CrowdStrike Identity Protection
CrowdStrike Identity Protection provides advanced monitoring and protection of user identities against unauthorized access and threats.
CrowdStrike Identity Protection is a robust platform designed to enhance identity threat detection and response. By integrating with Swimlane Turbine, this connector allows users to query identity protection data using GraphQL, providing a seamless way to access and analyze identity-related information. This integration empowers security teams to automate identity threat detection and response processes, improving efficiency and reducing the time to mitigate potential threats.
Prerequisites
Before you can use the CrowdStrike Identity Protection connector for Turbine, you'll need access to the CrowdStrike API. This requires the following:
- OAuth2 authorization using the following parameters:
- URL: The endpoint for accessing CrowdStrike's API services.
- Client ID: A unique identifier for your application to authenticate with the API.
- Client Secret: A secret key used in conjunction with the Client ID to authenticate.
- Token URL: The URL where the OAuth2 token can be obtained.
This Connector integrates exclusively with Identity Endpoint API provided by CrowdStrike.
Capabilities
This Connector provides the following capabilities:
- Query Identity Protection
Asset Setup
The Connector requires the oauth2_client_credential
Additional Documentation
Configurations
Oauth 2.0 Client Credentials
Authenticates using oauth 2.0 client credentials
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
token_url | ο»Ώ | string | Required |
client_id | The client ID | string | Required |
client_secret | The client secret. | string | Required |
audience | Permission scopes for this action. | string | Optional |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Query Identity Protection
Query identity protection in CrowdStrike using GraphQL. Requires a JSON body with a query parameter.
Endpoint
- URL: /identity-protection/combined/graphql/v1
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
query | string | Optional | Parameter for Query Identity Protection |
Input Example
{"json_body":{"query":"{entities(roles:[BuiltinAdministratorRole] sortKey:PRIMARY_DISPLAY_NAME sortOrder:ASCENDING first:5) {nodes{primaryDisplayName secondaryDisplayName}}}"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
data | object | Response data |
data.entities | object | Response data |
data.entities.nodes | array | Response data |
data.entities.nodes.file_name | string | Response data |
data.entities.nodes.file | string | Response data |
extensions | object | Output field: extensions |
extensions.runTime | number | Time value |
extensions.remainingPoints | number | Output field: extensions.remainingPoints |
extensions.reset | number | Output field: extensions.reset |
extensions.consumedPoints | number | Output field: extensions.consumedPoints |
Output Example
{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 16 Nov 2023 07:43:36 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"112","Connection":"keep-alive","Cache-Control":"no-cache","Content-Encoding":"gzip","Etag":"W/\"76-WxOjDDE1egxcFoFaOaRCMUbuHQ0\"","Expires":"Thu, 16 Nov 2023 07:43:35 GMT","Pragma":"no-cache","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Appliance-Date":"2023-11-16T07:43:36+00:...
Response Headers
Header | Description | Example |
|---|---|---|
Cache-Control | Directives for caching mechanisms | no-cache |
Connection | HTTP response header: Connection | keep-alive |
Content-Encoding | HTTP response header: Content-Encoding | gzip |
Content-Length | The length of the response body in bytes | 112 |
Content-Type | The media type of the resource | application/json; charset=utf-8 |
Date | The date and time at which the message was originated | Thu, 16 Nov 2023 07:43:36 GMT |
Etag | An identifier for a specific version of a resource | W/"76-WxOjDDE1egxcFoFaOaRCMUbuHQ0" |
Expires | The date/time after which the response is considered stale | Thu, 16 Nov 2023 07:43:35 GMT |
Pragma | HTTP response header: Pragma | no-cache |
Server | Information about the software used by the origin server | nginx |
Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains |
X-Appliance-Date | HTTP response header: X-Appliance-Date | 2023-11-16T07:43:36+00:00 |
X-Appliance-Id | HTTP response header: X-Appliance-Id | 38e4055c-061d-4ee4-a21f-ffefd648c15a |
X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff |
X-Cs-Region | HTTP response header: X-Cs-Region | us-1 |
X-Cs-Traceid | HTTP response header: X-Cs-Traceid | 1ea3951c-dbbd-4e62-8cd4-991c7c78c471 |
X-Dns-Prefetch-Control | HTTP response header: X-Dns-Prefetch-Control | off |
X-Download-Options | HTTP response header: X-Download-Options | noopen |
X-Frame-Options | HTTP response header: X-Frame-Options | SAMEORIGIN |
X-Powered-By | HTTP response header: X-Powered-By | Express |
X-Preempt-Version | HTTP response header: X-Preempt-Version | 5.58.56190 |
X-Ratelimit-Limit | The number of requests allowed in the current rate limit window | 6000 |
X-Ratelimit-Remaining | The number of requests remaining in the current rate limit window | 5998, 5999 |
X-Xss-Protection | HTTP response header: X-Xss-Protection | 1; mode=block |