Skip to content

Commit a2fddcd

Browse files
mjabascal10mjabascal10
committed
feat(crowdstrike): add integration procedures and configuration for CrowdStrike module
1 parent 7356807 commit a2fddcd

File tree

4 files changed

+319
-1
lines changed

4 files changed

+319
-1
lines changed

‎backend/src/main/java/com/park/utmstack/domain/application_modules/enums/ModuleName.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,5 +65,6 @@ public enum ModuleName {
6565
PFSENSE,
6666
ORACLE,
6767
SURICATA,
68-
UTMSTACK
68+
UTMSTACK,
69+
CROWDSTRIKE
6970
}

‎backend/src/main/java/com/park/utmstack/domain/application_modules/factory/impl/ModuleCrowdStrike.java‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
package com.park.utmstack.domain.application_modules.factory.impl;
2+
3+
import com.park.utmstack.domain.application_modules.UtmModule;
4+
import com.park.utmstack.domain.application_modules.UtmModuleGroupConfiguration;
5+
import com.park.utmstack.domain.application_modules.enums.ModuleName;
6+
import com.park.utmstack.domain.application_modules.factory.IModule;
7+
import com.park.utmstack.domain.application_modules.types.ModuleConfigurationKey;
8+
import com.park.utmstack.domain.application_modules.types.ModuleRequirement;
9+
import com.park.utmstack.domain.application_modules.validators.UtmModuleConfigValidator;
10+
import com.park.utmstack.repository.UtmModuleGroupConfigurationRepository;
11+
import com.park.utmstack.service.application_modules.UtmModuleService;
12+
import lombok.RequiredArgsConstructor;
13+
import org.springframework.stereotype.Component;
14+
15+
import java.util.ArrayList;
16+
import java.util.Collections;
17+
import java.util.List;
18+
import java.util.stream.Collectors;
19+
20+
@Component
21+
@RequiredArgsConstructor
22+
public class ModuleCrowdStrike implements IModule {
23+
private static final String CLASSNAME = "ModuleCrowdStrike";
24+
25+
private final UtmModuleService moduleService;
26+
private final UtmModuleConfigValidator utmStackConfigValidator;
27+
28+
@Override
29+
public UtmModule getDetails(Long serverId) throws Exception {
30+
final String ctx = CLASSNAME + ".getDetails";
31+
try {
32+
return moduleService.findByServerIdAndModuleName(serverId, ModuleName.CROWDSTRIKE);
33+
} catch (Exception e) {
34+
throw new Exception(ctx + ": " + e.getMessage());
35+
}
36+
}
37+
38+
@Override
39+
public List<ModuleRequirement> checkRequirements(Long serverId) throws Exception {
40+
return Collections.emptyList();
41+
}
42+
43+
@Override
44+
public List<ModuleConfigurationKey> getConfigurationKeys(Long groupId) throws Exception {
45+
List<ModuleConfigurationKey> keys = new ArrayList<>();
46+
47+
keys.add(ModuleConfigurationKey.builder()
48+
.withGroupId(groupId)
49+
.withConfKey("crowdStrike.client.id")
50+
.withConfName("Client ID")
51+
.withConfDescription("CrowdStrike Client ID")
52+
.withConfDataType("text")
53+
.withConfRequired(true)
54+
.build());
55+
56+
keys.add(ModuleConfigurationKey.builder()
57+
.withGroupId(groupId)
58+
.withConfKey("crowdStrike.client.secret")
59+
.withConfName("Secret")
60+
.withConfDescription("CrowdStrike Client Secret")
61+
.withConfDataType("password")
62+
.withConfRequired(true)
63+
.build());
64+
65+
keys.add(ModuleConfigurationKey.builder()
66+
.withGroupId(groupId)
67+
.withConfKey("crowdStrike.cloud.region.url")
68+
.withConfName("Cloud Region URL")
69+
.withConfDescription("CrowdStrike Cloud Region URL")
70+
.withConfDataType("text")
71+
.withConfRequired(false)
72+
.build());
73+
74+
75+
keys.add(ModuleConfigurationKey.builder()
76+
.withGroupId(groupId)
77+
.withConfKey("crowdStrike.app.name")
78+
.withConfName("App Name")
79+
.withConfDescription("App Name for CrowdStrike integration")
80+
.withConfDataType("text")
81+
.withConfRequired(false)
82+
.build());
83+
84+
return keys;
85+
86+
}
87+
88+
public boolean validateConfiguration(UtmModule module, List<UtmModuleGroupConfiguration> configuration) {
89+
90+
return utmStackConfigValidator.validate(module, configuration);
91+
}
92+
93+
@Override
94+
public ModuleName getName() {
95+
return ModuleName.SOC_AI;
96+
}
97+
}

‎backend/src/main/resources/config/liquibase/changelog/20260105001_adding_crowdstrike_integration.xml‎

Lines changed: 218 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,218 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<databaseChangeLog
3+
xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
6+
7+
<changeSet id="20260105001" author="Manuel">
8+
<createProcedure dbms="postgresql">
9+
<![CDATA[
10+
CREATE OR REPLACE FUNCTION public.register_integration_crowdstrike(srv_id integer)RETURNS void
11+
LANGUAGE plpgsql
12+
AS
13+
$function$
14+
declare
15+
grp_id integer;
16+
mod_id bigint;
17+
18+
begin
19+
INSERT INTO utm_module (pretty_name, module_description, module_active, module_icon, module_name,
20+
server_id, module_category, needs_restart, lite_version, is_activatable)
21+
VALUES ('CrowdStrike',
22+
'CrowdStrike is a leading cybersecurity company whose cloud-native Falcon platform uses AI, threat intelligence, and a lightweight agent to protect endpoints, cloud workloads, identities, and data.',
23+
FALSE,
24+
'crowdstrike.svg',
25+
'CROWDSTRIKE',
26+
srv_id,
27+
'Device',
28+
FALSE,
29+
TRUE,
30+
TRUE)
31+
ON CONFLICT (module_name, server_id) DO UPDATE SET pretty_name = 'CrowdStrike',
32+
module_icon = 'crowdstrike.svg',
33+
module_name = 'CROWDSTRIKE',
34+
module_category = 'Device',
35+
module_description = 'CrowdStrike is a leading cybersecurity company whose cloud-native Falcon platform uses AI, threat intelligence, and a lightweight agent to protect endpoints, cloud workloads, identities, and data.',
36+
lite_version = TRUE,
37+
server_id = srv_id;
38+
39+
end;
40+
$function$;
41+
]]>
42+
</createProcedure>
43+
44+
<createProcedure dbms="postgresql">
45+
<![CDATA[
46+
create or replace function register_integrations(srv_id integer, srv_type character varying)
47+
returns void
48+
language plpgsql
49+
as
50+
$$
51+
BEGIN
52+
53+
perform public.register_integration_netflow(srv_id);
54+
55+
perform public.register_integration_window_agent(srv_id);
56+
57+
perform public.register_integration_syslog(srv_id);
58+
59+
perform public.register_integration_vmware(srv_id);
60+
61+
perform public.register_integration_linux_agent(srv_id);
62+
63+
perform public.register_integration_apache(srv_id);
64+
65+
perform public.register_integration_linux_audit_demon(srv_id);
66+
67+
perform public.register_integration_elasticsearch(srv_id);
68+
69+
perform public.register_integration_hap(srv_id);
70+
71+
perform public.register_integration_kafka(srv_id);
72+
73+
perform public.register_integration_kibana(srv_id);
74+
75+
perform public.register_integration_logstash(srv_id);
76+
77+
perform public.register_integration_mongodb(srv_id);
78+
79+
perform public.register_integration_mysql(srv_id);
80+
81+
perform public.register_integration_nats(srv_id);
82+
83+
perform public.register_integration_nginx(srv_id);
84+
85+
perform public.register_integration_osquery(srv_id);
86+
87+
perform public.register_integration_postgresql(srv_id);
88+
89+
perform public.register_integration_redis(srv_id);
90+
91+
perform public.register_integration_traefik(srv_id);
92+
93+
perform public.register_integration_cisco(srv_id);
94+
95+
perform public.register_integration_cisco_meraki(srv_id);
96+
97+
perform public.register_integration_json(srv_id);
98+
99+
perform public.register_integration_iis(srv_id);
100+
101+
perform public.register_integration_kaspersky(srv_id);
102+
103+
perform public.register_integration_eset(srv_id);
104+
105+
perform public.register_integration_sentinel_one(srv_id);
106+
107+
perform public.register_integration_fortigate(srv_id);
108+
109+
perform public.register_integration_sophosxg(srv_id);
110+
111+
perform public.register_integration_macos(srv_id);
112+
113+
114+
IF srv_type = 'aio' THEN
115+
116+
perform public.register_integration_file_integrity(srv_id);
117+
118+
perform public.register_integration_azure(srv_id);
119+
120+
perform public.register_integration_o365(srv_id);
121+
122+
perform public.register_integration_aws(srv_id);
123+
124+
perform public.register_integration_sophos_central(srv_id);
125+
126+
perform public.register_integration_gcp(srv_id);
127+
128+
perform public.register_integration_fire_power(srv_id);
129+
130+
perform public.register_integration_mikrotik(srv_id);
131+
132+
perform public.register_integration_palo_alto(srv_id);
133+
134+
perform public.register_integration_cisco_switch(srv_id);
135+
136+
perform public.register_integration_sonic_wall(srv_id);
137+
138+
perform public.register_integration_deceptive_bytes(srv_id);
139+
140+
perform public.register_integration_github(srv_id);
141+
142+
perform public.register_integration_bitdefender(srv_id);
143+
144+
perform public.register_integration_soc_ai(srv_id);
145+
146+
perform public.register_integration_suricata(srv_id);
147+
148+
perform public.register_integration_utmstack(srv_id);
149+
150+
perform public.register_integration_crowdstrike(srv_id);
151+
152+
END IF;
153+
154+
perform public.update_module_dependencies();
155+
END;
156+
$$;
157+
]]>
158+
</createProcedure>
159+
<createProcedure dbms="postgresql">
160+
do
161+
$$
162+
begin
163+
perform public.execute_register_integration_function();
164+
end;
165+
$$
166+
language plpgsql;
167+
</createProcedure>
168+
<sql dbms="postgresql" splitStatements="true" stripComments="true">
169+
<![CDATA[
170+
171+
INSERT INTO utm_data_types (id, data_type, data_type_name, data_type_description, last_update, included, system_owner)
172+
VALUES (51, 'crowdstrike', 'CrowdStrike', 'Used to filter logs and apply alerting rules related to CrowdStrike integration', NOW(), true, true);
173+
174+
INSERT INTO utm_logstash_filter (id, logstash_filter, filter_name, filter_group_id, system_owner, module_name, is_active, filter_version, data_type_id)
175+
VALUES (1532, $$
176+
177+
# Crowdstrike module filter, version 1.0.0
178+
# Based in docs and samples provided
179+
#
180+
# Documentations
181+
# 1- https://docs.cyderes.cloud/parser-knowledge-base/cs_stream
182+
183+
pipeline:
184+
- dataTypes:
185+
- crowdstrike
186+
steps:
187+
- json:
188+
source: raw
189+
190+
$$, 'CrowdStrike', null, true, 'CROWDSTRIKE', false, '2.0.0', 51);
191+
]]>
192+
</sql>
193+
<sql dbms="postgresql" splitStatements="true" stripComments="true">
194+
<![CDATA[
195+
INSERT INTO public.utm_logstash_pipeline (id, pipeline_id, pipeline_name, pipeline_status, module_name, system_owner, pipeline_description, pipeline_internal, events_out)
196+
VALUES (57, 'crowdstrike', 'CrowdStrike', 'down', 'CROWDSTRIKE', true, null, false, 0);
197+
198+
INSERT INTO utm_group_logstash_pipeline_filters (filter_id, pipeline_id, relation)
199+
VALUES (1532, 57, 'PIPELINE_FILTER');
200+
201+
INSERT INTO utm_index_pattern (id, pattern, pattern_module, pattern_system, is_active)
202+
VALUES (70,'v11-log-crowdstrike-*', 'CrowdStrike', true, true);
203+
204+
INSERT INTO utm_menu (id, name, url, parent_id, type, dashboard_id, position, menu_active, menu_action, menu_icon, module_name_short)
205+
VALUES (268, 'CrowdStrike', 'discover/log-analyzer?patternId=70&indexPattern=v11-log-crowdstrike-*', 200, 1, null, 68, false, false, null, 'CROWDSTRIKE');
206+
207+
INSERT INTO utm_menu_authority (menu_id, authority_name)
208+
VALUES ( 268, 'ROLE_USER');
209+
210+
INSERT INTO utm_menu_authority (menu_id, authority_name)
211+
VALUES ( 268, 'ROLE_ADMIN');
212+
213+
]]>
214+
215+
216+
</sql>
217+
</changeSet>
218+
</databaseChangeLog>

‎backend/src/main/resources/config/liquibase/master.xml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -291,5 +291,7 @@
291291

292292
<include file="/config/liquibase/changelog/20251223003_update_filter_wineventlog.xml" relativeToChangelogFile="false"/>
293293

294+
<include file="/config/liquibase/changelog/20260105001_adding_crowdstrike_integration.xml" relativeToChangelogFile="false"/>
295+
294296

295297
</databaseChangeLog>

0 commit comments

Comments
 (0)