Cortex-Analyzers 3.4.0: Unleashing the Falcon with new CrowdStrike Analyzers & Responders

Bees and falcons are joining forces to strengthen the hive. We’re pleased to announce the release of Cortex-Analyzers 3.4.0, adding numerous analyzers and responders for CrowdStrike Falcon to the arsenal, supported and maintained by StrangeBee.

With CrowdStrike Falcon being one of the most popular EDR solutions, tightening its integration with TheHive provides significant advantages for incident responders all over the world. Here comes Cortex-Analyzers 3.4.0!

We’re introducing 4 new CrowdStrike Falcon Analyzers in this release, designed to provide analysts with richer context and actionable information directly within TheHive.

Get Device Details

Retrieve comprehensive details about a host in your environment, including the last user logged in and the status of the CrowdStrike Falcon agent.

Get Device Vulnerabilities

Get a list of identified vulnerabilities discovered on a host using Falcon Spotlight.

Get Device Alerts

Retrieve a list of alerts linked to a host to quickly review any related detections.

Falcon Sandbox

Leverage Falcon Sandbox for in-depth file analysis, enabling you to detect and analyze malicious files effectively and get insights directly inside TheHive.

Contain or mitigate threats in CrowdStrike Falcon straight from TheHive. This new release provides multiple responders that cover a variety of useful response actions, which are particularly valuable in time-sensitive scenarios.

Host Response Action

Using the CrowdStrike Falcon Hosts API, we’ve added responder flavors letting analysts perform all available hosts response actions, including the two most important in an incident response context:

• Contain Hosts: Quickly isolate compromised hosts to stop threats from spreading.
• Lift Containment: Bring hosts back online by lifting containment when they’re safe again.

Other available response actions on hosts include:

• Suppress Detections: Suppress detections for a host.
• Hide Hosts: Exclude hosts from certain views or management tasks.
• Reverse Actions: Undo any of the above actions when necessary, by using the correct responder.

IoC Management

Manage Indicators of Compromise (IoCs) in your CrowdStrike Falcon directly from TheHive to take a step ahead and block hashes, trigger alerts for IPs and domains across your fleet of endpoints. You can also reverse these actions if necessary, giving you greater control over your IoC management.

CrowdStrike Status Sync Responder

Additionally, we have added a CrowdStrike Status Sync responder. This responder maps TheHive case and alert stages to CrowdStrike Falcon detections and incidents statuses, ensuring statuses of your investigations are synchronized back to CrowdStrike Falcon.

Since TheHive version 5.0.14 and Cortex version 3.1.7, catalogs are automatically fetched. As a result, you may already see the new analyzers and responders in your Cortex instance. All that’s left to do is to log into your Cortex instance, enable the analyzers and responders, as well as updating the analyzers report templates for the best experience.

If you encounter a different situation or wish to know more, feel free to refer to our How to update analyzers & responders guide for detailed instructions.

We are looking forward to developing more integrations in the future and advancing further!

Feel free to let us know what could be improved and what you would like to see next through our support platform. We are eager to provide more useful content empowering incident responders worldwide!