AS-CrowdstrikeAlerts-Integration

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

This playbook is intended to be run on a timmed trigger. It will poll Crowdstrike for new alerts and replicate them in Sentinel

Attribute	Value
Type	Playbook
Solution	Standalone Content
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
Crowdstrike_Alerts_CL	?	✓	?

Logic App Connectors

This playbook uses 4 Logic App connectors / built-in actions:

Connector / Action	Type	Connections	Actions
azureloganalyticsdatacollector	Managed	1	1
azuremonitorlogs	Managed	1	1
keyvault	Managed	1	1
http	Built-in	0	3

Action parameters (URLs, paths, function IDs)

azureloganalyticsdatacollector (Managed)

Action	Method	Endpoint	Other
Send_Data	post	/api/logs	—

azuremonitorlogs (Managed)

Action	Method	Endpoint	Other
Run_query_and_list_results_V2_-_Get_Potential_Duplicates	post	/queryDataV2	—

keyvault (Managed)

Action	Method	Endpoint	Other
Get_Secret	get	[concat('/secrets/@{encodeURIComponent(''', parameters('SecretName'), ''')}/value')]	—

http (Built-in)

Action	Method	Endpoint	Other
HTTP_-_Get_Complete_Alerts	POST	[concat('https://', parameters('CrowdstrikeDomain') ,'/alerts/entities/alerts/v1')]	—
HTTP_-_Get_Alert_IDs	GET	[concat('https://', parameters('CrowdstrikeDomain') ,'/alerts/queries/alerts/v2?filter=created_timestamp:>=''@{addMinutes(variables(''Local Timestamp''), -10)}''&created_timestamp:<=''@{variables(''Local Timestamp'')}''&sort=created_timestamp.desc')]	—
HTTP_-_Get_Token	POST	[concat('https://', parameters('CrowdstrikeDomain') ,'/oauth2/token')]	—

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Playbooks