Latest Version: 1.1 - Release Date: 11/06/2024

This project integrates CrowdStrike Falcon Insight XDR and VMRay FinalVerdict / TotalInsight. It equips customers with extra intel regarding the threats detected by CrowdStrike Falcon Insight XDR on their endpoints. Depending on the configuration, the Connector collects unique SHA256 hash values from:

• Detections
• Quarantines

It then downloads and submits respective samples into the VMRay Analyzer for detonation and deep dynamic analysis. After the submission, it retrieves the verdict and IOC values from VMRay and updates Detection and Quarantine Objects, creates IOC, and contains (quarantines) machine if needed.

The connector supports the following VMRay products:

• Final Verdict
• Total Insight

app                             # Main project directory
├─── config                     # Configuration directory
│   └─── __init__.py 			
│   └─── crowdstike_conf.py     # CrowdStrike configuration file
│   └─── general_conf.py        # General configuration file
│   └─── crowdstike_conf.py     # VMRay configuration file    
├─── downloads                  # Directory for extracted binaries
├─── lib                        # Library directory
│   └─── __init__.py 				
│   └─── CrowdStrike.py         # Crowdstrike API functions
│   └─── VMRay.py               # VMRay API functions
│   └─── Sample.py              # Sample class for controlling the samples
├─── log                        # Log directory for connector
    └─── cs-connector.log       # Log file for connector
└─── __init__.py
└─── connector.py               # Main connector application
└─── requirements.txt           # Python library requirements
└─── log                        # Log directory for Docker volume

• Python >3.10 with required packages (Required Packages)
• CrowdStrike Falcon Insight XDR
• VMRay Analyzer
• Docker (optional)

Clone the repository into a local folder.

git clone https://github.com/vmray/crowdstrike-falcon.git

Install the requirements.

pip install -r requirements.txt

Edit the vmray_conf.py general_conf.py crowdstrike_conf.pyfiles and update with your configurations.

• Create a Custom Access Level with the permissions below with a web interface for API at Create API section. (Support and Resources > API client and keys)

• Edit the CrowdStrikeConfig class in crowdstrike_conf.py file

• Create API Key with web interface. (Analysis Settings > API Keys)

• Edit the VMRayConfig class in vmray_conf.py file.

• Edit the GeneralConfig class in general_conf.py file.

You can start the connector with the command line after completing the configurations. You need to set RUNTIME_MODE as RUNTIME_MODE.CLI in the GeneralConfig. Also, you can create a cron job for continuous processing.

python connector.py

You can create and start a Docker image with Dockerfile after completing the configurations. You need to set RUNTIME_MODE as RUNTIME_MODE.DOCKER in the GeneralConfig.

docker build -t cs_connector .
docker run -d -v $(pwd)/log:/app/log -t cs_connector

After running the Docker container, you can see connector logs in the log directory on your host machine.