{
  "name": "CrowdStrikeAPIConnector",
  "apiVersion": "2025-03-01",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "[parameters('workspace-location')]",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "CrowdStrikeAPIConnector",
      "title": "CrowdStrike API Data Connector (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The [CrowdStrike Data Connector](https://www.crowdstrike.com/) allows ingesting logs from the CrowdStrike API into Microsoft Sentinel. This connector provides the capability to ingest CrowdStrike [Alerts](https://falcon.crowdstrike.com/documentation/84/detection-and-prevention-policies-apis#get-alerts), [Detections](https://falcon.crowdstrike.com/documentation/84/detection-and-prevention-policies-apis#get-detections), [Hosts](https://falcon.crowdstrike.com/documentation/84/host-and-host-group-management-apis#get-hosts), [Cases](https://falcon.crowdstrike.com/documentation/84/cases-apis#get-cases), and [Vulnerabilities](https://falcon.crowdstrike.com/documentation/84/spotlight-apis#get-vulnerabilities) into Microsoft Sentinel. This connector is built on the Microsoft Sentinel Codeless Connector Platform and uses the CrowdStrike API to fetch logs. It supports DCR-based ingestion time transformations so that queries can run more efficiently. Refer to [CrowdStrike API documentation](https://falcon.crowdstrike.com/documentation/page/a2a7fc0e/crowdstrike-oauth2-based-apis) for more information.",
      "graphQueriesTableName": "CrowdStrikeAlertsV2_CL",
      "graphQueries": [
        {
          "metricName": "Total Alert logs received",
          "legend": "CrowdStrike Alert Logs",
          "baseQuery": "CrowdStrikeAlertsV2_CL"
        },
        {
          "metricName": "Total Cases logs received",
          "legend": "CrowdStrike Case Logs",
          "baseQuery": "CrowdStrikeCasesV2_CL"
        },
        {
          "metricName": "Total Detection logs received",
          "legend": "CrowdStrike Detection Logs",
          "baseQuery": "CrowdStrikeDetectionsV2_CL"
        },
        {
          "metricName": "Total Host logs received",
          "legend": "CrowdStrike Host Logs",
          "baseQuery": "CrowdStrikeHostsV2_CL"
        },
        {
          "metricName": "Total Vulnerability logs received",
          "legend": "CrowdStrike Vulnerability Logs",
          "baseQuery": "CrowdStrikeVulnerabilitiesV2_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get sample of CrowdStrike Alert logs",
          "query": "CrowdStrikeAlertsV2_CL\n | take 10"
        },
        {
          "description": "Get sample of CrowdStrike Case logs",
          "query": "CrowdStrikeCasesV2_CL\n | take 10"
        },
        {
          "description": "Get sample of CrowdStrike Detection logs",
          "query": "CrowdStrikeDetectionsV2_CL\n | take 10"
        },
        {
          "description": "Get sample of CrowdStrike Host logs",
          "query": "CrowdStrikeHostsV2_CL\n | take 10"
        },
        {
          "description": "Get sample of CrowdStrike Vulnerability logs",
          "query": "CrowdStrikeVulnerabilitiesV2_CL\n | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "CrowdStrikeAlertsV2_CL",
          "lastDataReceivedQuery": "CrowdStrikeAlertsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "CrowdStrikeCasesV2_CL",
          "lastDataReceivedQuery": "CrowdStrikeCasesV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "CrowdStrikeDetectionsV2_CL",
          "lastDataReceivedQuery": "CrowdStrikeDetectionsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "CrowdStrikeHostsV2_CL",
          "lastDataReceivedQuery": "CrowdStrikeHostsV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        },
        {
          "name": "CrowdStrikeVulnerabilitiesV2_CL",
          "lastDataReceivedQuery": "CrowdStrikeVulnerabilitiesV2_CL\n| where TimeGenerated > ago(12h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "isPreview": false,
        "status": 1
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true,
              "action": false
            }
          }
        ],
        "customs": [
          {
            "name": "Crowdstrike OAuth2 API Client and Scopes",
            "description": "#### Required API Scopes\nIn your CrowdStrike Falcon console, go to **Support and resources > API clients and keys**, select your API client, and enable the following scopes with **Read** access: **Alerts**, **Cases**, **Detections**, **Hosts**, **Spotlight Vulnerabilities**. [See the documentation to learn more about API](https://falcon.us-2.crowdstrike.com/documentation/page/a2a7fc0e/crowdstrike-oauth2-based-apis)."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect CrowdStrike to Microsoft Sentinel",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "Retrieve API URL and Client Credentials\nLog in to your CrowdStrike Console and navigate to the API section to copy your Base API URL.\nObtain your Client ID and Client Secret from the API credentials section in your CrowdStrike account."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "For detailed instructions on retrieving the Base API URL, Client ID, and Client Secret, please refer to the [Connector Tutorial](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/Data%20Connectors/CrowdStrikeAPI_ccp/README.md)."
              }
            },
            {
              "type": "MessageBar",
              "parameters": {
                "text": "**Solution version 3.4.0 and later uses the CrowdStrike V2 tables. Please use updated parser for any existing queries. Refer to the release notes of the solution [here](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/ReleaseNotes.md)**",
                "type": "warning"
              }
            }
          ]
        },
        {
          "title": "Manage CrowdStrike Connections",
          "description": "Add, view, and manage CrowdStrike API connections",
          "instructions": [
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnName": "Connector Alias",
                    "columnValue": "properties.addOnAttributes.friendlyName"
                  },
                  {
                    "columnName": "CrowdStrike Base URL",
                    "columnValue": "properties.addOnAttributes.apiUrl"
                  },
                  {
                    "columnName": "Data Type",
                    "columnValue": "properties.addOnAttributes.dataType"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "isPrimary": true,
                "label": "Add Connection",
                "title": "Configure CrowdStrike API Connection",
                "subtitle": "Connect to CrowdStrike to ingest security data",
                "contextPaneType": "DataConnectorsContextPane",
                "instructionSteps": [
                  {
                    "instructions": [
                      {
                        "type": "InfoMessage",
                        "parameters": {
                          "text": "**Note:** Each data type requires its corresponding API scope to be enabled. Missing scopes will only affect the related data type, other data types will continue to ingest normally.",
                          "visible": true,
                          "inline": true
                        }
                      },
                      {
                        "type": "Markdown",
                        "parameters": {
                          "content": ""
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Connection Alias",
                          "placeholder": "Production or Sandbox",
                          "type": "text",
                          "name": "friendlyName",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "InfoMessage",
                        "parameters": {
                          "text": "Enter a unique alias to identify this CrowdStrike connection. **Important**: Use different aliases for each domain. To update an existing connection, use the same alias or delete and create with the same alias. To replace a connection, delete the old one and create a new one with a new alias.",
                          "visible": true,
                          "inline": true
                        }
                      },
                      {
                        "type": "Dropdown",
                        "parameters": {
                          "label": "Query interval (in minutes)",
                          "name": "queryWindow",
                          "options": [
                            {
                              "key": "5",
                              "text": "5"
                            },
                            {
                              "key": "10",
                              "text": "10"
                            },
                            {
                              "key": "15",
                              "text": "15"
                            },
                            {
                              "key": "20",
                              "text": "20"
                            },
                            {
                              "key": "30",
                              "text": "30"
                            },
                            {
                              "key": "60",
                              "text": "60"
                            }
                          ],
                          "placeholder": "Select interval (e.g., 10)",
                          "required": true
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Base API URL",
                          "placeholder": "https://api.us-2.crowdstrike.com",
                          "type": "url",
                          "name": "apiUrl",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "InfoMessage",
                        "parameters": {
                          "text": "Enter the base URL of your CrowdStrike instance without trailing slash (e.g., https://api.us-2.crowdstrike.com)",
                          "visible": true,
                          "inline": true
                        }
                      },
                      {
                        "type": "Dropdown",
                        "parameters": {
                          "label": "Data Types",
                          "name": "selectedDataTypes",
                          "options": [
                            {
                              "key": "CrowdStrikeAlertsV2",
                              "text": "Alerts - Prevention alerts"
                            },
                            {
                              "key": "CrowdStrikeCasesV2",
                              "text": "Cases - Incident response cases"
                            },
                            {
                              "key": "CrowdStrikeDetectionsV2",
                              "text": "Detections - Endpoint detections"
                            },
                            {
                              "key": "CrowdStrikeHostsV2",
                              "text": "Hosts - Managed device inventory"
                            },
                            {
                              "key": "CrowdStrikeVulnerabilitiesV2",
                              "text": "Vulnerabilities - Spotlight vulnerability findings"
                            }
                          ],
                          "placeholder": "Select data types to collect...",
                          "isMultiSelect": true,
                          "defaultAllSelected": true,
                          "required": true
                        }
                      }
                    ]
                  },
                  {
                    "title": "OAuth2 Credentials",
                    "description": "Configure OAuth2 credentials for API access",
                    "instructions": [
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Client ID",
                          "placeholder": "Your Client ID",
                          "type": "text",
                          "name": "clientId",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Client Secret",
                          "placeholder": "Your Client Secret",
                          "type": "password",
                          "name": "clientSecret",
                          "validations": {
                            "required": true
                          }
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        },
        {
          "title": "Querying Detections (after successful connection)",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "Once logs are ingesting, the **CrowdStrikeDetections** table contains individual alert records grouped by `aggregate_id`. To view true detection-level behavior, use the following KQL query to aggregate alerts by their detection group:"
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "```\nCrowdStrikeDetections\n| summarize\n    AlertCount = count(),\n    FirstSeen = min(CreatedTimestamp),\n    LastSeen = max(CreatedTimestamp),\n    MaxSeverity = max(Severity)\nby AggregateId\n```"
              }
            }
          ]
        }
      ],
      "isConnectivityCriteriasMatchSome": false
    }
  }
}