Skip to content

Commit b557d00

Browse files
OverOrionOverOrion
authored
Merge pull request #18 from axoflow/feat/crowdstrike-alerts
feat: add crowdstrike connector
2 parents eb98baa + ee04510 commit b557d00

5 files changed

Lines changed: 238 additions & 1 deletion

File tree

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM ghcr.io/axoflow/axoflow-otel-collector/axoflow-otel-collector:0.129.0-axoflow.kafkareceiver AS axo-otelcol
1+
FROM ghcr.io/axoflow/axoflow-otel-collector/axoflow-otel-collector:0.129.0-axoflow.4 AS axo-otelcol
22

33
FROM alpine:3.21 AS base
44

‎README.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,41 @@ You can find guides per connector:
7373
| `KAFKA_TLS_KEY_FILE` | No | - | Path to client key file |
7474
| `KAFKA_TLS_INSECURE_SKIP_VERIFY` | No | `false` | Skip TLS certificate verification |
7575

76+
### Crowdstrike Provider
77+
78+
79+
### Crowdstrike Provider
80+
81+
| Variable | Required | Default | Description |
82+
|----------|----------|---------|-------------|
83+
| `CROWDSTRIKE_ACCESS_TOKEN` | No* | - | OAuth2 access token. Required **if not using client_id/client_secret**. |
84+
| `CROWDSTRIKE_CLIENT_ID` | No* | - | Client ID for Crowdstrike API authentication. Required **if not using access_token**. |
85+
| `CROWDSTRIKE_CLIENT_SECRET` | No* | - | Client Secret for Crowdstrike API authentication. Required **if not using access_token**. |
86+
| `CROWDSTRIKE_MEMBER_CID` | No | - | Member CID for MSSP (for cases when OAuth2 authenticates multiple CIDs). |
87+
| `CROWDSTRIKE_CLOUD` | No | - | Cloud region (e.g., `us-1`, `us-2`, `eu-1`, `us-gov-1`). |
88+
| `CROWDSTRIKE_HOST_OVERRIDE` | No | - | Optional override for API hostname. |
89+
| `CROWDSTRIKE_BASE_PATH_OVERRIDE` | No | - | Optional override for API base path. |
90+
| `CROWDSTRIKE_POLL_INTERVAL` | No | - | Poll interval for pulling logs/events. |
91+
| `CROWDSTRIKE_DEBUG` | No | `false` | Enables verbose Crowdstrike API debugging. |
92+
93+
#### TLS Settings
94+
95+
| Variable | Required | Default | Description |
96+
|----------|----------|---------|-------------|
97+
| `CROWDSTRIKE_TLS_INSECURE` | No | `false` | Disable TLS security (insecure). |
98+
| `CROWDSTRIKE_TLS_INSECURE_SKIP_VERIFY` | No | `false` | Skip TLS certificate verification. |
99+
| `CROWDSTRIKE_TLS_SERVER_NAME_OVERRIDE` | No | - | Optional TLS server name override. |
100+
| `CROWDSTRIKE_TLS_CA_FILE` | No | - | Path to a CA certificate file. |
101+
| `CROWDSTRIKE_TLS_CA_PEM` | No | - | PEM-encoded CA certificate. |
102+
| `CROWDSTRIKE_TLS_CERT_FILE` | No | - | Path to a client certificate file. |
103+
| `CROWDSTRIKE_TLS_CERT_PEM` | No | - | PEM-encoded client certificate. |
104+
| `CROWDSTRIKE_TLS_KEY_FILE` | No | - | Path to a client private key file. |
105+
| `CROWDSTRIKE_TLS_KEY_PEM` | No | - | PEM-encoded client private key. |
106+
| `CROWDSTRIKE_TLS_MIN_VERSION` | No | `1.2` | Minimum TLS version to use. |
107+
| `CROWDSTRIKE_TLS_MAX_VERSION` | No | - | Maximum TLS version to use. |
108+
| `CROWDSTRIKE_TLS_INCLUDE_SYSTEM_CA_CERTS_POOL` | No | `false` | Include system CA certs along with provided CA. |
109+
110+
76111
## Usage
77112

78113
### Local Development with Docker

‎connectors/crowdstrike/README.md‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
2+
# CrowdStrike Falcon Receiver
3+
4+
This directory contains the Axoflow CrowdStrike Falcon receiver which helps collecting alerts from the CrowdStrike Falcon platform.
5+
6+
## Quickstart
7+
8+
### Authentication with ClientID / ClientSecret
9+
10+
Make sure the required environment variables are set before running the receiver.
11+
12+
```bash
13+
UUID_FULL=$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c "import uuid; print(uuid.uuid4())")
14+
AXOCLOUDCONNECTOR_DEVICE_ID=$(echo "$UUID_FULL" | cut -d'-' -f1)
15+
16+
docker run \
17+
--rm \
18+
-v "${STORAGE_DIRECTORY}":"${STORAGE_DIRECTORY}" \
19+
-e CROWDSTRIKE_CLIENT_ID="${CROWDSTRIKE_CLIENT_ID}" \
20+
-e CROWDSTRIKE_CLIENT_SECRET="${CROWDSTRIKE_CLIENT_SECRET}" \
21+
-e CROWDSTRIKE_CLOUD="${CROWDSTRIKE_CLOUD}" \
22+
-e AXOROUTER_ENDPOINT="${AXOROUTER_ENDPOINT}" \
23+
-e STORAGE_DIRECTORY="${STORAGE_DIRECTORY}" \
24+
-e AXOCLOUDCONNECTOR_DEVICE_ID="${AXOCLOUDCONNECTOR_DEVICE_ID}" \
25+
ghcr.io/axoflow/axocloudconnectors:latest
26+
```
27+
28+
### Authentication with Access Token
29+
30+
Make sure the required environment variables are set before running the receiver.
31+
32+
```bash
33+
UUID_FULL=$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c "import uuid; print(uuid.uuid4())")
34+
AXOCLOUDCONNECTOR_DEVICE_ID=$(echo "$UUID_FULL" | cut -d'-' -f1)
35+
36+
docker run \
37+
--rm \
38+
-v "${STORAGE_DIRECTORY}":"${STORAGE_DIRECTORY}" \
39+
-e CROWDSTRIKE_ACCESS_TOKEN="${CROWDSTRIKE_ACCESS_TOKEN}" \
40+
-e CROWDSTRIKE_CLOUD="${CROWDSTRIKE_CLOUD}" \
41+
-e AXOROUTER_ENDPOINT="${AXOROUTER_ENDPOINT}" \
42+
-e STORAGE_DIRECTORY="${STORAGE_DIRECTORY}" \
43+
-e AXOCLOUDCONNECTOR_DEVICE_ID="${AXOCLOUDCONNECTOR_DEVICE_ID}" \
44+
ghcr.io/axoflow/axocloudconnectors:latest
45+
```
46+
47+
48+
## Deploy with Helm-chart (ClientID / ClientSecret)
49+
50+
```bash
51+
make minikube-cluster
52+
make docker-build
53+
make minikube-load-image
54+
55+
kubectl create namespace cloudconnectors
56+
kubectl create secret generic crowdstrike-falcon \
57+
--from-literal=client-id="<YOUR-CROWDSTRIKE-CLIENT-ID>" \
58+
--from-literal=client-secret="<YOUR-CROWDSTRIKE-CLIENT-SECRET>" \
59+
--from-literal=cloud="<YOUR-CROWDSTRIKE-CLOUD>" \
60+
--namespace cloudconnectors \
61+
--dry-run=client -o yaml | kubectl apply -f -
62+
63+
UUID_FULL=$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c "import uuid; print(uuid.uuid4())")
64+
AXOCLOUDCONNECTOR_DEVICE_ID=$(echo "$UUID_FULL" | cut -d'-' -f1)
65+
66+
helm upgrade --install --wait --namespace cloudconnectors cloudconnectors ./charts/cloudconnectors \
67+
--set image.repository="axocloudconnectors" \
68+
--set image.tag="dev" \
69+
--set 'env[0].name=AXOROUTER_ENDPOINT' \
70+
--set 'env[0].value=axorouter.axoflow-local.svc.cluster.local:4317' \
71+
--set 'env[1].name=AXOCLOUDCONNECTOR_DEVICE_ID' \
72+
--set "env[1].value=${AXOCLOUDCONNECTOR_DEVICE_ID}" \
73+
--set 'env[2].name=CROWDSTRIKE_CLIENT_ID' \
74+
--set 'env[2].valueFrom.secretKeyRef.name=crowdstrike-falcon' \
75+
--set 'env[2].valueFrom.secretKeyRef.key=client-id' \
76+
--set 'env[3].name=CROWDSTRIKE_CLIENT_SECRET' \
77+
--set 'env[3].valueFrom.secretKeyRef.name=crowdstrike-falcon' \
78+
--set 'env[3].valueFrom.secretKeyRef.key=client-secret' \
79+
--set 'env[4].name=CROWDSTRIKE_CLOUD' \
80+
--set 'env[4].valueFrom.secretKeyRef.name=crowdstrike-falcon' \
81+
--set 'env[4].valueFrom.secretKeyRef.key=cloud'
82+
```
83+
84+
## Deploy with Helm-chart (Access Token)
85+
86+
```bash
87+
kubectl create secret generic crowdstrike-falcon \
88+
--from-literal=access-token="<YOUR-CROWDSTRIKE-ACCESS-TOKEN>" \
89+
--from-literal=cloud="<YOUR-CROWDSTRIKE-CLOUD>" \
90+
--namespace cloudconnectors \
91+
--dry-run=client -o yaml | kubectl apply -f -
92+
93+
UUID_FULL=$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c "import uuid; print(uuid.uuid4())")
94+
AXOCLOUDCONNECTOR_DEVICE_ID=$(echo "$UUID_FULL" | cut -d'-' -f1)
95+
96+
helm upgrade --install --wait --namespace cloudconnectors cloudconnectors ./charts/cloudconnectors \
97+
--set image.repository="axocloudconnectors" \
98+
--set image.tag="dev" \
99+
--set 'env[0].name=AXOROUTER_ENDPOINT' \
100+
--set 'env[0].value=axorouter.axoflow-local.svc.cluster.local:4317' \
101+
--set 'env[1].name=AXOCLOUDCONNECTOR_DEVICE_ID' \
102+
--set "env[1].value=${AXOCLOUDCONNECTOR_DEVICE_ID}" \
103+
--set 'env[2].name=CROWDSTRIKE_ACCESS_TOKEN' \
104+
--set 'env[2].valueFrom.secretKeyRef.name=crowdstrike-falcon' \
105+
--set 'env[2].valueFrom.secretKeyRef.key=access-token' \
106+
--set 'env[3].name=CROWDSTRIKE_CLOUD' \
107+
--set 'env[3].valueFrom.secretKeyRef.name=crowdstrike-falcon' \
108+
--set 'env[3].valueFrom.secretKeyRef.key=cloud'
109+
```
110+

‎connectors/crowdstrike/config.yaml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
exporters:
2+
otlp/axorouter:
3+
endpoint: ${env:AXOROUTER_ENDPOINT}
4+
retry_on_failure:
5+
enabled: true
6+
max_elapsed_time: 0
7+
sending_queue:
8+
enabled: true
9+
storage: file_storage
10+
tls:
11+
insecure: ${env:AXOROUTER_TLS_INSECURE:-false}
12+
ca_file: ${env:AXOROUTER_TLS_CA_FILE}
13+
ca_pem: ${env:AXOROUTER_TLS_CA_PEM}
14+
cert_file: ${env:AXOROUTER_TLS_CERT_FILE}
15+
cert_pem: ${env:AXOROUTER_TLS_CERT_PEM}
16+
key_file: ${env:AXOROUTER_TLS_KEY_FILE}
17+
key_pem: ${env:AXOROUTER_TLS_KEY_PEM}
18+
min_version: ${env:AXOROUTER_TLS_MIN_VERSION:-1.2}
19+
max_version: ${env:AXOROUTER_TLS_MAX_VERSION}
20+
include_system_ca_certs_pool: ${env:AXOROUTER_TLS_INCLUDE_SYSTEM_CA_CERTS_POOL:-false}
21+
insecure_skip_verify: ${env:AXOROUTER_TLS_INSECURE_SKIP_VERIFY:-false}
22+
23+
processors:
24+
resource/axoflow_device_id:
25+
attributes:
26+
- key: "com.axoflow.device_id"
27+
action: insert
28+
value: "${env:AXOCLOUDCONNECTOR_DEVICE_ID}"
29+
30+
resourcedetection/system:
31+
detectors: ["system", "env"]
32+
system:
33+
hostname_sources: ["dns", "os", "cname", "lookup"]
34+
resource_attributes:
35+
host.name:
36+
enabled: true
37+
host.ip:
38+
enabled: true
39+
host.id:
40+
enabled: true
41+
42+
resource/axoflow: # Provider specific!
43+
attributes:
44+
- key: "com.axoflow.vendor"
45+
action: insert
46+
value: "crowdstrike"
47+
- key: "com.axoflow.product"
48+
action: insert
49+
value: "falcon"
50+
51+
receivers: # Provider specific!
52+
crowdstrike:
53+
access_token: ${env:CROWDSTRIKE_ACCESS_TOKEN}
54+
client_id: ${env:CROWDSTRIKE_CLIENT_ID}
55+
client_secret: ${env:CROWDSTRIKE_CLIENT_SECRET}
56+
member_cid: ${env:CROWDSTRIKE_MEMBER_CID}
57+
cloud: ${env:CROWDSTRIKE_CLOUD}
58+
host_override: ${env:CROWDSTRIKE_HOST_OVERRIDE}
59+
base_path_override: ${env:CROWDSTRIKE_BASE_PATH_OVERRIDE}
60+
poll_interval: ${env:CROWDSTRIKE_POLL_INTERVAL}
61+
debug: ${env:CROWDSTRIKE_DEBUG:-false}
62+
tls:
63+
insecure: ${env:CROWDSTRIKE_TLS_INSECURE:-false}
64+
insecure_skip_verify: ${env:CROWDSTRIKE_TLS_INSECURE_SKIP_VERIFY:-false}
65+
server_name_override: ${env:CROWDSTRIKE_TLS_SERVER_NAME_OVERRIDE}
66+
ca_file: ${env:CROWDSTRIKE_TLS_CA_FILE}
67+
ca_pem: ${env:CROWDSTRIKE_TLS_CA_PEM}
68+
cert_file: ${env:CROWDSTRIKE_TLS_CERT_FILE}
69+
cert_pem: ${env:CROWDSTRIKE_TLS_CERT_PEM}
70+
key_file: ${env:CROWDSTRIKE_TLS_KEY_FILE}
71+
key_pem: ${env:CROWDSTRIKE_TLS_KEY_PEM}
72+
min_version: ${env:CROWDSTRIKE_TLS_MIN_VERSION:-1.2}
73+
max_version: ${env:CROWDSTRIKE_TLS_MAX_VERSION}
74+
include_system_ca_certs_pool: ${env:CROWDSTRIKE_TLS_INCLUDE_SYSTEM_CA_CERTS_POOL:-false}
75+
76+
extensions:
77+
health_check:
78+
endpoint: ${env:POD_IP}:13133
79+
file_storage:
80+
directory: ${env:STORAGE_DIRECTORY}
81+
create_directory: true
82+
83+
service:
84+
extensions: [health_check, file_storage]
85+
pipelines:
86+
logs:
87+
receivers: [crowdstrike]
88+
processors:
89+
[resource/axoflow_device_id, resourcedetection/system, resource/axoflow]
90+
exporters: [otlp/axorouter]

‎entrypoint.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ detect_provider() {
1111
env | grep -q "^AZURE_" && provider="$provider azure" && count=$((count + 1))
1212
env | grep -q "^AWS_" && provider="$provider aws" && count=$((count + 1))
1313
env | grep -q "^KAFKA_" && provider="$provider kafka" && count=$((count + 1))
14+
env | grep -q "^CROWDSTRIKE_" && provider="$provider crowdstrike" && count=$((count + 1))
1415
# env | grep -q "^GCP_" && provider="$provider gcp" && count=$((count + 1))
1516

1617
if [ "$count" -gt 1 ]; then
@@ -31,5 +32,6 @@ echo "No cloud provider configuration detected. Please set environment variables
3132
echo " - Azure (AZURE_*)"
3233
echo " - AWS (AWS_*)"
3334
echo " - Kafka (KAFKA_*)"
35+
echo " - Crowdstrike (CROWDSTRIKE_*)"
3436
# echo " - GCP (GCP_*)"
3537
exit 1

0 commit comments

Comments
 (0)