The name of the file used to track malware families without a galaxy mapping. Number of processor threads to use for processing. This is used as the organization for all imports.īoolean to specify if SSL should be used to communicate with the MISP instance. The UUID of the CrowdStrike organization within your MISP instance.

MISP authorization key used to import data. The MISP section contains detail for communicating with your MISP instance. Title used for indicator malware family events. Title used for unattributed indicator events. Name to use for tag used to flag unknown malware families. Originating from CrowdStrike unique adversary tag. Originating from CrowdStrike unique indicator tag. Originating from CrowdStrike unique report tag. Other regions support 2500.īoolean to specify if SSL verification should be disabled.įilename to use to store the timestamp for the last imported report.įilename to use to store the timestamp for the last imported indicator.įilename to use to store the timestamp for the last imported adversary. The US-1 CrowdStrike region supports 5000 for a limit. Limit to use for requests to the CrowdStrike API. You may pass the full URL, the URL string, or just the shortname (US1, US2, EU1, USGOV1). The base URL to use for requests to CrowdStrike. The CrowdStrike section contains configuration detail for communicating with your CrowdStrike tenant. The are two sections within the misp_import.ini configuration file, CrowdStrike and MISP. You will also need to create an organization called 'CrowdStrike', and provide the UUID for this organization in the configuration file as detailed below. You will need to generate an authorization key (and potentially a user) to use for access to the MISP instance. Indicators (Falcon Threat Intelligence).Adversaries (Falcon Threat Intelligence).

Your API credentials will need READ access to: The following Python packages must be installed in order for this application to function. This solution supports standalone execution as well as container deployment. This solution will import adversaries, indicators or reports from CrowdStrike Falcon X into your MISP instance from a specified number of days backwards in time. MISP Modules - MISP modules that leverage CrowdStrike.Manual Import - Manually import Adversaries (Actors), Indicators or Reports from CrowdStrike Falcon X into your MISP instance.This repository is focused on a solution for importing CrowdStrike Threat Intelligence data into an instance of MISP.

Crowdstrike uninstall tool