IoC 로그에 대해 CrowdStrike에서 Google SecOps로의 로그 수집을 구성하려면 다음 단계를 완료하세요.
CrowdStrike Falcon 콘솔에서 새 API 클라이언트 키 쌍을 만듭니다. 이 키 쌍을 사용하면 Google SecOps Intel Bridge가 CrowdStrike Falcon의 이벤트와 보충 정보에 액세스하고 이를 읽을 수 있습니다. 설정 안내는 CrowdStrike to Google SecOps Intel Bridge를 참고하세요.
키 쌍을 만들 때 Indicators (Falcon Intelligence)에 READ 권한을 제공합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-02(UTC)"],[],[],null,["# Collect CrowdStrike Falcon logs\n===============================\n\nThis document provides guidance about how to ingest CrowdStrike Falcon logs into Google Security Operations as follows:\n\n- Collect CrowdStrike Falcon logs by setting up a Google Security Operations feed.\n- Map CrowdStrike Falcon log fields to Google SecOps Unified Data Model (UDM) fields.\n- Understand supported CrowdStrike Falcon log types and event types.\n\nFor more information, see the [Data ingestion to Google SecOps overview](/chronicle/docs/data-ingestion-flow).\n\nBefore you begin\n----------------\n\nEnsure that you have the following prerequisites:\n\n- Administrator rights on the CrowdStrike instance to install the [CrowdStrike Falcon Host sensor](https://falcon.us-2.crowdstrike.com/login?next=%2Fhost-management%2Fsensor-downloads%2Fall)\n- All systems in the deployment architecture are configured in the UTC time zone.\n- Target device runs on a supported operating system\n - Must be a 64-bit server\n - Microsoft Windows Server 2008 R2 SP1 is supported for CrowdStrike Falcon Host sensor version 6.51 or later.\n - Legacy OS versions must support SHA-2 code signing.\n- Google SecOps service account file and your customer ID from the [Google SecOps support team](/chronicle/docs/getting-support)\n\nDeploy CrowdStrike Falcon with Google SecOps feed integration\n-------------------------------------------------------------\n\nA typical deployment consists of CrowdStrike Falcon which sends the logs, and the Google SecOps feed which fetches the logs. Your deployment might differ slightly based on your setup.\n\nThe deployment typically includes the following components:\n\n- **CrowdStrike Falcon Intelligence**: The CrowdStrike product you collect logs from.\n- **CrowdStrike feed**. The CrowdStrike feed that fetches logs from CrowdStrike and writes them to Google SecOps.\n- **CrowdStrike Intel Bridge**: The CrowdStrike product that collects threat indicators from the data source and forwards them to Google SecOps.\n- **Google SecOps**: The platform that retains, normalizes and analyzes the CrowdStrike detection logs.\n- An ingestion label parser that normalizes raw log data into the UDM format. The information in this document applies to CrowdStrike Falcon parsers with the following ingestion labels:\n - `CS_EDR`\n - `CS_DETECTS`\n - `CS_IOC` The CrowdStrike Indicator of Compromise (IoC) parser supports the following indicator types:\n - `domain`\n - `email_address`\n - `file_name`\n - `file_path`\n - `hash_md5`\n - `hash_sha1`\n - `hash_sha256`\n - `ip_address`\n - `mutex_name`\n - `url`\n\nConfigure a Google SecOps feed for CrowdStrike EDR logs\n-------------------------------------------------------\n\nThe following procedures are needed to configure the feed.\n\n### How to configure CrowdStrike\n\nTo set up a Falcon Data Replicator feed, follow these steps:\n\n1. Sign in to the CrowdStrike Falcon Console.\n2. Go to **Support Apps** \\\u003e **Falcon Data Replicator**.\n3. Click **Add** to create a new Falcon Data Replicator feed and generate the following values:\n - **Feed**\n - **S3 identifier**,\n - **SQS URL**\n4. **Client secret**. Keep these values to set up a feed in Google SecOps.\n\nFor more information, see [How to set up Falcon Data replicator feed](https://falcon.us-2.crowdstrike.com/documentation/page/fa572b1c/falcon-data-replicator).\n\nSet up feeds\n------------\n\nThere are two different entry points to set up feeds in the\nGoogle SecOps platform:\n\n- **SIEM Settings \\\u003e Feeds \\\u003e Add New**\n- **Content Hub \\\u003e Content Packs \\\u003e Get Started**\n\nHow to set up the CrowdStrike Falcon feed\n-----------------------------------------\n\n1. Click the **CrowdStrike** pack.\n2. In the **CrowdStrike Falcon** log type, specify values for the following fields:\n\n - **Source**: Amazon SQS V2\n - **Queue Name**: Name of the SQS queue from which to read log data.\n - **S3 URI**: The S3 bucket source URI.\n - **Source deletion option**: Option to delete files and directories after transferring the data.\n - **Maximum File Age**: Include files modified within the last number of days. Default is 180 days.\n - **SQS Queue Access Key ID** : 20-character account access key ID. For example, `AKIAOSFOODNN7EXAMPLE`.\n - **SQS Queue Secret Access Key** : 40-character secret access key. For example, `wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY`.\n\n **Advanced options**\n - **Feed Name**: A prepopulated value that identifies the feed.\n - **Asset Namespace** : [Namespace associated with the feed](/chronicle/docs/investigation/asset-namespaces).\n - **Ingestion Labels** -- Labels applied to all events from this feed.\n3. Click **Create Feed**.\n\n| **Note:** The Content Hub is not available on the SIEM standalone platform. To upgrade, contact your Google SecOps representative.\n\nFor more information about configuring multiple feeds for different log types within this product family, see [Configure feeds by product](/chronicle/docs/ingestion/ingestion-entities/configure-multiple-feeds).\n\n#### Set up an ingestion feed with Amazon S3 bucket\n\nTo set up an ingestion feed using an S3 bucket, follow these steps:\n\n1. Go to **SIEM Settings \\\u003e Feeds**.\n2. Click **Add New Feed**.\n3. On the next page, click **Configure a single feed**.\n4. In the **Feed name** field, enter a name for the feed; for example, **Crowdstrike Falcon Logs**.\n5. In **Source type** , select **Amazon S3**.\n6. In **Log type** , select **CrowdStrike Falcon**.\n7. Based on the service account and the Amazon S3 bucket configuration that you created, specify values for the following fields:\n\nConfigure a Google SecOps feed for CrowdStrike logs\n---------------------------------------------------\n\nTo forward CrowdStrike detection monitoring logs, follow these steps:\n\n1. Sign in to CrowdStrike Falcon Console.\n2. Go to **Support Apps** \\\u003e **API Clients and Keys** .\n3. Create a new API client key pair at CrowdStrike Falcon. This key pair must have `READ` permissions for both `Detections` and `Alerts` from CrowdStrike Falcon.\n\nTo receive CrowdStrike detection monitoring logs, follow these steps:\n---------------------------------------------------------------------\n\n1. [Sign in](/chronicle/docs/log-in-to-ui) to your Google SecOps instance.\n2. Go to **SIEM Settings \\\u003e Feeds**.\n3. Click **Add New Feed**.\n4. On the next page, click **Configure a single feed**.\n5. In the **Feed name** field, enter a name for the feed; for example, **Crowdstrike Falcon Logs**.\n6. In **Source type** , select **Third Party API**.\n7. In **Log type** , select **CrowdStrike Detection Monitoring**.\n\nIf you encounter issues, contact the [Google SecOps support team](/chronicle/docs/getting-support).\n\nIngest CrowdStrike IoC logs into Google SecOps\n----------------------------------------------\n\nTo configure log ingestion from CrowdStrike into Google SecOps for IoC logs, complete the following steps:\n\n1. Create a new API client key pair at CrowdStrike Falcon Console. This key pair allows Google SecOps Intel Bridge to access and read events and supplementary information from CrowdStrike Falcon. For setup instructions, see [CrowdStrike to Google SecOps Intel Bridge](https://github.com/CrowdStrike/chronicle-intel-bridge).\n2. Provide `READ` permission to `Indicators (Falcon Intelligence)` when you create the key pair.\n3. Set up the Google SecOps Intel Bridge by following the steps in [CrowdStrike to Google SecOps Intel Bridge](https://github.com/CrowdStrike/chronicle-intel-bridge).\n4. Run the following Docker commands to send the logs from CrowdStrike to Google SecOps, where `sa.json` is the Google SecOps service account file:\n\n docker build . -t ccib:latest\n docker run -it --rm \\\n -e FALCON_CLIENT_ID=\"$FALCON_CLIENT_ID\" \\\n -e FALCON_CLIENT_SECRET=\"$FALCON_CLIENT_SECRET\" \\\n -e FALCON_CLOUD_REGION=\"$FALCON_CLOUD\" \\\n -e CHRONICLE_CUSTOMER_ID=\"$CHRONICLE_CUSTOMER_ID\" \\\n -e GOOGLE_APPLICATION_CREDENTIALS=/ccib/sa.json \\\n -v ~/my/path/to/service/account/filer/sa.json:/ccib/sa.json \\\n ccib:latest\n\n5. After the container runs successfully, IoC logs will begin streaming into Google SecOps.\n\nSupported CrowdStrike log formats\n---------------------------------\n\nThe CrowdStrike parser supports logs in JSON format.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
