Metadata-Version: 2.1
Name: pysigma-pipeline-crowdstrike
Version: 1.0.3
Summary: pySigma CrowdStrike processing pipelines
Home-page: https://github.com/SigmaHQ/pySigma-pipeline-crowdstrike
License: LGPL-2.1-only
Author: Thomas Patzke
Author-email: thomas@patzke.org
Requires-Python: >=3.8,<4.0
Classifier: License :: OSI Approved
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Requires-Dist: pysigma (>=0.11.3,<0.12.0)
Project-URL: Repository, https://github.com/SigmaHQ/pySigma-pipeline-crowdstrike
Description-Content-Type: text/markdown

![Tests](https://github.com/SigmaHQ/pySigma-pipeline-crowdstrike/actions/workflows/test.yml/badge.svg)
![Coverage Badge](https://img.shields.io/endpoint?url=https://gist.githubusercontent.com/thomaspatzke/46f41e1fcf5eaab808ff5742401ac42d/raw)
![Status](https://img.shields.io/badge/Status-pre--release-orange)

# pySigma CrowdStrike Processing Pipeline

This package provides a processing pipeline for CrowdStrike events. It was mainly written for Falcon Data Replicator data but Splunk queries should also work in the CrowdStrike Splunk.

It provides the package `sigma.pipeline.crowdstrike` with the `crowdstrike_fdr_pipeline` function that returns a ProcessingPipeline object.

Currently the pipeline adds support for the following event types (Sigma logsource category to event_simpleName mapping):

* process_creation: ProcessRollup2
    * Only rules with references to the file name of the parent image are supported because CrowdStrike ProcessRollup2 events only contain the file name.
* network_connection: NetworkConnectionIP4 or NetworkReceiveAcceptIP4 (depending on Initiated field value)
    * events that refer to process image names are not supported because this information is not available in CrowdStrike network connection events, just a process id reference.

Not supported because the FDR events lack information required by Sigma rules:

* create_remote_thread: event lack information required by most rules. No process details, only reference.

This backend is currently maintained by:

* [Thomas Patzke](https://github.com/thomaspatzke/)
