Skip to content

Commit 60793e1

Browse files
fuqing04Fuqing Wang
fuqing04
and
Fuqing Wang
authored
CrowdStrike Falcon Adversary Connector - change TableName (#13402)
* change tableName * bump to v3.2.0 * bump maintemplate to v3.2.0 --------- Co-authored-by: Fuqing Wang <fuqingwang@microsoft.com>
1 parent 213b60b commit 60793e1

File tree

5 files changed

+57
-58
lines changed

5 files changed

+57
-58
lines changed

‎Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeFalconAdversaryIntelligence/CrowdStrikeFalconAdversaryIntelligence_FunctionApp.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,26 +7,26 @@
77
{
88
"metricName": "Total data received",
99
"legend": "Crowdstrike Indicators of Compromise",
10-
"baseQuery": "ThreatIntelligenceIndicator\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'"
10+
"baseQuery": "ThreatIntelIndicators\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'"
1111
}
1212
],
1313
"sampleQueries": [
1414
{
1515
"description": "Threat Intel - Crowdstrike Indicators of Compromise",
16-
"query": "ThreatIntelligenceIndicator\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'\n | sort by TimeGenerated desc"
16+
"query": "ThreatIntelIndicators\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'\n | sort by TimeGenerated desc"
1717
}
1818
],
1919
"dataTypes": [
2020
{
2121
"name": "IndicatorsOfCompromise",
22-
"lastDataReceivedQuery": "ThreatIntelligenceIndicator\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
22+
"lastDataReceivedQuery": "ThreatIntelIndicators\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
2323
}
2424
],
2525
"connectivityCriterias": [
2626
{
2727
"type": "IsConnectedQuery",
2828
"value": [
29-
"ThreatIntelligenceIndicator\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(3d)"
29+
"ThreatIntelIndicators\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(3d)"
3030
]
3131
}
3232
],

‎Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@
3030
"azuresentinel.azure-sentinel-solution-commoneventformat"
3131
],
3232
"BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\CrowdStrike Falcon Endpoint Protection",
33-
"Version": "3.1.8",
33+
"Version": "3.2.0",
3434
"Metadata": "SolutionMetadata.json",
3535
"TemplateSpec": true,
3636
"Is1Pconnector": false

‎Solutions/CrowdStrike Falcon Endpoint Protection/Package/3.2.0.zip‎

73.4 KB
Binary file not shown.

‎Solutions/CrowdStrike Falcon Endpoint Protection/Package/mainTemplate.json‎

Lines changed: 51 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@
5555
"email": "support@microsoft.com",
5656
"_email": "[variables('email')]",
5757
"_solutionName": "CrowdStrike Falcon Endpoint Protection",
58-
"_solutionVersion": "3.1.9",
58+
"_solutionVersion": "3.2.0",
5959
"solutionId": "azuresentinel.azure-sentinel-solution-crowdstrikefalconep",
6060
"_solutionId": "[variables('solutionId')]",
6161
"uiConfigId1": "CrowdstrikeReplicatorv2",
@@ -156,9 +156,7 @@
156156
"playbookId3": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId3'))]",
157157
"playbookTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId3'))))]",
158158
"_playbookcontentProductId3": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId3'),'-', variables('playbookVersion3'))))]",
159-
"_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]",
160-
"stepId": "incidents_details",
161-
"_stepId": "[variables('stepId')]"
159+
"_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
162160
},
163161
"resources": [
164162
{
@@ -577,26 +575,26 @@
577575
{
578576
"metricName": "Total data received",
579577
"legend": "Crowdstrike Indicators of Compromise",
580-
"baseQuery": "ThreatIntelligenceIndicator\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'"
578+
"baseQuery": "ThreatIntelIndicators\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'"
581579
}
582580
],
583581
"sampleQueries": [
584582
{
585583
"description": "Threat Intel - Crowdstrike Indicators of Compromise",
586-
"query": "ThreatIntelligenceIndicator\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'\n | sort by TimeGenerated desc"
584+
"query": "ThreatIntelIndicators\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'\n | sort by TimeGenerated desc"
587585
}
588586
],
589587
"dataTypes": [
590588
{
591589
"name": "IndicatorsOfCompromise",
592-
"lastDataReceivedQuery": "ThreatIntelligenceIndicator\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
590+
"lastDataReceivedQuery": "ThreatIntelIndicators\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
593591
}
594592
],
595593
"connectivityCriterias": [
596594
{
597595
"type": "IsConnectedQuery",
598596
"value": [
599-
"ThreatIntelligenceIndicator\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(3d)"
597+
"ThreatIntelIndicators\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(3d)"
600598
]
601599
}
602600
],
@@ -769,27 +767,27 @@
769767
{
770768
"metricName": "Total data received",
771769
"legend": "Crowdstrike Indicators of Compromise",
772-
"baseQuery": "ThreatIntelligenceIndicator\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'"
770+
"baseQuery": "ThreatIntelIndicators\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'"
773771
}
774772
],
775773
"dataTypes": [
776774
{
777775
"name": "IndicatorsOfCompromise",
778-
"lastDataReceivedQuery": "ThreatIntelligenceIndicator\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
776+
"lastDataReceivedQuery": "ThreatIntelIndicators\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
779777
}
780778
],
781779
"connectivityCriterias": [
782780
{
783781
"type": "IsConnectedQuery",
784782
"value": [
785-
"ThreatIntelligenceIndicator\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(3d)"
783+
"ThreatIntelIndicators\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(3d)"
786784
]
787785
}
788786
],
789787
"sampleQueries": [
790788
{
791789
"description": "Threat Intel - Crowdstrike Indicators of Compromise",
792-
"query": "ThreatIntelligenceIndicator\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'\n | sort by TimeGenerated desc"
790+
"query": "ThreatIntelIndicators\n | where SourceSystem == 'CrowdStrike Falcon Adversary Intelligence'\n | sort by TimeGenerated desc"
793791
}
794792
],
795793
"availability": {
@@ -9398,7 +9396,7 @@
93989396
"stepType": "Nested",
93999397
"nextSteps": [
94009398
{
9401-
"stepId": "[variables('_stepId')]",
9399+
"stepId": "incidents_details",
94029400
"stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project resources = res['resources'] | mvexpand resources | project Url_PlaceHolder = resources"
94039401
}
94049402
]
@@ -10134,52 +10132,52 @@
1013410132
"status": "Available",
1013510133
"requiredDataConnectors": [
1013610134
{
10137-
"connectorId": "CefAma",
1013810135
"dataTypes": [
1013910136
"CommonSecurityLog"
10140-
]
10137+
],
10138+
"connectorId": "CefAma"
1014110139
}
1014210140
],
1014310141
"entityMappings": [
1014410142
{
10143+
"entityType": "Account",
1014510144
"fieldMappings": [
1014610145
{
10147-
"identifier": "FullName",
10148-
"columnName": "AccountCustomEntity"
10146+
"columnName": "AccountCustomEntity",
10147+
"identifier": "FullName"
1014910148
}
10150-
],
10151-
"entityType": "Account"
10149+
]
1015210150
},
1015310151
{
10152+
"entityType": "Host",
1015410153
"fieldMappings": [
1015510154
{
10156-
"identifier": "FullName",
10157-
"columnName": "HostCustomEntity"
10155+
"columnName": "HostCustomEntity",
10156+
"identifier": "FullName"
1015810157
}
10159-
],
10160-
"entityType": "Host"
10158+
]
1016110159
},
1016210160
{
10161+
"entityType": "IP",
1016310162
"fieldMappings": [
1016410163
{
10165-
"identifier": "Address",
10166-
"columnName": "IPCustomEntity"
10164+
"columnName": "IPCustomEntity",
10165+
"identifier": "Address"
1016710166
}
10168-
],
10169-
"entityType": "IP"
10167+
]
1017010168
},
1017110169
{
10170+
"entityType": "FileHash",
1017210171
"fieldMappings": [
1017310172
{
10174-
"identifier": "Algorithm",
10175-
"columnName": "FileHashAlgo"
10173+
"columnName": "FileHashAlgo",
10174+
"identifier": "Algorithm"
1017610175
},
1017710176
{
10178-
"identifier": "Value",
10179-
"columnName": "FileHashCustomEntity"
10177+
"columnName": "FileHashCustomEntity",
10178+
"identifier": "Value"
1018010179
}
10181-
],
10182-
"entityType": "FileHash"
10180+
]
1018310181
}
1018410182
]
1018510183
}
@@ -10263,52 +10261,52 @@
1026310261
"status": "Available",
1026410262
"requiredDataConnectors": [
1026510263
{
10266-
"connectorId": "CefAma",
1026710264
"dataTypes": [
1026810265
"CommonSecurityLog"
10269-
]
10266+
],
10267+
"connectorId": "CefAma"
1027010268
}
1027110269
],
1027210270
"entityMappings": [
1027310271
{
10272+
"entityType": "Account",
1027410273
"fieldMappings": [
1027510274
{
10276-
"identifier": "FullName",
10277-
"columnName": "AccountCustomEntity"
10275+
"columnName": "AccountCustomEntity",
10276+
"identifier": "FullName"
1027810277
}
10279-
],
10280-
"entityType": "Account"
10278+
]
1028110279
},
1028210280
{
10281+
"entityType": "Host",
1028310282
"fieldMappings": [
1028410283
{
10285-
"identifier": "FullName",
10286-
"columnName": "HostCustomEntity"
10284+
"columnName": "HostCustomEntity",
10285+
"identifier": "FullName"
1028710286
}
10288-
],
10289-
"entityType": "Host"
10287+
]
1029010288
},
1029110289
{
10290+
"entityType": "IP",
1029210291
"fieldMappings": [
1029310292
{
10294-
"identifier": "Address",
10295-
"columnName": "IPCustomEntity"
10293+
"columnName": "IPCustomEntity",
10294+
"identifier": "Address"
1029610295
}
10297-
],
10298-
"entityType": "IP"
10296+
]
1029910297
},
1030010298
{
10299+
"entityType": "FileHash",
1030110300
"fieldMappings": [
1030210301
{
10303-
"identifier": "Algorithm",
10304-
"columnName": "FileHashAlgo"
10302+
"columnName": "FileHashAlgo",
10303+
"identifier": "Algorithm"
1030510304
},
1030610305
{
10307-
"identifier": "Value",
10308-
"columnName": "FileHashCustomEntity"
10306+
"columnName": "FileHashCustomEntity",
10307+
"identifier": "Value"
1030910308
}
10310-
],
10311-
"entityType": "FileHash"
10309+
]
1031210310
}
1031310311
]
1031410312
}

‎Solutions/CrowdStrike Falcon Endpoint Protection/ReleaseNotes.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
22
|-------------|--------------------------------|--------------------------------------------------------------------------------|
3+
| 3.2.0 | 07-01-2026 | Updated *CrowdStrike Falcon Adversary Data Connector* Change table name to be "ThreatIntelIndicators" instead of "ThreatIntelligenceIndicator" |
34
| 3.1.9 | 17-12-2025 | Updated *CrowdStrike API Data Connector* Enhance API configuration instructions with link |
45
| 3.1.8 | 08-12-2025 | Updated *CrowdStrike API Data Connector* to fix rate limit exceptions by introducing retry logic. |
56
| 3.1.7 | 12-11-2025 | Updated *CrowdStrike API Data Connector* to fix rate limit exceptions |

0 commit comments

Comments
 (0)