Add CrowdStrike plugin

plugins/CrowdStrike/v1/configValidation.json

@@ -0,0 +1,11 @@
+{
+    "steps": [
+        {
+            "displayName": "Authenticate",
+            "dataStream": { "name": "currentUser" },
+            "required": true,
+            "error": "Could not authenticate. Check your Client ID, Client Secret and CrowdStrike Cloud region are correct, and that the API client has the Hosts: Read scope.",
+            "success": "Connected successfully."
+        }
+    ]
+}

plugins/CrowdStrike/v1/custom_types.json

@@ -0,0 +1,16 @@
+[
+    {
+        "name": "CrowdStrike Host Group",
+        "sourceType": "CrowdStrike Host Group",
+        "icon": "layer-group",
+        "singular": "Host Group",
+        "plural": "Host Groups"
+    },
+    {
+        "name": "CrowdStrike Host",
+        "sourceType": "CrowdStrike Host",
+        "icon": "desktop",
+        "singular": "Host",
+        "plural": "Hosts"
+    }
+]

plugins/CrowdStrike/v1/dataStreams/alerts.json

@@ -0,0 +1,232 @@
+{
+    "name": "alerts",
+    "displayName": "Alerts",
+    "description": "Detections and incidents from the unified Falcon Alerts API, one row per alert, with computed detection and response latency",
+    "tags": [
+        "Security",
+        "Alerts"
+    ],
+    "baseDataSourceName": "httpRequestUnscoped",
+    "config": {
+        "httpMethod": "post",
+        "endpointPath": "/alerts/combined/alerts/v1",
+        "postBody": {
+            "limit": 1000,
+            "sort": "created_timestamp|desc",
+            "filter": "{{ (typeof timeframe !== 'undefined' && timeframe && timeframe.start && timeframe.end ? [ \"created_timestamp:>'\" + timeframe.start.replace(/\\.\\d+Z$/, 'Z') + \"'+created_timestamp:<'\" + timeframe.end.replace(/\\.\\d+Z$/, 'Z') + \"'\" ] : []).concat(((S => S.length > 1 ? [ \"(\" + S.join(\",\") + \")\" ] : S)((typeof scope === 'undefined' || !scope ? [] : [ [\"device.device_id\", scope.filter(o => (typeof o.type === 'string' ? o.type : JSON.stringify(o)).indexOf('Host Group') < 0)], [\"device.groups\", scope.filter(o => (typeof o.type === 'string' ? o.type : JSON.stringify(o)).indexOf('Host Group') >= 0)] ].filter(p => p[1].length).map(p => p[0] + \":[\" + p[1].map(o => \"'\" + String([].concat(o.rawId !== undefined ? o.rawId : (o.sourceId || o.id))[0]).split('~').pop() + \"'\").join(\",\") + \"]\"))))).concat((typeof status === 'undefined' || !status || !status.length ? [] : [ \"status:[\" + status.map(s => \"'\" + (s.value || s) + \"'\").join(\",\") + \"]\" ])).join(\"+\") || \"created_timestamp:>'2000-01-01T00:00:00Z'\" }}"
+        },
+        "paging": {
+            "mode": "token",
+            "in": {
+                "realm": "payload",
+                "path": "meta.pagination.after"
+            },
+            "out": {
+                "realm": "body",
+                "path": "after"
+            }
+        },
+        "pathToData": "resources",
+        "expandInnerObjects": true,
+        "errorHandling": {
+            "type": "script",
+            "script": "errorHandling/falconApiError.js"
+        }
+    },
+    "matches": "none",
+    "ui": [
+        {
+            "type": "objects",
+            "name": "scope",
+            "label": "Host or Host Group (optional)",
+            "matches": {
+                "sourceType": {
+                    "type": "oneOf",
+                    "values": [
+                        "CrowdStrike Host",
+                        "CrowdStrike Host Group"
+                    ]
+                }
+            }
+        },
+        {
+            "type": "choiceChips",
+            "name": "status",
+            "label": "Status",
+            "isMulti": true,
+            "options": [
+                {
+                    "value": "new",
+                    "label": "New"
+                },
+                {
+                    "value": "in_progress",
+                    "label": "In Progress"
+                },
+                {
+                    "value": "closed",
+                    "label": "Closed"
+                },
+                {
+                    "value": "reopened",
+                    "label": "Reopened"
+                }
+            ]
+        }
+    ],
+    "metadata": [
+        {
+            "name": "composite_id",
+            "displayName": "ID",
+            "shape": "string",
+            "role": "id",
+            "visible": false
+        },
+        {
+            "name": "name",
+            "displayName": "Name",
+            "shape": "string",
+            "role": "label"
+        },
+        {
+            "name": "description",
+            "displayName": "Description",
+            "shape": "string"
+        },
+        {
+            "name": "status",
+            "displayName": "Status",
+            "shape": "string"
+        },
+        {
+            "name": "severity_name",
+            "displayName": "Severity",
+            "shape": "string"
+        },
+        {
+            "name": "severity",
+            "displayName": "Severity Score",
+            "shape": "number"
+        },
+        {
+            "name": "confidence",
+            "displayName": "Confidence",
+            "shape": "number"
+        },
+        {
+            "name": "product",
+            "displayName": "Product",
+            "shape": "string"
+        },
+        {
+            "name": "type",
+            "displayName": "Alert Type",
+            "shape": "string"
+        },
+        {
+            "name": "tactic",
+            "displayName": "Tactic",
+            "shape": "string"
+        },
+        {
+            "name": "technique",
+            "displayName": "Technique",
+            "shape": "string"
+        },
+        {
+            "name": "device.device_id",
+            "displayName": "Device ID",
+            "shape": "string",
+            "visible": false
+        },
+        {
+            "name": "device.hostname",
+            "displayName": "Hostname",
+            "shape": "string"
+        },
+        {
+            "name": "device.platform_name",
+            "displayName": "Platform",
+            "shape": "string"
+        },
+        {
+            "name": "filename",
+            "displayName": "File Name",
+            "shape": "string"
+        },
+        {
+            "name": "filepath",
+            "displayName": "File Path",
+            "shape": "string"
+        },
+        {
+            "name": "cmdline",
+            "displayName": "Command Line",
+            "shape": "string"
+        },
+        {
+            "name": "user_name",
+            "displayName": "User",
+            "shape": "string"
+        },
+        {
+            "name": "tags",
+            "displayName": "Tags",
+            "shape": "string"
+        },
+        {
+            "name": "created_timestamp",
+            "displayName": "Created",
+            "shape": "date",
+            "role": "timestamp"
+        },
+        {
+            "name": "updated_timestamp",
+            "displayName": "Last Updated",
+            "shape": "date"
+        },
+        {
+            "name": "first_behavior",
+            "displayName": "First Behavior",
+            "shape": "date"
+        },
+        {
+            "name": "last_behavior",
+            "displayName": "Last Behavior",
+            "shape": "date"
+        },
+        {
+            "name": "detectionLatencySeconds",
+            "displayName": "Detection Latency",
+            "computed": true,
+            "valueExpression": "{{ ($['first_behavior'] && $['created_timestamp']) ? Math.max(0, (new Date($['created_timestamp']) - new Date($['first_behavior'])) / 1000) : null }}",
+            "shape": [
+                "seconds",
+                {
+                    "formatDuration": true
+                }
+            ]
+        },
+        {
+            "name": "responseLatencySeconds",
+            "displayName": "Response Latency",
+            "computed": true,
+            "valueExpression": "{{ ($['seconds_to_triaged'] !== undefined && $['seconds_to_triaged'] !== null && $['seconds_to_triaged'] !== '' && !isNaN(Number($['seconds_to_triaged']))) ? Math.max(0, Number($['seconds_to_triaged'])) : null }}",
+            "shape": [
+                "seconds",
+                {
+                    "formatDuration": true
+                }
+            ]
+        },
+        {
+            "sourceId": "device.device_id",
+            "sourceType": "CrowdStrike Host",
+            "name": "device.hostname"
+        },
+        {
+            "pattern": ".*"
+        }
+    ],
+    "timeframes": true
+}

plugins/CrowdStrike/v1/dataStreams/currentUser.json

@@ -0,0 +1,18 @@
+{
+    "name": "currentUser",
+    "displayName": "Host IDs",
+    "description": "A minimal Falcon Hosts query, used only to verify the configured credentials can reach the API",
+    "tags": ["Security"],
+    "baseDataSourceName": "httpRequestUnscoped",
+    "config": {
+        "httpMethod": "get",
+        "endpointPath": "/devices/queries/devices/v1",
+        "getArgs": [{ "key": "limit", "value": "1" }],
+        "paging": { "mode": "none" },
+        "pathToData": "resources"
+    },
+    "matches": "none",
+    "visibility": { "type": "hidden" },
+    "metadata": [{ "pattern": ".*" }],
+    "timeframes": false
+}