Use our SDKs, APIs, and guides to build your integrations Learn more about the CrowdStrike developer community. We're on Reddit, have official support forums, any many SDK communities on GitHub. Learn more about our SDKs, Foundry layers and…
Welcome to the CrowdStrike developer blog! Monday, December 02, 2024 in Blog The Oxford dictionary defines soar as to “fly or rise high in the air”. While this pairs nicely with Falcon, SOAR is an acronym, not a word, when it comes to cyber…
The Oxford dictionary defines soar as to “fly or rise high in the air”. While this pairs nicely with Falcon, SOAR is an acronym, not a word, when it comes to cybersecurity. In a cybersecurity context, SOAR stands for Security Orchestration,…
Developers and professionals who work within the cybersecurity industry are constantly looking to create more dynamic and impactful integrations between CrowdStrike’s Falcon platform and other security and IT tools. In order to help better
If you are creating a package with a vendor that has already been used in other packages, make sure to use the same name as they have in here. If you create a package for a new vendor, add the vendor name here. When choosing a new name, use…
The standard is based on Elastic Common Schema (ECS), with all deviations and clarifications noted below. We use the latest 9.x version of ECS (which is the current major version at the time of writing). We are free to upgrade to minor and
Start with our Foundry Quickstart to get up and running quickly, explore our Featured Foundry Samples to see what’s possible, then dive into the full collection of Foundry Samples on GitHub to find exactly what you need for your use case. R…
If you are creating a package with a vendor and module that has already been used in other packages, make sure to reuse the same name as they have in here. If you create a package for a new module, add the module name here. When choosing a
Adversaries move fast - eCrime breakout times average under 30 minutes. Manual response can’t keep up. The Falcon platform gives you Real-Time Response (RTR) for live endpoint access, host containment to isolate compromised machines, and wo…
Automate Falcon sensor deployment, configuration, and lifecycle management across your infrastructure. Use configuration management tools to install sensors at scale, or deployment scripts for direct installation across Linux, macOS, and Wi…
CrowdStrike provides a Terraform provider for managing Falcon platform resources and a set of modules for cloud account registration and sensor deployment. Use declarative configuration to enforce security posture, register cloud accounts,
Accessing and analyzing CrowdStrike Falcon intelligence data Required scopes: Actors (Falcon Intelligence): READ Generate a MITRE ATT&CK report for a given threat actor. Accepts an actor name (e.g., ‘WARP PANDA’) or numeric ID. Returns MITR…