Panther supports pulling logs directly from CrowdStrike events by integrating with the CrowdStrike Falcon Data Replicator (FDR). To ingest CrowdStrike logs into panther, you must have an active subscription to FDR, and it must be enabled in CrowdStrike.
As of Panther version 1.52, all new CrowdStrike log source configurations will use the Crowdstrike.FDREvent schema.
The Trigger an alert when no events are processed setting defaults to YES. We recommend leaving this enabled, as you will be alerted if data stops flowing from the log source after a certain period of time. The timeframe is configurable, with a default of 24 hours.
Not all FDR events contain the same fields. To accommodate this, the value of fdr_event_type is assigned dynamically, according to the following rules (ordered by precedence):
If event_simpleName is present, fdr_event_type = event_simpleName
If event_type is present, fdr_event_type = event.event_type
If ExternalApiType is present, fdr_event_type = event.ExternalApiType
Crowdstrike.DetectionSummary and Crowdstrike.ActivityAudit log types define this ExternalApiType field.
Existing CrowdStrike log source configurations set up prior to Panther version 1.52 will continue to function using the legacy log types below, until you transition them to Crowdstrike.FDREvent. Please contact your Panther support team if you would like assistance with this transition.
Crowdstrike.AIDMaster
Sensor and Host information provided by Falcon Insight.
schema:Crowdstrike.AIDMasterparser:native:name:Crowdstrike.AIDMasterdescription:Sensor and Host information provided by Falcon InsightreferenceURL:https://developer.crowdstrike.com/crowdstrike/docs/falcon-data-replicator-guide#section-aid-masterfields: - name:Timerequired:true description: Timestamp of when the event was received by the CrowdStrike cloud. This is not to be confused with the time the event was generated locally on the system (the _timeevent). This is the timestamp of the event from the cloud's point of view. This value can be converted to any time format and can be used for calculations.
type:timestamptimeFormat:unixisEventTime:true - name:AgentLoadFlagsrequired:truedescription:'Whether the sensor loaded during or after the Windows host''s boot process. Example values: 0, 1'type:int - name:AgentLocalTimerequired:truedescription:The local time for the sensor in epoch format.type:timestamptimeFormat:unix - name:AgentTimeOffsetrequired:truedescription:The time since the last reboot in epoch format.type:float - name:AgentVersionrequired:truedescription:The version of the sensor running on a host.type:string - name:aidrequired:true description: The sensor ID. This value is unique to each installation of a Falcon sensor. When a sensor is updated or reinstalled, the host gets a new aid. In those situations, a single host could have multiple aid values over time.
type:stringindicators: - md5 - trace_id - name:cidrequired:truedescription:The customer ID.type:stringindicators: - md5 - trace_id - name:aiprequired:true description: The sensor’s IP, as seen from the CrowdStrike cloud. This is typically the public IP of the sensor. This helps determine the location of a computer, depending on your network.
type:stringindicators: - ip - name:BiosManufacturerdescription:The manufacturer of the host's BIOS.type:string - name:BiosVersiondescription:The version of the host's BIOS.type:string - name:ChassisTypedescription:Type of system chassis, as defined in SMBIOS Standard.type:string - name:Citydescription:The system's city of origin.type:string - name:Countrydescription:The system's country of origin.type:string - name:Continentdescription:The sensor's continent, as seen from the CrowdStrike cloud.type:string - name:ComputerNamedescription:The name of the host.type:string - name:ConfigBuilddescription:ConfigBuild fieldtype:string - name:ConfigIDBuilddescription:Build number used as part of the ConfigID.type:string - name:event_platformdescription:'The platform the sensor is running on. Example values: ''Win'', ''Lin'', ''Mac''.'type:string - name:FalconGroupingTagsdescription:FalconGroupingTags fieldtype:string - name:FirstSeendescription:The first time the sensor was seen by the CrowdStrike cloud in epoch format.type:timestamptimeFormat:unix - name:MachineDomaindescription:The Windows domain name to which the host is currently joined.type:string - name:OUdescription:The organizational unit of the host as seen by the sensor (defined by system admin).type:string - name:PointerSize description: 'The processor architecture (in decimal, non-hex format): ''4'' for 32-bit, ''8'' for 64-bit, or ''none'' for unknown.'
type:string - name:ProductType description: 'The type of product (in decimal, non-hex format). Example values: ''1'' (Workstation), ''2'' (Domain Controller), ''3'' (Server).'
type:string - name:SensorGroupingTagsdescription:SensorGroupingTags fieldtype:string - name:ServicePackMajordescription:'The major version # of the OS Service Pack (in decimal, non-hex format).'type:string - name:SiteNamedescription:The site name of the domain to which the host is joined (defined by system admin).type:string - name:SystemManufacturerdescription:The host's system manufacturer.type:string - name:SystemProductNamedescription:The host's product name.type:string - name:Timezonedescription:The sensor's time zone, as seen from the CrowdStrike cloud.type:string - name:Versiondescription:The host's system version.type:string - name:HostHiddenStatusdescription:Whether the host is visible or not.type:string
schema:Crowdstrike.ActivityAuditparser:native:name:Crowdstrike.ActivityAuditdescription:Contains activity audit informationreferenceURL:https://developer.crowdstrike.com/crowdstrike/docs/streaming-api-events#section-authenticationfields: - name:AgentIdStringdescription:The Agent IDtype:string - name:ciddescription:The customer ID. A 32-character (hex) identifier in the CrowdStrike cloud.type:stringindicators: - md5 - trace_id - name:ExternalApiTyperequired:truedescription:The external API typetype:string - name:Noncedescription:The noncetype:bigint - name:ServiceNamedescription:The service nametype:string - name:UserId description: User that performed the operation, e.g. person that performed the operation to create a new user account.
type:stringindicators: - email - name:UserIpdescription:IP address of user that performs the operation.type:stringindicators: - ip - name:CustomerIdStringdescription:Unique ID assigned by CS for each customer.type:string - name:EventTyperequired:truedescription:Will be Event_ExternalApiEventtype:string - name:OperationNamedescription:The operation nametype:string - name:UTCTimestampdescription:The timestamptype:timestamptimeFormat:unix_ms - name:timestamprequired:truedescription:The timestamptype:timestamptimeFormat:rfc3339isEventTime:true - name:AuditKeyValuesdescription:The AuditKeyValuestype:arrayelement:type:objectfields: - name:Keydescription:The Keytype:string - name:ValueStringdescription:The value as a stringtype:string - name:eiddescription:The EIDtype:bigint - name:Successdescription:If the operation was successful or nottype:boolean - name:EventUUIDdescription:The EventUUIDtype:string
Crowdstrike.AppInfo
Detected Application Information provided by Falcon Discover.
schema:Crowdstrike.AppInfoparser:native:name:Crowdstrike.AppInfodescription:Detected Application Information provided by Falcon DiscoverreferenceURL:https://developer.crowdstrike.com/crowdstrike/docs/falcon-data-replicator-guide#section-appinfofields: - name:_timerequired:truedescription:The host's local time in epoch format.type:timestamptimeFormat:unixisEventTime:true - name:cidrequired:truedescription:The customer ID.type:stringindicators: - md5 - trace_id - name:CompanyNamerequired:truedescription:The name of the company.type:string - name:detectioncountrequired:truedescription:The number of detections.type:bigint - name:FileNamerequired:truedescription:The name of the file.type:string - name:SHA256HashDatarequired:truedescription:The file hash bashed on SHA-256.type:stringindicators: - sha256 - name:FileDescriptiondescription:The description of the file, if any.type:string - name:FileVersiondescription:The version of the file.type:string - name:ProductNamedescription:The name of the product.type:string - name:ProductVersiondescription:The version of the product.type:string
Crowdstrike.CriticalFile
This event is generated every time a critical file is accessed or modified.
schema:Crowdstrike.CriticalFileparser:native:name:Crowdstrike.CriticalFiledescription:This event is generated every time a critical file is accessed or modifiedreferenceURL:https://falcon.us-2.crowdstrike.com/support/documentation/26/events-data-dictionaryfields: - name:event_simpleNamerequired:truedescription:Event nametype:string - name:namerequired:truedescription:The event nametype:string - name:aid description: The sensor ID. This value is unique to each installation of a Falcon sensor. When a sensor is updated or reinstalled, the host gets a new aid. In those situations, a single host could have multiple aid values over time.
type:stringindicators: - md5 - trace_id - name:aip description: The sensor’s IP, as seen from the CrowdStrike cloud. This is typically the public IP of the sensor. This helps determine the location of a computer, depending on your network.
type:stringindicators: - ip - name:ciddescription:CIDtype:stringindicators: - md5 - trace_id - name:iddescription:IDtype:string - name:event_platformdescription:The platform the sensor was running ontype:string - name:timestampdescription:Timestamp when the event was received by the CrowdStrike cloud.type:timestamptimeFormat:unix_msisEventTime:true - name:_timedescription:Timestamp when the event was received by the CrowdStrike cloud (human readable)type:timestamptimeFormat:layout=01/02/2006 15:04:05.999 - name:ComputerNamedescription:The name of the host.type:stringindicators: - hostname - name:ConfigBuilddescription:Config buildtype:string - name:ConfigStateHashdescription:Config state hashtype:string - name:Entitlementsdescription:Entitlementstype:string - name:TreeIddescription:If this event is part of a detection tree, the tree ID it is part oftype:stringindicators: - trace_id - name:TreeId_decimaldescription:If this event is part of a detection tree, the tree ID it is part of. (in decimal, non-hex format)type:bigint - name:ContextThreadIddescription:The unique ID of a process that was spawned by another process.type:string - name:ContextThreadId_decimaldescription:The unique ID of a process that was spawned by another process (in decimal, non-hex format).type:bigint - name:ContextTimeStampdescription:The time at which an event occurred on the system, as seen by the sensor.type:timestamptimeFormat:unix - name:ContextTimeStamp_decimal description: The time at which an event occurred on the system, as seen by the sensor (in decimal, non-hex format).
type:timestamptimeFormat:unix_ms - name:ContextProcessIddescription:The unique ID of a process that was spawned by another process.type:string - name:ContextProcessId_decimaldescription:The unique ID of a process that was spawned by another process (in decimal, non-hex format).type:bigint - name:InContextdescription:In context (N/A on iOS)type:string - name:EffectiveTransmissionClassdescription:Effective transmission classtype:bigint - name:GIDdescription:The user Group IDtype:bigint - name:TargetFileNamedescription:The file that was accessedtype:string - name:UIDdescription:The User IDtype:bigint - name:UnixModedescription:The unix file permissionstype:string - name:FileIdentifierdescription:The file identifiertype:string - name:USNdescription:The USNtype:bigint
Crowdstrike.DNSRequest
This event is generated for every attempted DNS name resolution on a host.
schema:Crowdstrike.DNSRequestparser:native:name:Crowdstrike.DNSRequestdescription:This event is generated for every attempted DNS name resolution on a host.fields: - name:event_simpleNamerequired:truedescription:Event nametype:string - name:namerequired:truedescription:The event nametype:string - name:aid description: The sensor ID. This value is unique to each installation of a Falcon sensor. When a sensor is updated or reinstalled, the host gets a new aid. In those situations, a single host could have multiple aid values over time.
type:stringindicators: - md5 - trace_id - name:aip description: The sensor’s IP, as seen from the CrowdStrike cloud. This is typically the public IP of the sensor. This helps determine the location of a computer, depending on your network.
type:stringindicators: - ip - name:ciddescription:CIDtype:stringindicators: - md5 - trace_id - name:iddescription:IDtype:string - name:event_platformdescription:The platform the sensor was running ontype:string - name:timestampdescription:Timestamp when the event was received by the CrowdStrike cloud.type:timestamptimeFormat:unix_msisEventTime:true - name:_timedescription:Timestamp when the event was received by the CrowdStrike cloud (human readable)type:timestamptimeFormat:layout=01/02/2006 15:04:05.999 - name:ComputerNamedescription:The name of the host.type:stringindicators: - hostname - name:ConfigBuilddescription:Config buildtype:string - name:ConfigStateHashdescription:Config state hashtype:string - name:Entitlementsdescription:Entitlementstype:string - name:TreeIddescription:If this event is part of a detection tree, the tree ID it is part oftype:stringindicators: - trace_id - name:TreeId_decimaldescription:If this event is part of a detection tree, the tree ID it is part of. (in decimal, non-hex format)type:bigint - name:ContextThreadIddescription:The unique ID of a process that was spawned by another process.type:string - name:ContextThreadId_decimaldescription:The unique ID of a process that was spawned by another process (in decimal, non-hex format).type:bigint - name:ContextTimeStampdescription:The time at which an event occurred on the system, as seen by the sensor.type:timestamptimeFormat:unix - name:ContextTimeStamp_decimal description: The time at which an event occurred on the system, as seen by the sensor (in decimal, non-hex format).
type:timestamptimeFormat:unix_ms - name:ContextProcessIddescription:The unique ID of a process that was spawned by another process.type:string - name:ContextProcessId_decimaldescription:The unique ID of a process that was spawned by another process (in decimal, non-hex format).type:bigint - name:InContextdescription:In context (N/A on iOS)type:string - name:EffectiveTransmissionClassdescription:Effective transmission classtype:bigint - name:DomainNamedescription:The domain name requestedtype:stringindicators: - domain - name:InterfaceIndexdescription:The network interface index (Windows only)type:bigint - name:DualRequestdescription:If the event is dual request (Windows only)type:bigint - name:DnsRequestCountdescription:The number of DNS requests (Windows only)type:bigint - name:AppIdentifierdescription:The identifier of the app that made the request (Android, iOS)type:string - name:IpAddressdescription:The device ip address (Android, iOS)type:stringindicators: - ip - name:RequestTypedescription:The DNS request typetype:string
Crowdstrike.DetectionSummary
Detection Summary events include multiple detections, when multiple malicious behaviors are detected.
schema:Crowdstrike.DetectionSummaryparser:native:name:Crowdstrike.DetectionSummarydescription:Detection Summary events include multiple detections, when multiple malicious behaviors are detected.referenceURL:https://developer.crowdstrike.com/crowdstrike/docs/streaming-api-events#section-detection-summaryfields: - name:ciddescription:Customer IDtype:stringindicators: - md5 - trace_id - name:Techniquedescription:The name of the technique associated to the behavior.type:string - name:ProcessIddescription:Process ID.type:bigint - name:AgentIdStringdescription:Agent Id.type:string - name:DetectName description: 'NOTE: The DetectName field has been replaced by Objective, Tactic, and Technique as we have aligned with MITRE’s ATT&CK. DetectName will be deprecated January 16, 2019 - more information'
type:string - name:ComputerNamedescription:Host name.type:string - name:ProcessStartTimedescription:Timestamp of when a process started.type:timestamptimeFormat:unix - name:GrandparentCommandLinedescription:Effective transmission classtype:string - name
