CrowdStrike Falcon

You can integrate CrowdStrike Falcon with Sophos XDR so that it sends data to Sophos for analysis.

This page gives you an overview of the integration.

CrowdStrike Falcon product overview

CrowdStrike Falcon is a cloud-native endpoint protection platform that harnesses the power of real-time threat intelligence. Using its proprietary graph technology, it offers speedy detection and response, ensuring endpoints remain secure even against sophisticated attacks.

What we ingest

Sophos XDR collects security alerts from CrowdStrike Falcon over HTTPS by polling the CrowdStrike Endpoint Security API. We use the following CrowdStrike APIs:

• Incident and Alert Monitoring API

  • Bulk alert retrieval (POST /alerts/combined/alerts/v1): Retrieves CrowdStrike Falcon alert events.

Sophos XDR polls the CrowdStrike API periodically, with each poll requesting alerts created during a recent time interval, and the time intervals progressively advancing between the polls. Sophos XDR uses CrowdStrike API pagination to retrieve all alerts in each time interval.

Sophos XDR authenticates to the CrowdStrike API using OAuth2 access tokens, which are acquired using an API client ID and API client secret.

In addition to the alerts polled from the CrowdStrike API, Sophos XDR ingests endpoint detection and response (EDR) telemetry from CrowdStrike Falcon Data Replicator (FDR). Unlike the Alerts data source, FDR data is delivered to Sophos XDR rather than polled: when you create an FDR feed, CrowdStrike continuously writes compressed event data to a CrowdStrike-managed Amazon S3 bucket and publishes a notification to a CrowdStrike-managed Amazon SQS queue for each batch of files it writes. Sophos XDR long-polls that SQS queue using the AWS credentials CrowdStrike issues with the feed, retrieves the referenced objects from the FDR S3 bucket, and normalizes the events as they arrive. Sophos XDR only reads from your FDR feed; it does not write to it or change its configuration.

Event and data types

We ingest the following event and data types from CrowdStrike Falcon:

• Alerts: Detections generated by various CrowdStrike Falcon products. Here are some of the sources that can generate alerts:

  • Falcon Endpoint Protection
  • Falcon Identity Protection
  • Falcon Insight XDR
  • Falcon Next-Gen SIEM

• FDR events: Raw endpoint and Active Directory activity generated by the Falcon sensor and collected through FDR. This includes process execution, module loads, file modifications, registry changes, script blocks, DNS requests, network connections, authentication and account-management activity, WMI activity, thread injection, persistence changes, device-control activity, and host inventory information. These events are normalized to various telemetry types as listed in the next section.

Alert events are normalized to third-party security alert telemetry. Events related to alerts are normalized to process telemetry.

Data provided by this integration

Data provided by CrowdStrike Falcon gets normalized to the following schemas:

• antivirus
• asset
• auth
• dns
• filemod
• generic
• http
• management
• netflow
• persistence
• process
• processmodule
• registry
• scriptblock
• softwareinfo
• threadinjection
• thirdpartyalert

For more information about using schemas in Data Lake Search, see Schemas and logical types.

Vendor documentation

• Incident and Alert Monitoring APIs
• OAuth2 Auth Token APIs
• Falcon Data Replicator