CrowdStrike
[CrowdStrike] CrowdStrike provides cloud workload and endpoint security, threat intelligence, and cyberattack response services and products. This module provides triggers to collect events from CrowdStrike
Configuration
| Name | Type | Description |
|---|---|---|
aws_access_key_id |
string |
The identifier of the access key (leave empty when using aws_role_arn) |
aws_secret_access_key |
string |
The secret associated to the access key (leave empty when using aws_role_arn) |
aws_region |
string |
The area hosting the AWS resources |
aws_role_arn |
string |
The ARN of the IAM Role to assume via OIDC (leave empty when using static access keys) |
Triggers
Fetch new events from CrowdStrike Data replication
Forward Crowdstrike Falcon Data Replication events to Sekoia.io
Arguments
| Name | Type | Description |
|---|---|---|
chunk_size |
integer |
The size of max number of messages for the batch processing (default: 20000) |
frequency |
integer |
Batch frequency in seconds. Should be greater than 0 and lower then 20 (default: 10) |
is_fifo |
boolean |
Flag to determine if the queue is a FIFO queue (default: false) |
queue_name |
string |
The name of the SQS queue that received messages with files information |
queue_url |
string |
The URL of the SQS queue that received messages with files information |
intake_server |
string |
Server of the intake server (e.g. 'https://intake.sekoia.io') |
intake_key |
string |
Intake key to use when sending events |
Extra
Module CrowdStrike v1.10.2