falconstream's Introduction

FalconStream

falconstream is event forwarder of CrowdStrike Falcon. CrowdStrike Falcon has Event Stream API and the API provides events regarding audit, malware detection and so on. falconstream receives the events continuously and can store them to local file system or Amazon S3. (Also Amazon Kinesis Data Firehose is planned to implement)

Architecture

falconstream simply receives events from CrowdStrike Falcon Event Stream API by long time HTTPS connection.

Getting Started

Prerequisite

Go >= 1.13
API key (client_id + secret) of CrowdStrike Falcon

Setup

go get github.com/m-mizutani/falconstream

Run and output to console

$ export FALCON_CLIENT_ID=xxxxxxxxxxxxx
$ export FALCON_SECRET=xxxxxxxxxxxxxxxxxxx
$ falconstream
falconstream.falconEvent{
  MetaData: &gofalcon.StreamEventMetaData{
    CustomerIDString:  "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    EventType:         "UserActivityAuditEvent",
    Offset:            12345,
    EventCreationTime: 1568947873000,
  },
  Event: map[string]interface {}{
    "AuditKeyValues": []interface {}{
      map[string]interface {}{
        "ValueString": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
        "Key":         "quarantined_file_id",
      },
      map[string]interface {}{
        "Key":         "action_taken",
        "ValueString": "quarantined",
      },
    },
    "UTCTimestamp":  1568947873.000000,
    "UserId":        "Crowdstrike",
    "UserIp":        "",
    "OperationName": "quarantined_file_update",
    "ServiceName":   "quarantined_files",
  },
}

Basic usage

Output to local file system

$ falconstream -e fs &
$ tail -f falcon.log
{"metadata":{"customerIDString":"xxxxxxxxxxx","eventType":"AuthActivityAuditEvent","offset":1100,"eventCreationTime":1567079329516},"event":{"OperationName":"twoFactorAuthenticate","ServiceName":"CrowdStrike Authentication","Success":true,"UTCTimestamp":1567079329516,"UserId":"xxxxxxxxx","UserIp":"10.0.0.1"}}
...(snip)...

Output to Amazon S3

NOTE: You need to prepare AWS credential. See following document for more detail.

$ falconstream -e s3 --aws-region ap-northeast-1 --aws-s3-bucket YOUR-BUCKET-NAME

Use AWS Secrets Manager to save Falcon credentials

NOTE: You need to setup a secret including falcon_client_id and falcon_secret in Secrets Manager at first. Then see ARN of the secret.

$ falconstream --aws-secret-arn arn:aws:secretsmanager:ap-northeast-1:1234567890:secret:my-secret

License

MIT License
Author: Masayoshi Mizutani < [email protected] >

falconstream's People

Contributors

Stargazers

Watchers

falconstream's Issues

Not working on Ubuntu 20.04.1 LTS with Go 1.13.8

My Setup

root@dev:~# uname -a
Linux dev 5.4.0-62-generic #70-Ubuntu SMP Tue Jan 12 12:45:47 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux

root@dev:~# go version
go version go1.13.8 linux/amd64

Issue

root@dev:~# go get github.com/m-mizutani/falconstream
# github.com/m-mizutani/falconstream
go/src/github.com/m-mizutani/falconstream/main.go:29:14: cannot use []cli.Author literal (type []cli.Author) as type []*cli.Author in assignment
go/src/github.com/m-mizutani/falconstream/main.go:37:17: cannot use cli.StringFlag literal (type cli.StringFlag) as type cli.Flag in array or slice literal:
	cli.StringFlag does not implement cli.Flag (Apply method has pointer receiver)
go/src/github.com/m-mizutani/falconstream/main.go:43:17: cannot use cli.StringFlag literal (type cli.StringFlag) as type cli.Flag in array or slice literal:
	cli.StringFlag does not implement cli.Flag (Apply method has pointer receiver)
go/src/github.com/m-mizutani/falconstream/main.go:49:17: cannot use cli.StringFlag literal (type cli.StringFlag) as type cli.Flag in array or slice literal:
	cli.StringFlag does not implement cli.Flag (Apply method has pointer receiver)
go/src/github.com/m-mizutani/falconstream/main.go:54:17: cannot use cli.StringFlag literal (type cli.StringFlag) as type cli.Flag in array or slice literal:
	cli.StringFlag does not implement cli.Flag (Apply method has pointer receiver)
go/src/github.com/m-mizutani/falconstream/main.go:59:17: cannot use cli.StringFlag literal (type cli.StringFlag) as type cli.Flag in array or slice literal:
	cli.StringFlag does not implement cli.Flag (Apply method has pointer receiver)
go/src/github.com/m-mizutani/falconstream/main.go:64:17: cannot use cli.StringFlag literal (type cli.StringFlag) as type cli.Flag in array or slice literal:
	cli.StringFlag does not implement cli.Flag (Apply method has pointer receiver)
root@dev:~#

Recommend Projects

m-mizutani / falconstream Goto Github PK