result.data.\*.resources.\* | string | | windows mac linux +action_result.summary.result_count | numeric | | +action_result.message | string | | Found 3 rule groups +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 + +## action: 'list ioa rule groups' +List IOA Rule Groups + +Type: **investigate** +Read only: **True** + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**fql_query** | optional | FQL query to filter rule groups | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.fql_query | string | | enabled: true + platform: 'mac' +action_result.data.\*.errors | string | | +action_result.data.\*.meta.powered_by | string | | empower-api +action_result.data.\*.meta.query_time | numeric | | 5.917429897 +action_result.data.\*.meta.trace_id | string | | 6b7c63e1-0ebd-4121-90f3-cd53451be245 +action_result.data.\*.resources.\*.instance_id | string | `crowdstrike ioa rule id` | 1 +action_result.data.\*.resources.\*.customer_id | string | `crowdstrike customer id` | 4061c7ff3b634e22b38274d4b586554r +action_result.data.\*.resources.\*.ruletype_id | string | | 5 +action_result.data.\*.resources.\*.ruletype_name | string | | Process Creation +action_result.data.\*.resources.\*.comment | string | | Created rule +action_result.data.\*.resources.\*.enabled | boolean | | True False +action_result.data.\*.resources.\*.deleted | boolean | | True False +action_result.data.\*.resources.\*.magic_cookie | numeric | | 2 +action_result.data.\*.resources.\*.rulegroup_id | string | `crowdstrike ioa rule group id` | 83f596d2f8c04f36ad39182311e90e3a +action_result.data.\*.resources.\*.version_ids.\* | string | | 1 +action_result.data.\*.resources.\*.instance_version | numeric | | 1 +action_result.data.\*.resources.\*.name | string | | BugRule +action_result.data.\*.resources.\*.description | string | | Stops the bug +action_result.data.\*.resources.\*.pattern_id | string | | 41005 +action_result.data.\*.resources.\*.pattern_severity | string | | critical +action_result.data.\*.resources.\*.action_label | string | | Block Execution +action_result.data.\*.resources.\*.disposition_id | numeric | | 30 +action_result.data.\*.resources.\*.field_values.\*.name | string | | GrandparentImageFilename +action_result.data.\*.resources.\*.field_values.\*.value | string | | (?i).+bug.exe +action_result.data.\*.resources.\*.field_values.\*.label | string | | Grandparent Image Filename +action_result.data.\*.resources.\*.field_values.\*.type | string | | excludable +action_result.data.\*.resources.\*.field_values.\*.values.\*.label | string | | include +action_result.data.\*.resources.\*.field_values.\*.values.\*.value | string | | .+bug.exe +action_result.data.\*.resources.\*.field_values.\*.final_value | string | | (?i).+bug.exe +action_result.summary.result_count | numeric | | +action_result.message | string | | Found 3 rule groups +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 + +## action: 'list ioa severities' +List valid severity values for IOA rules + +Type: **investigate** +Read only: **True** + +#### Action Parameters +No parameters are required for this action + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.data.\*.errors | string | | +action_result.data.\*.meta.powered_by | string | | empower-api +action_result.data.\*.meta.query_time | numeric | | 5.917429897 +action_result.data.\*.meta.trace_id | string | | 6b7c63e1-0ebd-4121-90f3-cd53451be245 +action_result.data.\*.resources.\* | string | | informational low medium high critical +action_result.summary.result_count | numeric | | +action_result.message | string | | Found 3 supported platforms +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 + +## action: 'list ioa types' +List valid types of IOA rules + +Type: **investigate** +Read only: **True** + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**platform** | optional | Show only IOA types supported by the given platform | string | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.platform | string | | mac linux windows +action_result.data.\*.errors | string | | +action_result.data.\*.meta.powered_by | string | | empower-api +action_result.data.\*.meta.query_time | numeric | | 5.917429897 +action_result.data.\*.meta.trace_id | string | | 6b7c63e1-0ebd-4121-90f3-cd53451be245 +action_result.data.\*.resources.\*.id | string | | 1 +action_result.data.\*.resources.\*.name | string | | Process Creation +action_result.data.\*.resources.\*.channel | numeric | | 501 +action_result.data.\*.resources.\*.long_desc | string | | Mac basic process custom template. Triggered off of CreateProcessPreventionQueryMac. +action_result.data.\*.resources.\*.released | boolean | | True False +action_result.data.\*.resources.\*.fields.\*.name | string | | GrandparentImageFilename +action_result.data.\*.resources.\*.fields.\*.label | string | | Grandparent Image Filename +action_result.data.\*.resources.\*.fields.\*.type | string | | excludable +action_result.data.\*.resources.\*.fields.\*.type.\*.label | string | | include +action_result.data.\*.resources.\*.fields.\*.type.\*.value | string | | +action_result.data.\*.resources.\*.disposition_map.\*.id | numeric | | 10 +action_result.data.\*.resources.\*.disposition_map.\*.label | string | | Monitor +action_result.data.\*.resources.\*.fields_pretty | string | | {} +action_result.summary.result_count | numeric | | +action_result.message | string | | Found 3 rule types +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 + +## action: 'create ioa rule' +Create a new IOA Rule + +Type: **contain** +Read only: **False** + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**rule_group_id** | required | Rule Group ID in which to create this rule | string | `crowdstrike ioa rule group id` +**name** | required | Rule name | string | +**description** | required | Rule description | string | +**severity** | required | Rule severity (run the "list ioa severities" action to find valid severities) | string | +**rule_type_id** | required | Rule type to create (run the "list ioa types" action to find valid types of rules and their IDs and parameters) | numeric | +**disposition_id** | required | The action that the rule should take when triggered (valid dispositions can be found in the "list ioa types" output) | numeric | +**field_values** | required | JSON list of parameters to pass to the new rule (valid fields can be found in the "list ioa types" output) | string | +**comment** | optional | Comment for the audit log (optional) | string | +**enabled** | optional | Enable this rule immediately | boolean | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.rule_group_id | string | `crowdstrike ioa rule group id` | 83f596d2f8c04f36ad39182311e90e3a +action_result.parameter.name | string | | BugRule +action_result.parameter.description | string | | Stops the bug +action_result.parameter.severity | string | | critical +action_result.parameter.rule_type_id | numeric | | 5 +action_result.parameter.disposition_id | numeric | | 30 +action_result.parameter.field_values | string | | {"label":"Grandparent Image Filename","name":"GrandparentImageFilename","type":"excludable","values":[{"label":"include","value":".+bug.exe"}]}] +action_result.parameter.comment | string | | Example comment +action_result.parameter.enabled | boolean | | True False +action_result.data.\*.errors | string | | +action_result.data.\*.meta.powered_by | string | | empower-api +action_result.data.\*.meta.query_time | numeric | | 5.917429897 +action_result.data.\*.meta.trace_id | string | | 6b7c63e1-0ebd-4121-90f3-cd53451be245 +action_result.data.\*.resources.\*.instance_id | string | `crowdstrike ioa rule id` | 1 +action_result.data.\*.resources.\*.customer_id | string | `crowdstrike customer id` | 4061c7ff3b634e22b38274d4b586554r +action_result.data.\*.resources.\*.ruletype_id | string | | 5 +action_result.data.\*.resources.\*.ruletype_name | string | | Process Creation +action_result.data.\*.resources.\*.comment | string | | Created rule +action_result.data.\*.resources.\*.enabled | boolean | | True False +action_result.data.\*.resources.\*.deleted | boolean | | True False +action_result.data.\*.resources.\*.magic_cookie | numeric | | 2 +action_result.data.\*.resources.\*.rulegroup_id | string | `crowdstrike ioa rule group id` | 83f596d2f8c04f36ad39182311e90e3a +action_result.data.\*.resources.\*.version_ids.\* | string | | 1 +action_result.data.\*.resources.\*.instance_version | numeric | | 1 +action_result.data.\*.resources.\*.name | string | | BugRule +action_result.data.\*.resources.\*.description | string | | Stops the bug +action_result.data.\*.resources.\*.pattern_id | string | | 41005 +action_result.data.\*.resources.\*.pattern_severity | string | | critical +action_result.data.\*.resources.\*.action_label | string | | Block Execution +action_result.data.\*.resources.\*.disposition_id | numeric | | 30 +action_result.data.\*.resources.\*.field_values.\*.name | string | | GrandparentImageFilename +action_result.data.\*.resources.\*.field_values.\*.value | string | | (?i).+bug.exe +action_result.data.\*.resources.\*.field_values.\*.label | string | | Grandparent Image Filename +action_result.data.\*.resources.\*.field_values.\*.type | string | | excludable +action_result.data.\*.resources.\*.field_values.\*.values.\*.label | string | | include +action_result.data.\*.resources.\*.field_values.\*.values.\*.value | string | | .+bug.exe +action_result.data.\*.resources.\*.field_values.\*.final_value | string | | (?i).+bug.exe +action_result.summary.rule_group_id | string | `crowdstrike ioa rule group id` | 83f596d2f8c04f36ad39182311e90e3a +action_result.summary.rule_id | string | `crowdstrike ioa rule id` | 1 +action_result.message | string | | Rule created successfully +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 + +## action: 'update ioa rule' +Update an existing IOA Rule + +Type: **contain** +Read only: **False** + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**rule_group_id** | required | Rule Group ID containing the rule | string | `crowdstrike ioa rule group id` +**rule_group_version** | required | Latest version of Rule Group | numeric | +**rule_id** | required | Rule ID to update | string | `crowdstrike ioa rule id` +**rule_version** | required | Latest version of Rule | numeric | +**name** | required | Rule name | string | +**description** | required | Rule description | string | +**severity** | required | Rule severity (run the "list ioa severities" action to find valid severities) | string | +**disposition_id** | required | The action that the rule should take when triggered (valid dispositions can be found in the "list ioa types" output) | numeric | +**field_values** | required | JSON list of parameters to pass to the new rule (valid fields can be found in the "list ioa types" output) | string | +**comment** | optional | Comment for the audit log (optional) | string | +**enabled** | optional | Enable this rule | boolean | + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.rule_group_id | string | `crowdstrike ioa rule group id` | 83f596d2f8c04f36ad39182311e90e3a +action_result.parameter.rule_group_version | numeric | | 2 +action_result.parameter.rule_id | string | `crowdstrike ioa rule id` | 1 +action_result.parameter.rule_version | numeric | | 1 +action_result.parameter.name | string | | BugRule +action_result.parameter.description | string | | Stops the bug +action_result.parameter.severity | string | | critical +action_result.parameter.disposition_id | numeric | | 30 +action_result.parameter.field_values | string | | {"label":"Grandparent Image Filename","name":"GrandparentImageFilename","type":"excludable","values":[{"label":"include","value":".+bug.exe"}]}] +action_result.parameter.comment | string | | Example comment +action_result.parameter.enabled | boolean | | True False +action_result.data.\*.errors | string | | +action_result.data.\*.meta.powered_by | string | | empower-api +action_result.data.\*.meta.query_time | numeric | | 5.917429897 +action_result.data.\*.meta.trace_id | string | | 6b7c63e1-0ebd-4121-90f3-cd53451be245 +action_result.data.\*.resources.\*.id | string | `crowdstrike ioa rule group id` | 83f596d2f8c04f36ad39182311e90e3a +action_result.data.\*.resources.\*.name | string | | Bug Rule Group +action_result.data.\*.resources.\*.rules.\*.name | string | | BugRule +action_result.data.\*.resources.\*.rules.\*.comment | string | | Updated the thing +action_result.data.\*.resources.\*.rules.\*.deleted | boolean | | True False +action_result.data.\*.resources.\*.rules.\*.enabled | boolean | | True False +action_result.data.\*.resources.\*.rules.\*.created_by | string | `crowdstrike unique user id` | bb777249-c782-4434-b57a-f15ac742926c +action_result.data.\*.resources.\*.rules.\*.created_on | string | `date` | 2021-09-15T09:52:27.651770437Z +action_result.data.\*.resources.\*.rules.\*.pattern_id | string | | 41007 +action_result.data.\*.resources.\*.rules.\*.customer_id | string | `crowdstrike customer id` | 4061c7ff3b634e22b38274d4b586554r +action_result.data.\*.resources.\*.rules.\*.description | string | | Stops the bug +action_result.data.\*.resources.\*.rules.\*.modified_by | string | `crowdstrike unique user id` | bb777249-c782-4434-b57a-f15ac742926c +action_result.data.\*.resources.\*.rules.\*.modified_on | string | `date` | 2021-09-15T09:52:27.651770437Z +action_result.data.\*.resources.\*.rules.\*.ruletype_id | string | | +action_result.data.\*.resource.\*.rules.\*.version_ids.\* | string | | +action_result.data.\*.resource.\*.rules.\*.action_label | string | | +action_result.data.\*.resources.\*.rules.\*.committed_on | string | `date` | 2021-09-15T09:52:27.651770437Z +action_result.data.\*.resources.\*.rules.\*.field_values.\*.name | string | | GrandparentImageFilename +action_result.data.\*.resources.\*.rules.\*.field_values.\*.value | string | | (?i).+bug.exe +action_result.data.\*.resources.\*.rules.\*.field_values.\*.label | string | | Grandparent Image Filename +action_result.data.\*.resources.\*.rules.\*.field_values.\*.type | string | | excludable +action_result.data.\*.resources.\*.rules.\*.field_values.\*.values.\*.label | string | | include +action_result.data.\*.resources.\*.rules.\*.field_values.\*.values.\*.value | string | | .+bug.exe +action_result.data.\*.resources.\*.rules.\*.field_values.\*.final_value | string | | (?i).+bug.exe +action_result.data.\*.resources.\*.rules.\*.magic_cookie | numeric | | 6 +action_result.data.\*.resources.\*.rules.\*.rulegroup_id | string | `crowdstrike ioa rule group id` | +action_result.data.\*.resources.\*.rules.\*.ruletype_name | string | | Process Creation +action_result.data.\*.resources.\*.rules.\*.disposition_id | numeric | | 10 +action_result.data.\*.resources.\*.rules.\*.instance_version | numeric | | 3 +action_result.data.\*.resources.\*.rules.\*.pattern_severity | string | | medium +action_result.data.\*.resources.\*.comment | string | | Created rule +action_result.data.\*.resources.\*.enabled | boolean | | True False +action_result.data.\*.resources.\*.deleted | boolean | | True False +action_result.data.\*.resources.\*.version | numeric | | 2 +action_result.data.\*.resources.\*.platform | string | | mac windows linux +action_result.data.\*.resources.\*.rule_ids.\* | string | `crowdstrike ioa rule id` | 1 +action_result.data.\*.resources.\*.created_by | string | `crowdstrike unique user id` | bb777249-c782-4434-b57a-f15ac742926c +action_result.data.\*.resources.\*.created_on | string | `date` | 2021-09-15T09:52:27.651770437Z +action_result.data.\*.resources.\*.customer_id | string | `crowdstrike customer id` | 4061c7ff3b634e22b38274d4b586554r +action_result.data.\*.resources.\*.description | string | | Stops the bug +action_result.data.\*.resources.\*.modified_by | string | `crowdstrike unique user id` | bb777249-c782-4434-b57a-f15ac742926c +action_result.data.\*.resources.\*.modified_on | string | `date` | 2021-09-15T09:52:27.651770437Z +action_result.data.\*.resources.\*.committed_on | string | `date` | 2021-09-15T09:52:27.651770437Z +action_result.summary.rule_group_id | string | `crowdstrike ioa rule group id` | 83f596d2f8c04f36ad39182311e90e3a +action_result.summary.rule_group_version | numeric | | 1 +action_result.summary.rule_id | string | `crowdstrike ioa rule id` | 1 +action_result.summary.rule_version | numeric | | 1 +action_result.message | string | | Rule updated successfully +summary.total_objects | numeric | | 1 +summary.total_objects_successful | numeric | | 1 + +## action: 'delete ioa rule' +Delete an existing IOA Rule + +Type: **contain** +Read only: **False** + +#### Action Parameters +PARAMETER | REQUIRED | DESCRIPTION | TYPE | CONTAINS +--------- | -------- | ----------- | ---- | -------- +**rule_group_id** | required | Rule Group ID containing the rule | string | `crowdstrike ioa rule group id` +**rule_id** | required | Rule ID to delete | string | `crowdstrike ioa rule id` + +#### Action Output +DATA PATH | TYPE | CONTAINS | EXAMPLE VALUES +--------- | ---- | -------- | -------------- +action_result.status | string | | success failed +action_result.parameter.rule_group_id | string | `crowdstrike ioa rule group id` | 83f596d2f8c04f36ad39182311e90e3a +action_result.parameter.rule_id | string | `crowdstrike ioa rule id` | 1 +action_result.data.\*.errors | string | | +action_result.data.\*.meta.powered_by | string | | empower-api +action_result.data.\*.meta.query_time | numeric | | 5.917429897 +action_result.data.\*.meta.trace_id | string | | 6b7c63e1-0ebd-4121-90f3-cd53451be245 +action_result.summary.resources_affected | string | | +action_result.message | string | | Rule deleted successfully +summary.total_objects | numeric | | 1 summary.total_objects_successful | numeric | | 1 \ No newline at end of file diff --git a/__init__.py b/__init__.py index 44bae34..a21cc51 100644 --- a/__init__.py +++ b/__init__.py @@ -1,6 +1,6 @@ # File: __init__.py # -# Copyright (c) 2019-2023 Splunk Inc. +# Copyright (c) 2019-2024 Splunk Inc. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. diff --git a/crowdstrike_assign_hosts.html b/crowdstrike_assign_hosts.html index 823d87a..ac78627 100644 --- a/crowdstrike_assign_hosts.html +++ b/crowdstrike_assign_hosts.html @@ -10,7 +10,7 @@ {% block widget_content %} + + + + +
+ {% for result in results %} +
+ + + {% if not result.data %} +

No data found

+ + {% else %} +

New IOA Rule

+
+ +
+
+
+ + + + + + + + + + + + + + + + + + + {% for rule_group in result.data %} + {% for resource in rule_group.resources %} + + + + + + + + + + + + + + {% endfor %} + {% endfor %} + +
Rule Group IDRule Group VersionRule IDRule VersionEnabledNameDescriptionSeverityRule TypeDispositionField ValuesComment
+ + {{ resource.rulegroup_id }} +   + + + {{ resource.magic_cookie }} + + {{ resource.instance_id }} +   + + + {{ resource.instance_version }} + {{ resource.enabled }}{{ resource.name }}{{ resource.description }}{{ resource.pattern_severity }}{{ resource.ruletype_name }}{{ resource.action_label }}{{ resource.field_values }}{{ resource.comment }}
+
+
+
+
+
+ {% endif %} + {% endfor %} +
+ + + +{% endblock %} diff --git a/crowdstrike_create_ioa_rule_group.html b/crowdstrike_create_ioa_rule_group.html new file mode 100644 index 0000000..0410c56 --- /dev/null +++ b/crowdstrike_create_ioa_rule_group.html @@ -0,0 +1,216 @@ +{% extends 'widgets/widget_template.html' %} +{% load custom_template %} + +{% block custom_title_prop %}{% if title_logo %}style="background-size: auto 60%; background-position: 50%; background-repeat: no-repeat; background-image: url('/app_resource/{{ title_logo }}');"{% endif %}{% endblock %} +{% block title1 %}{{ title1 }}{% endblock %} +{% block title2 %}{{ title2 }}{% endblock %} +{% block custom_tools %} +{% endblock %} + +{% block widget_content %} + + + + +
+ {% for result in results %} +
+ + + {% if not result.data %} +

No data found

+ + {% else %} +

New Rule Group

+
+ +
+
+
+ + + + + + + + + + + + + + {% for rule_group in result.data %} + {% for resource in rule_group.resources %} + + + + + + + + + + {% endfor %} + {% endfor %} + +
Rule Group IDVersionEnabledNameDescriptionPlatformComment
+ + {{ resource.id }} +   + + + {{ resource.version }}{{ resource.enabled }}{{ resource.name }}{{ resource.description }}{{ resource.platform }}{{ resource.comment }}
+
+
+
+
+

Prevention Policies Attached

+
+ +
+
+
+ + + + + + + + + {% for rule_group in result.data %} + {% for resource in rule_group.resources %} + {% for policy_id in resource.assigned_policy_ids %} + + + + + {% endfor %} + {% endfor %} + {% endfor %} + +
Rule Group IDPrevention Policy ID
+ + {{ resource.id }} +   + + + + + {{ policy_id }} +   + + +
+
+
+
+
+
+ {% endif %} + {% endfor %} +
+ + + +{% endblock %} diff --git a/crowdstrike_create_session.html b/crowdstrike_create_session.html index 397616e..3695dee 100644 --- a/crowdstrike_create_session.html +++ b/crowdstrike_create_session.html @@ -10,7 +10,7 @@ {% block widget_content %} + + + + +
+ {% for result in results %} +
+ + + {% if not result.data %} +

No data found

+ + {% else %} +

Delete Rule

+
+ +
+
+
+ + + + + + + + {% for deletion in result.data %} + + + + {% endfor %} + +
Rules deleted
{{ deletion.meta.writes.resources_affected }}
+
+
+
+
+
+ {% endif %} + {% endfor %} +
+ + + +{% endblock %} diff --git a/crowdstrike_delete_ioa_rule_group.html b/crowdstrike_delete_ioa_rule_group.html new file mode 100644 index 0000000..11716ff --- /dev/null +++ b/crowdstrike_delete_ioa_rule_group.html @@ -0,0 +1,151 @@ +{% extends 'widgets/widget_template.html' %} +{% load custom_template %} + +{% block custom_title_prop %}{% if title_logo %}style="background-size: auto 60%; background-position: 50%; background-repeat: no-repeat; background-image: url('/app_resource/{{ title_logo }}');"{% endif %}{% endblock %} +{% block title1 %}{{ title1 }}{% endblock %} +{% block title2 %}{{ title2 }}{% endblock %} +{% block custom_tools %} +{% endblock %} + +{% block widget_content %} + + + + +
+ {% for result in results %} +
+ + + {% if not result.data %} +

No data found

+ + {% else %} +

Delete Rule Group

+
+ +
+
+
+ + + + + + + + {% for deletion in result.data %} + + + + {% endfor %} + +
Rule groups deleted
{{ deletion.meta.writes.resources_affected }}
+
+
+
+
+
+ {% endif %} + {% endfor %} +
+ + + +{% endblock %} diff --git a/crowdstrike_detonate_file.html b/crowdstrike_detonate_file.html index 769d78c..5763fd0 100644 --- a/crowdstrike_detonate_file.html +++ b/crowdstrike_detonate_file.html @@ -10,7 +10,7 @@ {% block widget_content %} + + + + +
+ {% for result in results %} +
+ + + {% if not result.data %} +

No data found

+ + {% else %} +

Supported Platforms for IOA Rules

+
+ +
+
+
+ + + + + + + + {% for platform in result.data %} + {% for platform_name in platform.resources %} + + + + {% endfor %} + {% endfor %} + +
Platform
{{ platform_name }}
+
+
+
+
+
+ {% endif %} + {% endfor %} +
+ + + +{% endblock %} diff --git a/crowdstrike_list_ioa_rule_groups.html b/crowdstrike_list_ioa_rule_groups.html new file mode 100644 index 0000000..582364d --- /dev/null +++ b/crowdstrike_list_ioa_rule_groups.html @@ -0,0 +1,213 @@ +{% extends 'widgets/widget_template.html' %} +{% load custom_template %} + +{% block custom_title_prop %}{% if title_logo %}style="background-size: auto 60%; background-position: 50%; background-repeat: no-repeat; background-image: url('/app_resource/{{ title_logo }}');"{% endif %}{% endblock %} +{% block title1 %}{{ title1 }}{% endblock %} +{% block title2 %}{{ title2 }}{% endblock %} +{% block custom_tools %} +{% endblock %} + +{% block widget_content %} + + + + +
+ {% for result in results %} +
+ + + {% if not result.data %} +

No data found

+ + {% else %} +

Rule Groups

+
+ +
+ {% for rule_group in result.data %} + {% for resource in rule_group.resources %} +
+
+

Rule Group {{ resource.name }}

+ + + + + + + + + + + + + + + + + + + + + + + +
Rule Group IDVersionEnabledNameDescriptionPlatformComment
+ + {{ resource.id }} +   + + + {{ resource.version }}{{ resource.enabled }}{{ resource.name }}{{ resource.description }}{{ resource.platform }}{{ resource.comment }}
+

Rules

+ + + + + + + + + + + + + + + + + {% for rule in resource.rules %} + + + + + + + + + + + + + {% endfor %} + +
Rule IDRule VersionEnabledNameDescriptionRule TypeSeverityActionField ValuesComment
+ + {{ rule.instance_id }} +   + + + {{ rule.instance_version }}{{ rule.enabled }}{{ rule.name }}{{ rule.description }}{{ rule.ruletype_name }}{{ rule.pattern_severity }}{{ rule.action_label }}{{ rule.field_values }}{{ rule.comment }}
+
+
+
+ {% endfor %} + {% endfor %} +
+
+
+ {% endif %} + {% endfor %} +
+ + +{% endblock %} diff --git a/crowdstrike_list_ioa_severities.html b/crowdstrike_list_ioa_severities.html new file mode 100644 index 0000000..6ca742c --- /dev/null +++ b/crowdstrike_list_ioa_severities.html @@ -0,0 +1,153 @@ +{% extends 'widgets/widget_template.html' %} +{% load custom_template %} + +{% block custom_title_prop %}{% if title_logo %}style="background-size: auto 60%; background-position: 50%; background-repeat: no-repeat; background-image: url('/app_resource/{{ title_logo }}');"{% endif %}{% endblock %} +{% block title1 %}{{ title1 }}{% endblock %} +{% block title2 %}{{ title2 }}{% endblock %} +{% block custom_tools %} +{% endblock %} + +{% block widget_content %} + + + + +
+ {% for result in results %} +
+ + + {% if not result.data %} +

No data found

+ + {% else %} +

Valid Severities for IOA Rules

+
+ +
+
+
+ + + + + + + + {% for severity in result.data %} + {% for severity_id in severity.resources %} + + + + {% endfor %} + {% endfor %} + +
Severity
{{ severity_id }}
+
+
+
+
+
+ {% endif %} + {% endfor %} +
+ + + +{% endblock %} diff --git a/crowdstrike_list_ioa_types.html b/crowdstrike_list_ioa_types.html new file mode 100644 index 0000000..345348c --- /dev/null +++ b/crowdstrike_list_ioa_types.html @@ -0,0 +1,414 @@ +{% extends 'widgets/widget_template.html' %} +{% load custom_template %} + +{% block custom_title_prop %}{% if title_logo %}style="background-size: auto 60%; background-position: 50%; background-repeat: no-repeat; background-image: url('/app_resource/{{ title_logo }}');"{% endif %}{% endblock %} +{% block title1 %}{{ title1 }}{% endblock %} +{% block title2 %}{{ title2 }}{% endblock %} +{% block custom_tools %} +{% endblock %} + +{% block widget_content %} + + + + +
+ {% for result in results %} +
+ + + {% if not result.data %} +

No data found

+ + {% else %} +

Available IOA Rule Types

+
+ +
+ {% for type_info in result.data %} + {% for type in type_info.resources %} +
+

{{ type.name }}

+
+ + + + + + + + + + + + + + + +
Rule Type IDPlatformDescription
{{ type.id }}{{ type.platform }}{{ type.long_desc }}
+
+
+

Valid disposition IDs

+ + + + + + + + + {% for disposition in type.disposition_map %} + + + + + {% endfor %} + +
Disposition IDDescription
{{ disposition.id }}{{ disposition.label }}
+
+
+

Rule Parameters

+
+ Fill in this form to generate a JSON list of fields. + This list can be pasted into the "field_values" parameter when creating or updating an IOA rule. +
+
{{ type.fields_pretty }}
+
+
+
+

JSON Output

+ 
+
+
+
+
+
+ {% endfor %} + {% endfor %} +
+
+
+ {% endif %} + {% endfor %} +
+ + + + +{% endblock %} diff --git a/crowdstrike_list_users.html b/crowdstrike_list_users.html index 7f52f7a..7f94430 100644 --- a/crowdstrike_list_users.html +++ b/crowdstrike_list_users.html @@ -10,7 +10,7 @@ {% block widget_content %} + + + + +
+ {% for result in results %} +
+ + + {% if not result.data %} +

No data found

+ + {% else %} +

Updated Rule

+
+ +
+
+
+ + + + + + + + + + + + + + {% for rule_group in result.data %} + {% for resource in rule_group.resources %} + + + + + + + + + + {% endfor %} + {% endfor %} + +
Rule Group IDVersionEnabledNameDescriptionPlatformComment
+ + {{ resource.id }} +   + + + {{ resource.version }}{{ resource.enabled }}{{ resource.name }}{{ resource.description }}{{ resource.platform }}{{ resource.comment }}
+
+
+
+
+

Rules

+
+
+
+
+ {% for rule_group in result.data %} + {% for resource in rule_group.resources %} + + + + + + + + + + + + + + + + + {% for rule in resource.rules %} + + + + + + + + + + + + + {% endfor %} + +
Rule IDRule VersionEnabledNameDescriptionRule TypeSeverityActionField ValuesComment
+ + {{ rule.instance_id }} +   + + + {{ rule.instance_version }}{{ rule.enabled }}{{ rule.name }}{{ rule.description }}{{ rule.ruletype_name }}{{ rule.pattern_severity }}{{ rule.action_label }}{{ rule.field_values }}{{ rule.comment }}
+ {% endfor %} + {% endfor %} +
+
+
+
+
+ {% endif %} + {% endfor %} +
+ + + +{% endblock %} diff --git a/crowdstrike_update_ioa_rule_group.html b/crowdstrike_update_ioa_rule_group.html new file mode 100644 index 0000000..bee461a --- /dev/null +++ b/crowdstrike_update_ioa_rule_group.html @@ -0,0 +1,312 @@ +{% extends 'widgets/widget_template.html' %} +{% load custom_template %} + +{% block custom_title_prop %}{% if title_logo %}style="background-size: auto 60%; background-position: 50%; background-repeat: no-repeat; background-image: url('/app_resource/{{ title_logo }}');"{% endif %}{% endblock %} +{% block title1 %}{{ title1 }}{% endblock %} +{% block title2 %}{{ title2 }}{% endblock %} +{% block custom_tools %} +{% endblock %} + +{% block widget_content %} + + + + +
+ {% for result in results %} +
+ + + {% if not result.data %} +

No data found

+ + {% else %} +

Updated Rule Group

+
+ +
+
+
+ + + + + + + + + + + + + + {% for rule_group in result.data %} + {% for resource in rule_group.resources %} + + + + + + + + + + {% endfor %} + {% endfor %} + +
Rule Group IDVersionEnabledNameDescriptionPlatformComment
+ + {{ resource.id }} +   + + + {{ resource.version }}{{ resource.enabled }}{{ resource.name }}{{ resource.description }}{{ resource.platform }}{{ resource.comment }}
+
+
+
+
+

Rules

+
+
+
+
+ {% for rule_group in result.data %} + {% for resource in rule_group.resources %} + + + + + + + + + + + + + + + + + {% for rule in resource.rules %} + + + + + + + + + + + + + {% endfor %} + +
Rule IDRule VersionEnabledNameDescriptionRule TypeSeverityActionField ValuesComment
+ + {{ rule.instance_id }} +   + + + {{ rule.instance_version }}{{ rule.enabled }}{{ rule.name }}{{ rule.description }}{{ rule.ruletype_name }}{{ rule.pattern_severity }}{{ rule.action_label }}{{ rule.field_values }}{{ rule.comment }}
+ {% endfor %} + {% endfor %} +
+
+
+
+

Prevention Policies Attached

+
+ +
+
+
+ + + + + + + + + {% for rule_group in result.data %} + {% for resource in rule_group.resources %} + {% for policy_id in resource.assigned_policy_ids %} + + + + + {% endfor %} + {% endfor %} + {% endfor %} + +
Rule Group IDPrevention Policy ID
+ + {{ resource.id }} +   + + + + + {{ policy_id }} +   + + +
+
+
+
+
+

Prevention Policies Removed

+
+ +
+
+
+ + + + + + + + + {% for rule_group in result.data %} + {% for resource in rule_group.resources %} + {% for policy_id in resource.removed_policy_ids %} + + + + + {% endfor %} + {% endfor %} + {% endfor %} + +
Rule Group IDPrevention Policy ID
+ + {{ resource.id }} +   + + + + + {{ policy_id }} +   + + +
+
+
+
+
+
+ {% endif %} + {% endfor %} +
+ + + +{% endblock %} diff --git a/crowdstrike_url_reputation.html b/crowdstrike_url_reputation.html index 7fff63d..1268228 100644 --- a/crowdstrike_url_reputation.html +++ b/crowdstrike_url_reputation.html @@ -10,7 +10,7 @@ {% block widget_content %}