From 3c5c6934496eacee6425478f4f201286f922cba3 Mon Sep 17 00:00:00 2001 From: Joe Peeples Date: Mon, 11 Nov 2024 16:00:55 -0500 Subject: [PATCH 1/2] Known Issues + Access requirements for Crowdstrike Connector (#5848) * First draft * mdx to asciidoc * Apply suggestions from Nastasha's review Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> --------- Co-authored-by: Colleen McGinnis Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com> (cherry picked from commit 8b7467f9b885392cc666878e35ab0d8e8d77264c) # Conflicts: # docs/serverless/endpoint-response-actions/response-actions-config.asciidoc # docs/serverless/endpoint-response-actions/third-party-actions.asciidoc --- .../admin/response-actions-config.asciidoc | 8 + .../admin/third-party-actions.asciidoc | 2 + docs/release-notes/8.15.asciidoc | 22 ++- .../response-actions-config.asciidoc | 165 ++++++++++++++++++ .../third-party-actions.asciidoc | 80 +++++++++ 5 files changed, 273 insertions(+), 4 deletions(-) create mode 100644 docs/serverless/endpoint-response-actions/response-actions-config.asciidoc create mode 100644 docs/serverless/endpoint-response-actions/third-party-actions.asciidoc diff --git a/docs/management/admin/response-actions-config.asciidoc b/docs/management/admin/response-actions-config.asciidoc index e38ab3022a..52a556fb51 100644 --- a/docs/management/admin/response-actions-config.asciidoc +++ b/docs/management/admin/response-actions-config.asciidoc @@ -38,8 +38,16 @@ Expand a section below for your endpoint security system: . **Enable API access in CrowdStrike.** Create an API client in CrowdStrike to allow access to the system. Refer to CrowdStrike's docs for instructions. + - Give the API client the minimum privilege required to read CrowdStrike data and perform actions on enrolled hosts. Consider creating separate API clients for reading data and performing actions, to limit privileges allowed by each API client. + * To isolate and release hosts, the API client must have `Read` access for Alerts, and `Read` and `Write` access for Hosts. + - Take note of the client ID, client secret, and base URL; you'll need them in later steps when you configure {elastic-sec} components to access CrowdStrike. +- The base URL varies depending on your CrowdStrike account type: + * US-1: `https://api.crowdstrike.com` + * US-2: `https://api.us-2.crowdstrike.com` + * EU-1: `https://api.eu-1.crowdstrike.com` + * US-GOV-1: `https://api.laggar.gcw.crowdstrike.com` + . **Install the CrowdStrike integration and {agent}.** Elastic's {integrations-docs}/crowdstrike[CrowdStrike integration] collects and ingests logs into {elastic-sec}. + diff --git a/docs/management/admin/third-party-actions.asciidoc b/docs/management/admin/third-party-actions.asciidoc index 27dece4a79..c2367a16f3 100644 --- a/docs/management/admin/third-party-actions.asciidoc +++ b/docs/management/admin/third-party-actions.asciidoc @@ -16,6 +16,8 @@ You can perform response actions on hosts enrolled in other third-party endpoint * Third-party response actions require an https://www.elastic.co/pricing[Enterprise subscription]. * Each response action type has its own user role privilege requirements. Find an action's role requirements at <>. + +* Additional <> is required to connect {elastic-sec} with a third-party system. -- [discrete] diff --git a/docs/release-notes/8.15.asciidoc b/docs/release-notes/8.15.asciidoc index 7a3a786bf5..c77343f346 100644 --- a/docs/release-notes/8.15.asciidoc +++ b/docs/release-notes/8.15.asciidoc @@ -157,7 +157,7 @@ On October 17, 2024, this issue was resolved. ==== Bug fixes * Fixes an {elastic-defend} bug that affected CPU usage for Windows process events where the same executable is repeatedly launched, for example, during compilation workloads. With this fix, CPU usage is improved. -* Fixes an {elastic-defend} bug that sometimes caused malware scan response actions to crash when they attempted to scan an inaccessible directory. +* Fixes an {elastic-defend} bug that sometimes caused malware scan response actions to crash when they attempted to scan an inaccessible directory. * Fixes an {elastic-defend} bug that sometimes caused {elastic-endpoint} to report an incorrect version if it used an independent {agent} release. * Fixes an {elastic-defend} bug where the `process.thread.Ext.call_stack_final_user_module.protection_provenance_path` field might be populated with a non-path value. This fix is for Windows endpoints only. * Fixes an {elastic-defend} bug that can lead to {elastic-endpoint} reporting `STATUS_ACCESS_DENIED` when attempting to open files for `GENERIC_READ`. {elastic-endpoint} almost always recovered from this issue, but with this fix, it succeeds on the first try. This fix is for Windows endpoints only. @@ -196,7 +196,7 @@ On August 1, 2024, it was discovered that Elastic AI Assistant's responses when [%collapsible] ==== *Details* + -On August 20, 2024, it was discovered that the bulk actions menu on the Rules page erroneously had the option to manually run multiple rules. +On August 20, 2024, it was discovered that the bulk actions menu on the Rules page erroneously had the option to manually run multiple rules. *Workaround* + Upgrade to 8.15.1. @@ -224,6 +224,20 @@ On September 5, 2024, this issue was resolved. ==== // end::known-issue-14686[] +// tag::known-issue-crowdstrike-response-actions[] +[discrete] +.CrowdStrike response actions (isolate and release host) not working +[%collapsible] +==== +*Details* + +A bug prevented third-party response actions with CrowdStrike from working. + +*Workaround* + +Upgrade to 8.15.1 or later. + +==== +// end::known-issue-crowdstrike-response-actions[] + // tag::known-issue-192084[] [discrete] .Alerts wrongfully inherit previously-selected tags @@ -267,7 +281,7 @@ On October 17, 2024, this issue was resolved. * Adds an API that allows you to perform paginated KQL searches through asset criticality records ({kibana-pull}186568[#186568]). * Adds public APIs for managing asset criticality ({kibana-pull}186169[#186169]). * Allows you to edit the `max_signals`, `related_integrations`, and `required_fields` fields for custom rules ({kibana-pull}179680[#179680], {kibana-pull}178295[#178295], {kibana-pull}180682[#180682]). -* Provides help from AI Assistant when you're correcting rule query errors ({kibana-pull}179091[#179091]). +* Provides help from AI Assistant when you're correcting rule query errors ({kibana-pull}179091[#179091]). * Allows you to bulk update custom highlighted fields for rules ({kibana-pull}179312[#179312]). * Adds alert suppression for {ml} and {esql} rules ({kibana-pull}181926[#181926], {kibana-pull}180927[#180927]). * Provides previews of hosts, users, and alerts that you're examining in the alert details flyout ({kibana-pull}186850[#186850], {kibana-pull}186857[#186857]). @@ -293,7 +307,7 @@ On October 17, 2024, this issue was resolved. * Updates the copy for bulk assigning asset criticality to multiple entities ({kibana-pull}181390[#181390]). * Improves visual and logic issues in the Findings table ({kibana-pull}184185[#184185]). * Enables the expandable alert details flyout by default and replaces the `securitySolution:enableExpandableFlyout` advanced setting with a feature flag that allows you to revert to the old flyout version ({kibana-pull}184169[#184169]). -* Improves the UI design and copy of various places in the alert details flyout ({kibana-pull}187430[#187430], {kibana-pull}187920[#187920]). +* Improves the UI design and copy of various places in the alert details flyout ({kibana-pull}187430[#187430], {kibana-pull}187920[#187920]). * Updates the MITRE ATT&CK framework to version 15.1 ({kibana-pull}183463[#183463]). * Improves the warning message about rule actions being unavailable after a rule ran ({kibana-pull}182741[#182741]). * Enables the `xMatters` and `Server Log connectors` rule actions ({kibana-pull}172933[#172933]). diff --git a/docs/serverless/endpoint-response-actions/response-actions-config.asciidoc b/docs/serverless/endpoint-response-actions/response-actions-config.asciidoc new file mode 100644 index 0000000000..b761623996 --- /dev/null +++ b/docs/serverless/endpoint-response-actions/response-actions-config.asciidoc @@ -0,0 +1,165 @@ +[[security-response-actions-config]] += Configure third-party response actions + +// :description: Configure {elastic-sec} to perform response actions on hosts protected by third-party systems. +// :keywords: serverless, security, how-to, configure + +preview:[] + +preview::[] + +You can direct third-party endpoint protection systems to perform response actions on enrolled hosts, such as isolating a suspicious endpoint from your network, without leaving the {elastic-sec} UI. This page explains the configuration steps needed to enable response actions for these third-party systems: + +* CrowdStrike +* SentinelOne + +Check out <> to learn which response actions are supported for each system. + +.Prerequisites +[NOTE] +==== +* <>: Endpoint Protection Complete +* <>: **SOC manager** or **Endpoint operations analyst** +* Endpoints must have actively running third-party agents installed. +==== + +Select a tab below for your endpoint security system: + +++++ +
+
+ + +
+
+++++ +//// +/* NOTE TO CONTRIBUTORS: These DocTabs have very similar content. If you change anything + in this tab, apply the change to the other tabs, too. */ +//// + +To configure response actions for CrowdStrike-enrolled hosts: + +. **Enable API access in CrowdStrike.** Create an API client in CrowdStrike to allow access to the system. Refer to CrowdStrike's docs for instructions. ++ +** Give the API client the minimum privilege required to read CrowdStrike data and perform actions on enrolled hosts. Consider creating separate API clients for reading data and performing actions, to limit privileges allowed by each API client. +*** To isolate and release hosts, the API client must have `Read` access for Alerts, and `Read` and `Write` access for Hosts. +** Take note of the client ID, client secret, and base URL; you'll need them in later steps when you configure {elastic-sec} components to access CrowdStrike. +** The base URL varies depending on your CrowdStrike account type: +*** US-1: `https://api.crowdstrike.com` +*** US-2: `https://api.us-2.crowdstrike.com` +*** EU-1: `https://api.eu-1.crowdstrike.com` +*** US-GOV-1: `https://api.laggar.gcw.crowdstrike.com` +. **Install the CrowdStrike integration and {agent}.** Elastic's {integrations-docs}/crowdstrike[CrowdStrike integration] collects and ingests logs into {elastic-sec}. ++ +.. Go to **Project Settings** → **Integrations**, search for and select **CrowdStrike**, then select **Add CrowdStrike**. +.. Configure the integration with an **Integration name** and optional **Description**. +.. Select **Collect CrowdStrike logs via API**, and enter the required **Settings**: ++ +*** **Client ID**: Client ID for the API client used to read CrowdStrike data. +*** **Client Secret**: Client secret allowing you access to CrowdStrike. +*** **URL**: The base URL of the CrowdStrike API. +.. Select the **Falcon Alerts** and **Hosts** sub-options under **Collect CrowdStrike logs via API**. +.. Scroll down and enter a name for the agent policy in **New agent policy name**. If other agent policies already exist, you can click the **Existing hosts** tab and select an existing policy instead. For more details on {agent} configuration settings, refer to {fleet-guide}/agent-policy.html[{agent} policies]. +.. Click **Save and continue**. +.. Select **Add {agent} to your hosts** and continue with the <> to install {agent} on a resource in your network (such as a server or VM). {agent} will act as a bridge collecting data from CrowdStrike and sending it back to {elastic-sec}. +. **Create a CrowdStrike connector.** Elastic's {kibana-ref}/crowdstrike-action-type.html[CrowdStrike connector] enables {elastic-sec} to perform actions on CrowdStrike-enrolled hosts. ++ +[IMPORTANT] +==== +Do not create more than one CrowdStrike connector. +==== ++ +.. Go to **Stack Management** → **Connectors**, then select **Create connector**. +.. Select the **CrowdStrike** connector. +.. Enter the configuration information: ++ +*** **Connector name**: A name to identify the connector. +*** **CrowdStrike API URL**: The base URL of the CrowdStrike API. +*** **CrowdStrike Client ID**: Client ID for the API client used to perform actions in CrowdStrike. +*** **Client Secret**: Client secret allowing you access to CrowdStrike. +.. Click **Save**. +. **Create and enable detection rules to generate {elastic-sec} alerts.** (Optional) Create <> to generate {elastic-sec} alerts based on CrowdStrike events and data. The {integrations-docs}/crowdstrike[CrowdStrike integration docs] list the available ingested logs and fields you can use to build a rule query. ++ +This gives you visibility into CrowdStrike without needing to leave {elastic-sec}. You can perform supported endpoint response actions directly from alerts that a rule creates, by using the **Take action** menu in the alert details flyout. + +++++ +
+ +
+++++ diff --git a/docs/serverless/endpoint-response-actions/third-party-actions.asciidoc b/docs/serverless/endpoint-response-actions/third-party-actions.asciidoc new file mode 100644 index 0000000000..c0d38cb0e1 --- /dev/null +++ b/docs/serverless/endpoint-response-actions/third-party-actions.asciidoc @@ -0,0 +1,80 @@ +[[security-third-party-actions]] += Third-party response actions + +// :description: Respond to threats on hosts enrolled in third-party security systems. +// :keywords: serverless, security, defend, reference, manage + +preview:[] + +preview::[] + +You can perform response actions on hosts enrolled in other third-party endpoint protection systems, such as CrowdStrike or SentinelOne. For example, you can direct the other system to isolate a suspicious endpoint from your network, without leaving the {elastic-sec} UI. + +.Requirements +[NOTE] +==== +* Third-party response actions require the Endpoint Protection Complete <>. +* Each response action type has its own user role privilege requirements. Find an action's role requirements at <>. +* Additional <> is required to connect {elastic-sec} with a third-party system. +==== + +[discrete] +[[security-third-party-actions-supported-systems-and-response-actions]] +== Supported systems and response actions + +The following third-party response actions are supported for CrowdStrike and SentinelOne. <> to connect each system with {elastic-sec}. + +++++ +
+
+ + +
+
+++++ +These response actions are supported for CrowdStrike-enrolled hosts: + +* **Isolate and release a host** using any of these methods: ++ +** From a detection alert +** From the response console ++ +Refer to the instructions on <> and <> hosts for more details. + +++++ +
+ +
+++++ From e617bb25f4d9ed104ba4fb9fbd417b828c81d51f Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Mon, 11 Nov 2024 21:03:14 +0000 Subject: [PATCH 2/2] Delete docs/serverless directory and its contents --- .../response-actions-config.asciidoc | 165 ------------------ .../third-party-actions.asciidoc | 80 --------- 2 files changed, 245 deletions(-) delete mode 100644 docs/serverless/endpoint-response-actions/response-actions-config.asciidoc delete mode 100644 docs/serverless/endpoint-response-actions/third-party-actions.asciidoc diff --git a/docs/serverless/endpoint-response-actions/response-actions-config.asciidoc b/docs/serverless/endpoint-response-actions/response-actions-config.asciidoc deleted file mode 100644 index b761623996..0000000000 --- a/docs/serverless/endpoint-response-actions/response-actions-config.asciidoc +++ /dev/null @@ -1,165 +0,0 @@ -[[security-response-actions-config]] -= Configure third-party response actions - -// :description: Configure {elastic-sec} to perform response actions on hosts protected by third-party systems. -// :keywords: serverless, security, how-to, configure - -preview:[] - -preview::[] - -You can direct third-party endpoint protection systems to perform response actions on enrolled hosts, such as isolating a suspicious endpoint from your network, without leaving the {elastic-sec} UI. This page explains the configuration steps needed to enable response actions for these third-party systems: - -* CrowdStrike -* SentinelOne - -Check out <> to learn which response actions are supported for each system. - -.Prerequisites -[NOTE] -==== -* <>: Endpoint Protection Complete -* <>: **SOC manager** or **Endpoint operations analyst** -* Endpoints must have actively running third-party agents installed. -==== - -Select a tab below for your endpoint security system: - -++++ -
-
- - -
-
-++++ -//// -/* NOTE TO CONTRIBUTORS: These DocTabs have very similar content. If you change anything - in this tab, apply the change to the other tabs, too. */ -//// - -To configure response actions for CrowdStrike-enrolled hosts: - -. **Enable API access in CrowdStrike.** Create an API client in CrowdStrike to allow access to the system. Refer to CrowdStrike's docs for instructions. -+ -** Give the API client the minimum privilege required to read CrowdStrike data and perform actions on enrolled hosts. Consider creating separate API clients for reading data and performing actions, to limit privileges allowed by each API client. -*** To isolate and release hosts, the API client must have `Read` access for Alerts, and `Read` and `Write` access for Hosts. -** Take note of the client ID, client secret, and base URL; you'll need them in later steps when you configure {elastic-sec} components to access CrowdStrike. -** The base URL varies depending on your CrowdStrike account type: -*** US-1: `https://api.crowdstrike.com` -*** US-2: `https://api.us-2.crowdstrike.com` -*** EU-1: `https://api.eu-1.crowdstrike.com` -*** US-GOV-1: `https://api.laggar.gcw.crowdstrike.com` -. **Install the CrowdStrike integration and {agent}.** Elastic's {integrations-docs}/crowdstrike[CrowdStrike integration] collects and ingests logs into {elastic-sec}. -+ -.. Go to **Project Settings** → **Integrations**, search for and select **CrowdStrike**, then select **Add CrowdStrike**. -.. Configure the integration with an **Integration name** and optional **Description**. -.. Select **Collect CrowdStrike logs via API**, and enter the required **Settings**: -+ -*** **Client ID**: Client ID for the API client used to read CrowdStrike data. -*** **Client Secret**: Client secret allowing you access to CrowdStrike. -*** **URL**: The base URL of the CrowdStrike API. -.. Select the **Falcon Alerts** and **Hosts** sub-options under **Collect CrowdStrike logs via API**. -.. Scroll down and enter a name for the agent policy in **New agent policy name**. If other agent policies already exist, you can click the **Existing hosts** tab and select an existing policy instead. For more details on {agent} configuration settings, refer to {fleet-guide}/agent-policy.html[{agent} policies]. -.. Click **Save and continue**. -.. Select **Add {agent} to your hosts** and continue with the <> to install {agent} on a resource in your network (such as a server or VM). {agent} will act as a bridge collecting data from CrowdStrike and sending it back to {elastic-sec}. -. **Create a CrowdStrike connector.** Elastic's {kibana-ref}/crowdstrike-action-type.html[CrowdStrike connector] enables {elastic-sec} to perform actions on CrowdStrike-enrolled hosts. -+ -[IMPORTANT] -==== -Do not create more than one CrowdStrike connector. -==== -+ -.. Go to **Stack Management** → **Connectors**, then select **Create connector**. -.. Select the **CrowdStrike** connector. -.. Enter the configuration information: -+ -*** **Connector name**: A name to identify the connector. -*** **CrowdStrike API URL**: The base URL of the CrowdStrike API. -*** **CrowdStrike Client ID**: Client ID for the API client used to perform actions in CrowdStrike. -*** **Client Secret**: Client secret allowing you access to CrowdStrike. -.. Click **Save**. -. **Create and enable detection rules to generate {elastic-sec} alerts.** (Optional) Create <> to generate {elastic-sec} alerts based on CrowdStrike events and data. The {integrations-docs}/crowdstrike[CrowdStrike integration docs] list the available ingested logs and fields you can use to build a rule query. -+ -This gives you visibility into CrowdStrike without needing to leave {elastic-sec}. You can perform supported endpoint response actions directly from alerts that a rule creates, by using the **Take action** menu in the alert details flyout. - -++++ -
- -
-++++ diff --git a/docs/serverless/endpoint-response-actions/third-party-actions.asciidoc b/docs/serverless/endpoint-response-actions/third-party-actions.asciidoc deleted file mode 100644 index c0d38cb0e1..0000000000 --- a/docs/serverless/endpoint-response-actions/third-party-actions.asciidoc +++ /dev/null @@ -1,80 +0,0 @@ -[[security-third-party-actions]] -= Third-party response actions - -// :description: Respond to threats on hosts enrolled in third-party security systems. -// :keywords: serverless, security, defend, reference, manage - -preview:[] - -preview::[] - -You can perform response actions on hosts enrolled in other third-party endpoint protection systems, such as CrowdStrike or SentinelOne. For example, you can direct the other system to isolate a suspicious endpoint from your network, without leaving the {elastic-sec} UI. - -.Requirements -[NOTE] -==== -* Third-party response actions require the Endpoint Protection Complete <>. -* Each response action type has its own user role privilege requirements. Find an action's role requirements at <>. -* Additional <> is required to connect {elastic-sec} with a third-party system. -==== - -[discrete] -[[security-third-party-actions-supported-systems-and-response-actions]] -== Supported systems and response actions - -The following third-party response actions are supported for CrowdStrike and SentinelOne. <> to connect each system with {elastic-sec}. - -++++ -
-
- - -
-
-++++ -These response actions are supported for CrowdStrike-enrolled hosts: - -* **Isolate and release a host** using any of these methods: -+ -** From a detection alert -** From the response console -+ -Refer to the instructions on <> and <> hosts for more details. - -++++ -
- -
-++++