Use Cases (2)
Real-world integrations with TheHive
Synchronise status between TheHive alerts/cases and CrowdStrike detections/incidents
Keep case/alert status in sync between TheHive and CrowdStrike Falcon using notifications and the CrowdStrikeFalcon_Sync responder.
- License required: Platinum
- TheHive version required: 5.0+
Ingest CrowdStrike Falcon Detections and Incidents into TheHive Using an External Script
Install and configure the falcon2thehive connector to automatically ingest CrowdStrike Falcon detections and incidents into TheHive as alerts in real time.
Analyzers (11)
Enrich observables with intelligence
CrowdstrikeFalcon Sandbox Win7 v1.0
Send a file to CrowdstrikeFalcon Sandbox
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
file
CrowdstrikeFalcon Sandbox Win10 v1.0
Send a file to CrowdstrikeFalcon Sandbox
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
file
CrowdstrikeFalcon Sandbox Win11 v1.0
Send a file to CrowdstrikeFalcon Sandbox
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
file
CrowdstrikeFalcon Sandbox Linux v1.0
Send a file to CrowdstrikeFalcon Sandbox
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
file
CrowdstrikeFalcon Sandbox MacOS v1.0
Send a file to CrowdstrikeFalcon Sandbox
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
file
CrowdstrikeFalcon Sandbox Win7 64 v1.0
Send a file to CrowdstrikeFalcon Sandbox
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
file
CrowdstrikeFalcon getDeviceDetails v1.0
Get device information from Crowdstrike Falcon
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
hostname
CrowdstrikeFalcon ThreatIntel v1.0
Query threat intelligence indicators from Crowdstrike Falcon Intelligence
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
hash,domain,ip,url
CrowdstrikeFalcon getDeviceAlerts v1.0
Get Device alerts from Crowdstrike Falcon
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
hostname
CrowdstrikeFalcon GetDeviceVulnerabilities v1.0
Get device vulnerabilities from hostname
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
hostname
CrowdstrikeFalcon Sandbox Android v1.0
Send a file to CrowdstrikeFalcon Sandbox
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
file
Responders (9)
Trigger automated responses
CrowdStrikeFalcon unhideHost v1.0
This action will restore a host. Detection reporting will resume after the host is restored
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
thehive:case_artifact
CrowdStrikeFalcon suppressDetections v1.0
Supress detections for the host.
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
thehive:case_artifact
CrowdStrikeFalcon AddIOC v1.0
Add IOC to IoC Management on Crowdstrike - supports domain, url, IPs & different kind of hashes
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
thehive:case_artifact
CrowdStrikeFalcon LiftContainmentHost v1.0
This action lifts containment on the host, which returns its network communications to normal
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
thehive:case_artifact
CrowdStrikeFalcon RemoveIOC v1.0
remove IOC from IoC Management on Crowdstrike
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
thehive:case_artifact
CrowdStrikeFalcon unsuppressDetections v1.0
Allow detections for the host.
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
thehive:case_artifact
CrowdStrikeFalcon hideHost v1.0
This action will delete a host. After the host is deleted, no new detections for that host will be reported via UI or APIs
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
thehive:case_artifact
CrowdStrikeFalcon HostContainment v1.0
This action contains the host, which stops any network communications to locations other than the CrowdStrike cloud and IPs specified in your containment policy
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
thehive:case_artifact
CrowdStrikeFalcon Sync v1.0
Sync TheHive status back to CS Alerts or Incidents
- Author: Fabien Bloume, StrangeBee
- License: AGPL-V3
- Data Types:
thehive:case,thehive:alert
External Integrations (1)
External integrations that connect CrowdStrike Falcon with TheHive
falcon2thehive
Real-time connector that streams CrowdStrike Falcon detection events into TheHive, turning Falcon alerts into actionable TheHive Alerts. Supports DetectionSummaryEvent, IdentityProtectionEvent, and MobileDetectionSummaryEvent with automatic observable extraction and TTP mapping.
- Type: connector
