Had a client request come in last week: they needed every containment action from Falcon (host isolation, process kill, etc.) logged directly into their SIEM for compliance auditing. While the Falcon UI is great, pulling a historical, automated feed for another system isn't always obvious.
The Event Stream API is the key. I wrote a straightforward Python script that polls for `DetectionSummaryEvent` events where `ContainmentStatus` is not null. It formats the critical details (hostname, user, action, timestamp, detection ID) and forwards them via the SIEM's API (in this case, Splunk HTTP Event Collector). The script runs as a scheduled service.
Here's the core logic (minus the SIEM-specific forwarding):
```python
import requests
import json
from datetime import datetime, timedelta
# Configuration
API_BASE = "https://api.crowdstrike.com"
CLIENT_ID = "your_client_id"
CLIENT_SECRET = "your_client_secret"
SIEM_HEC_URL = "your_siem_hec_endpoint"
SIEM_HEC_TOKEN = "your_siem_hec_token"
def get_falcon_token():
url = f"{API_BASE}/oauth2/token"
data = {"client_id": CLIENT_ID, "client_secret": CLIENT_SECRET}
response = requests.post(url, data=data)
return response.json()["access_token"]
def get_containment_events(token, minutes_back=60):
url = f"{API_BASE}/sensors/entities/datafeed/v2"
headers = {"Authorization": f"Bearer {token}"}
params = {
"filter": f"ContainmentStatus:!=''",
"after": (datetime.utcnow() - timedelta(minutes=minutes_back)).isoformat() + "Z"
}
response = requests.get(url, headers=headers, params=params)
return response.json().get("resources", [])
# Main loop: get token, fetch events, process and forward to SIEM
token = get_falcon_token()
events = get_containment_events(token)
for event in events:
# Extract relevant fields
log_entry = {
"timestamp": event.get("ProcessStartTime"),
"hostname": event.get("ComputerName"),
"detection_id": event.get("DetectId"),
"action": event.get("ContainmentStatus"),
"user": event.get("UserName")
}
# Forward to SIEM (example for Splunk HEC)
# requests.post(SIEM_HEC_URL, headers={"Authorization": f"Splunk {SIEM_HEC_TOKEN}"}, json=log_entry)
```
**Key points:**
* You'll need API credentials with `Event Streams: Read` scope.
* The script is stateless; for production, you'd want to track the last fetched event ID or timestamp.
* Consider error handling and rate limits for your SIEM's API.
* This pattern works for any log destination (Azure Log Analytics, Sumo Logic, etc.)—just change the forwarding part.
This turned a manual, periodic reporting task into a fully automated audit trail. Handy for anyone building a centralized security operations log.
-mike
Integrate or die