})
+
+We're excited to announce the release of our new cloud-to-cloud source for CrowdStrike Threat Intel. This source helps you to collect indicators data from the CrowdStrike platform, and ingest them into Sumo Logic for streamlined analysis. [Learn more](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source).
diff --git a/cid-redirects.json b/cid-redirects.json
index fc8741b11d..5e363df135 100644
--- a/cid-redirects.json
+++ b/cid-redirects.json
@@ -1597,6 +1597,7 @@
"/cid/10195": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/google-bigquery-source",
"/cid/10196": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/zero-networks-segment-source",
"/cid/10122": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/webex-source",
+ "/cid/10124": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source",
"/cid/10125": "/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/druva-cyber-resilience-source",
"/cid/10135": "/docs/manage/manage-subscription/manage-org-settings",
"/cid/10136": "/docs/send-data/hosted-collectors/amazon-aws/aws-kinesis-firehose-logs-source",
diff --git a/docs/integrations/product-list/product-list-a-l.md b/docs/integrations/product-list/product-list-a-l.md
index 34ceef40b4..8c06c29dee 100644
--- a/docs/integrations/product-list/product-list-a-l.md
+++ b/docs/integrations/product-list/product-list-a-l.md
@@ -166,7 +166,7 @@ For descriptions of the different types of integrations Sumo Logic offers, see [
| }){kind=logo}
| [Couchbase](https://www.couchbase.com/) | Apps:}){kind=logo}
| [Cribl](https://cribl.io/) | Automation integration: [Cribl](/docs/platform-services/automation-service/app-central/integrations/cribl/) })
| [Criminal IP](https://www.criminalip.io/) | Automation integration: [Criminal IP](/docs/platform-services/automation-service/app-central/integrations/criminal-ip) |
-| })
| [CrowdStrike](https://www.crowdstrike.com/) | Apps: | [CrowdStrike](https://www.crowdstrike.com/) | Apps: })
| [Cuckoo](https://cuckoo.readthedocs.io/en/latest/#) | Automation integration: [Cuckoo](/docs/platform-services/automation-service/app-central/integrations/cuckoo/) |
| })
| [CyberArk](https://www.cyberark.com/) | Automation integrations: })
| [CyberInt](https://cyberint.com/) | Automation integration: [Cyberint](/docs/platform-services/automation-service/app-central/integrations/cyberint) |
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source.md
new file mode 100644
index 0000000000..cd66d500d5
--- /dev/null
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source.md
@@ -0,0 +1,127 @@
+---
+id: crowdstrike-threat-intel-source
+title: CrowdStrike Threat Intel Source
+sidebar_label: CrowdStrike Threat Intel
+tags:
+ - cloud-to-cloud
+ - crowdstrike-threat-intel
+description: Learn how to collect combined endpoint vulnerabilities data from the CrowdStrike Spotlight platform.
+---
+import CodeBlock from '@theme/CodeBlock';
+import ExampleJSON from '/files/c2c/crowdstrike-threat-intel/example.json';
+import MyComponentSource from '!!raw-loader!/files/c2c/crowdstrike-threat-intel/example.json';
+import TerraformExample from '!!raw-loader!/files/c2c/crowdstrike-threat-intel/example.tf';
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+
+
+CrowdStrike is the leader in next-generation endpoint protection, threat intelligence, and response services. CrowdStrike’s core technology, the Falcon platform, stops breaches by preventing and responding to all types of attacks — both malware and malware-free. The CrowdStrike Threat Intel integration ingests the indicator data from CrowdStrike Combined API and sends it to Sumo Logic as normalized threat indicator.
+
+:::important
+The CrowdStrike API documentation is not public and can only be accessed by partners or customers.
+:::
+
+## Data collected
+
+| Polling Interval | Data |
+| :--- | :--- |
+| 1 hour | Indicator data |
+
+## Setup
+
+### Vendor configuration
+
+**Prerequisites**
+
+To collect vulnerability data from the CrowdStrike platform, you must have an authorized CrowdStrike account. CrowdStrike APIs use an OAuth 2.0 authorization token to make authorized API calls. CrowdStrike API Client is required to get the OAuth 2.0 authorization token. To define a CrowdStrike API client, you must be designated as a `CrowdStrike Falcon Administrator` role.
+
+In this configuration, you will set up the CrowdStrike Threat Intel and configure it to be authorized and authenticated to use indicator information from CrowdStrike Threat Intel API. To obtain the auth token, you will need the following parameters.
+
+#### API Client and API Secret
+
+The **API security token** is used to authenticate with CrowdStrike Threat Intel API. After successfully creating the API client, you will get the **Client Id**, **Client Secret**, and **Base URL**.
+
+To get the **CrowdStrike API Client**, follow the steps below:
+
+1. Sign in to [CrowdStrike Platform](https://falcon.crowdstrike.com/login/).
+1. Sign in using your email address and password. After you've completed the two-factor authentication, you'll be directed to the application dashboard.})
+1. From the CrowdStrike console, select the **Support and resources** option from the menu.})
+1. In the **Resources and tools** section, select the **API clients and keys** option. You can then view existing clients or add new API clients from there.})
+1. Click **Add new API client**. You will be prompted to give a descriptive name and select the appropriate API scopes.})
+1. Provide a proper name and description and select the **indicators(Falcon Intelligence):read scope** scope. Click on `ADD` to complete the process.
+1. After you click on `ADD` a dialogue box will appear with the **Client ID**, **Client Secret**, and **Base URL**. Copy and save the Client Id, Client Secret, and Base URL to a folder location because you will need them while configuring the [CrowdStrike Threat Intel Source](#source-configuration).})
+
+#### Region
+
+Identify your **Region** based on your **Base URL**. The region can be selected from the list below.
+
+ | Region | Base URL |
+ | :------ | :-------------------------- |
+ | US-1 | https://api.crowdstrike.com |
+ | US-2 | https://api.us-2.crowdstrike.com |
+ | EU-1 | https://api.eu-1.crowdstrike.com |
+ | US-GOV-1 | https://api.laggar.gcw.crowdstrike.com |
+
+### Source configuration
+
+When you create a CrowdStrike Spotlight Source, you add it to a Hosted Collector. Before creating the Source, identify the Hosted Collector you want to use or create a new Hosted Collector. For instructions, see [Configure a Hosted Collector](/docs/send-data/hosted-collectors/configure-hosted-collector).
+
+To configure the CrowdStrike Spotlight Source:
+1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. Learn how to collect combined endpoint vulnerabilities data from the CrowdStrike Spotlight platform.
+Learn how to collect combined endpoint indicators data from the CrowdStrike Threat Intel platform.
+
-CrowdStrike is the leader in next-generation endpoint protection, threat intelligence, and response services. CrowdStrike’s core technology, the Falcon platform, stops breaches by preventing and responding to all types of attacks — both malware and malware-free. The CrowdStrike Threat Intel integration ingests the indicator data from CrowdStrike Combined API and sends it to Sumo Logic as normalized threat indicator.
+CrowdStrike is the leader in next-generation endpoint protection, threat intelligence, and response services. CrowdStrike’s core technology, the Falcon platform, stops breaches by preventing and responding to all types of attacks — both malware and malware-free. The CrowdStrike Threat Intel integration ingests the indicator data from CrowdStrike Combined API and sends it to Sumo Logic as normalized threat indicator information.
:::important
The CrowdStrike API documentation is not public and can only be accessed by partners or customers.
From ef03c718a441c5afab4202a9d1200c6c8b16c431 Mon Sep 17 00:00:00 2001
From: Jagadisha V <129049263+JV0812@users.noreply.github.com>
Date: Wed, 23 Oct 2024 14:03:25 +0530
Subject: [PATCH 3/8] Update
docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source.md
Co-authored-by: John Pipkin (Sumo Logic)
-1. From the CrowdStrike console, select the **Support and resources** option from the menu.
+1. From the CrowdStrike console, select the **Support and resources** option from the menu.
1. In the **Resources and tools** section, select the **API clients and keys** option. You can then view existing clients or add new API clients from there.
1. Click **Add new API client**. You will be prompted to give a descriptive name and select the appropriate API scopes.
1. Provide a proper name and description and select the **indicators(Falcon Intelligence):read scope** scope. Click on `ADD` to complete the process.
From f4de6b3a76e1d49f2d19d7116f54273b2554bbdf Mon Sep 17 00:00:00 2001
From: Jagadisha V <129049263+JV0812@users.noreply.github.com>
Date: Wed, 23 Oct 2024 14:03:31 +0530
Subject: [PATCH 4/8] Update
docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source.md
Co-authored-by: John Pipkin (Sumo Logic)
1. From the CrowdStrike console, select the **Support and resources** option from the menu.
-1. In the **Resources and tools** section, select the **API clients and keys** option. You can then view existing clients or add new API clients from there.
+1. In the **Resources and tools** section, select the **API clients and keys** option. You can then view existing clients or add new API clients from there.
1. Click **Add new API client**. You will be prompted to give a descriptive name and select the appropriate API scopes.
1. Provide a proper name and description and select the **indicators(Falcon Intelligence):read scope** scope. Click on `ADD` to complete the process.
1. After you click on `ADD` a dialogue box will appear with the **Client ID**, **Client Secret**, and **Base URL**. Copy and save the Client Id, Client Secret, and Base URL to a folder location because you will need them while configuring the [CrowdStrike Threat Intel Source](#source-configuration).
From def3120ca15fa2132ac9477e564a3bcc24bdabe7 Mon Sep 17 00:00:00 2001
From: Jagadisha V <129049263+JV0812@users.noreply.github.com>
Date: Wed, 23 Oct 2024 14:03:40 +0530
Subject: [PATCH 5/8] Update
docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source.md
Co-authored-by: John Pipkin (Sumo Logic)
1. From the CrowdStrike console, select the **Support and resources** option from the menu.
1. In the **Resources and tools** section, select the **API clients and keys** option. You can then view existing clients or add new API clients from there.
-1. Click **Add new API client**. You will be prompted to give a descriptive name and select the appropriate API scopes.
+1. Click **Add new API client**. You will be prompted to give a descriptive name and select the appropriate API scopes.
1. Provide a proper name and description and select the **indicators(Falcon Intelligence):read scope** scope. Click on `ADD` to complete the process.
1. After you click on `ADD` a dialogue box will appear with the **Client ID**, **Client Secret**, and **Base URL**. Copy and save the Client Id, Client Secret, and Base URL to a folder location because you will need them while configuring the [CrowdStrike Threat Intel Source](#source-configuration).
From 4c67e4ad0030e789ca38436586ae37bef5813433 Mon Sep 17 00:00:00 2001
From: Jagadisha V <129049263+JV0812@users.noreply.github.com>
Date: Wed, 23 Oct 2024 14:03:47 +0530
Subject: [PATCH 6/8] Update
docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source.md
Co-authored-by: John Pipkin (Sumo Logic)
1. Click **Add new API client**. You will be prompted to give a descriptive name and select the appropriate API scopes.
1. Provide a proper name and description and select the **indicators(Falcon Intelligence):read scope** scope. Click on `ADD` to complete the process.
-1. After you click on `ADD` a dialogue box will appear with the **Client ID**, **Client Secret**, and **Base URL**. Copy and save the Client Id, Client Secret, and Base URL to a folder location because you will need them while configuring the [CrowdStrike Threat Intel Source](#source-configuration).
+1. After you click on `ADD` a dialogue box will appear with the **Client ID**, **Client Secret**, and **Base URL**. Copy and save the Client Id, Client Secret, and Base URL to a folder location because you will need them for the [source configuration](#source-configuration).
#### Region
From 268ed1e5febddb4bab9b3ad8f5899c1f86afb572 Mon Sep 17 00:00:00 2001
From: Jagadisha V <129049263+JV0812@users.noreply.github.com>
Date: Wed, 23 Oct 2024 14:04:01 +0530
Subject: [PATCH 7/8] Update
docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source.md
Co-authored-by: John Pipkin (Sumo Logic)
-
-We're excited to announce the release of our new cloud-to-cloud source for CrowdStrike Threat Intel. This source helps you to collect indicators data from the CrowdStrike platform, and ingest them into Sumo Logic for streamlined analysis. [Learn more](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source).
diff --git a/docs/integrations/product-list/product-list-a-l.md b/docs/integrations/product-list/product-list-a-l.md
index e3f0d4081d..d57beb4a3d 100644
--- a/docs/integrations/product-list/product-list-a-l.md
+++ b/docs/integrations/product-list/product-list-a-l.md
@@ -168,7 +168,7 @@ For descriptions of the different types of integrations Sumo Logic offers, see [
| | [Couchbase](https://www.couchbase.com/) | Apps: | [Cribl](https://cribl.io/) | Automation integration: [Cribl](/docs/platform-services/automation-service/app-central/integrations/cribl/) | [Criminal IP](https://www.criminalip.io/) | Automation integration: [Criminal IP](/docs/platform-services/automation-service/app-central/integrations/criminal-ip) |
-| | [CrowdStrike](https://www.crowdstrike.com/) | Apps: | [CrowdStrike](https://www.crowdstrike.com/) | Apps: | [Cuckoo](https://cuckoo.readthedocs.io/en/latest/#) | Automation integration: [Cuckoo](/docs/platform-services/automation-service/app-central/integrations/cuckoo/) |
| | [CyberArk](https://www.cyberark.com/) | Automation integrations: | [CyberInt](https://cyberint.com/) | Automation integration: [Cyberint](/docs/platform-services/automation-service/app-central/integrations/cyberint) |
diff --git a/docs/platform-services/threat-intelligence-indicators.md b/docs/platform-services/threat-intelligence-indicators.md
index d90e1f94e5..7eecafeb08 100644
--- a/docs/platform-services/threat-intelligence-indicators.md
+++ b/docs/platform-services/threat-intelligence-indicators.md
@@ -40,6 +40,7 @@ You do not need to be assigned these role capabilities to [find threats with log
To search logs that contain correlations to threat intelligence indicators, you must first ingest the indicators. You can ingest indicators using:
* **The Threat Intelligence tab**. See [Add indicators in the Threat Intelligence tab](#add-indicators-in-the-threat-intelligence-tab).
* **A collector**. See:
+ * [CrowdStrike Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source)
* [Intel471 Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/intel471-threat-intel-source)
* [Mandiant Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/mandiant-threat-intel-source)
* [STIX/TAXII 1 Client Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/stix-taxii-1-client-source)
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source.md
index 29604eddc6..3819a855aa 100644
--- a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source.md
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source.md
@@ -5,8 +5,15 @@ sidebar_label: CrowdStrike Threat Intel
tags:
- cloud-to-cloud
- crowdstrike-threat-intel
-description: Learn how to collect combined endpoint vulnerabilities data from the CrowdStrike Spotlight platform.
+description: Learn how to collect combined endpoint vulnerabilities data from the CrowdStrike platform.
---
+
+
+
+
+
+
+
import CodeBlock from '@theme/CodeBlock';
import ExampleJSON from '/files/c2c/crowdstrike-threat-intel/example.json';
import MyComponentSource from '!!raw-loader!/files/c2c/crowdstrike-threat-intel/example.json';
@@ -64,12 +71,12 @@ Identify your **Region** based on your **Base URL**. The region can be selected
### Source configuration
-When you create a CrowdStrike Spotlight Source, you add it to a Hosted Collector. Before creating the Source, identify the Hosted Collector you want to use or create a new Hosted Collector. For instructions, see [Configure a Hosted Collector](/docs/send-data/hosted-collectors/configure-hosted-collector).
+When you create a CrowdStrike Threat Intel Source, you add it to a Hosted Collector. Before creating the Source, identify the Hosted Collector you want to use or create a new Hosted Collector. For instructions, see [Configure a Hosted Collector](/docs/send-data/hosted-collectors/configure-hosted-collector).
-To configure the CrowdStrike Spotlight Source:
+To configure the CrowdStrike Threat Intel Source:
1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. Learn how to collect combined endpoint vulnerabilities data from the CrowdStrike Spotlight platform.