Search details of some Detection

[brucelourenco]

Hello all. I hope everyone is well.
Using get_detect_summaries method from Detects class I receive the detail of the detection.
However, I couldn't find some details like :

• Network Operations
• Disk Operations
• DNS Requests
• Registry Operations
• Process Operations

For example:

The outcome of the query shows me several parameters but not these listed above.

I'm searching for this information using the wrong class and method?

Thanks for help

[jshcodes]

Hi @brucelourenco!

Detection details displayed within the UI are compiled using data from the detection as well as from ThreatGraph. Not all of this information is available via the API.

[brucelourenco]

It is a pity =(
If getting this information by API was possible will be a great feature.
Thanks for the quick answear @jshcodes !

[brucelourenco]

Hello @jshcodes!
Do you know if there is some improvement about catch these operations in detection details?
I'm working on producing a report for a customer, but they have Falcon Pro license that has some limitations in show information. Getting this information directly in the Falcon Console is a hard mission lol.
Anyway, thank you for any updates about this topic.

[crowdstrikedcs]

Hey @brucelourenco there may be an opportunity here to use the Event Streams Service Collection

This streaming based API is typically used to feed SIEM tooling and contains events containing detection details as well as several audit based event types. It uses a long lived streaming HTTP connection, a bit different from many restful actions in FalconPy.

Take a look in our docs (especially the Detection Summary Event) here. Most of the information you've listed when available can be found there especially in regards to file/network operations.

Let us know if you need any more detail on connecting or using this.

[brucelourenco]

Hi @crowdstrikedcs
Many thanks for sharing this information and material!
I'm taking a look on this right now, and as soon as I could test it I'll share my experience.
Thank you

[brucelourenco]

Hello @crowdstrikedcs how have you been?
Follow these docos shared I'm getting 404 error using refresh_active_stream as follows:

What I'm doing wrong?
Thank you

[crowdstrikedcs]

Hey @brucelourenco, doing well man. Walk me through a bit of your code to discover streams if you could. Below I've pasted a sample of how I connect and process and event stream using the uber class in QRadar.

1. Discover Streams: This will return an object containing the streaming URL to connect to.
2. Connect to the discovered stream with stream=True
3. Iterate through the response lines.
4. Refresh the stream periodically.

params = {'appId': "test"}
result = api_request.command("listAvailableStreamsOAuth2", parameters=params)

# check we have a stream and store it, the object contains the stream_token and stream_url for each partition
if len(result['body']['resources']) > 0:
	client_streams[client_index] = result['body']['resources']

# I then iterate through client_streams and call get_stream_data for each stream.

...

def get_stream_data(self, stream_url, stream_token, offset, events):
		try:
			headers={'Authorization': 'Token %s' % stream_token, 'Connection': 'Keep-Alive'}
			parameters = {'offset': offset, 'eventType': events}
			log('Getting stream data for: ' + stream_url)
			response = requests.get(stream_url, headers=headers, params=parameters, proxies=self.proxy, stream=True)
			
			if response.status_code == 200:
				log('Stream data recieved successfully for: ' + stream_url)
			else:
				log('Failed to get the stream data for: ' + stream_url)
				log('Status code: {0}'.format(response.status_code))
				log('Content: {0}'.format(response.content))
				response = ''
		except Exception as e:
			raise Exception('Exception while fetching the detection stream:' + str(e))
		return response

# next we iterate through the response

 for line in response.iter_lines():
                    if line:
                        decoded_line = line.decode('utf-8')
                        eventdata = json.loads(decoded_line)

Inside the for loop we additionally need to refresh the stream periodically. The stream will end if not refreshed after 30 mins, and I typically refresh it after 28 mins.

result = api_request.command("refreshActiveStreamSession", partition=part, action_name = "refresh_active_stream_session", appId = "test")

The event stream can be rather noisy. You'll see I also pass a query parameter when opening the stream eventType you could set this to DetectionSummaryEvent to get only detection events.

[brucelourenco]

Thank you @crowdstrikedcs
I'll take a look and share a feedback as soon as I can.
Many thanks