Skip to content

cs-shadowbq/falcon-intel-spike

Repository files navigation

Falcon Intel Indicators Spike

Warning

This is Proof of Concept Code for fetching CrowdStrike Threat Intel Indicators in mass from the OAUTH2 REST API and storing them in a mongodb.

This proof of concept is a concept. This is not a production ready tested piece of code that uses to best practices, patterns, and processes.

screenshot

Data Storage Capacity and Size

This data can take significant time to download the over 200+ Million indicators at 4000 indicators per page, even with threads.

Storage of the solution would use 10s of GB of data and require proper indexing on the MongoDB.

Setup

Setup consist of using the config.ini and exporting sensitive OAUTH ENV variables as shown. Do not store your Client Secrets or Mongo Connection String secrets in a unprotected config file.

screenshot

Example of a connection string is in the config.ini:

export MONGO_CONNECTIONSTRING=mongodb://[username:password@]host1[:port1][,...hostN[:portN]][/[defaultauthdb][?options]]

Dependencies

FalconPy

Falconpy is the supported CrowdStrike Python Falcon SDK.

MongoDB

MongoClient is required to connect to a mongoDB with authorization via mongoconnect string

About

falcon intel indicators to mongodb

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages