Aperçu
Imports CrowdStrike Falcon Next-Gen SIEM alerts into OpenCTI as Incidents, with the victim and threat observables and the MITRE ATT&CK techniques.
CrowdStrike Falcon Next-Gen SIEM raises alerts when its correlation rules match the logs ingested in the platform.
The OpenCTI CrowdStrike Incidents connector retrieves these Next-Gen SIEM alerts through the CrowdStrike Falcon Alerts API and imports each of them as an Incident, with the affected hosts, IP addresses and user accounts as observables, and the MITRE ATT&CK techniques declared by the correlation rule as Attack Patterns linked to the existing ATT&CK dataset. Optionally, each Incident is enriched with the threat observables of the alert's source event in Next-Gen SIEM: the executed file and its hashes, and its execution context.