Configuring CrowdStrike Falcon Host to Communicate with JSA

To send LEEF events from CrowdStrike Falcon Host to JSA, you must install and configure Falcon SIEM connector.

You must have access with administrator privileges to the Falcon Streaming API. To enable access, contact Crowdstrike support (support@crowdstrike.com).

1. Obtain an API key and UUID to configure SIEM Connector.

   1. Log in to the Falcon user interface.

   2. Select People App, and then click the Customer tab.

      The People App option is only visible to admin users.

   3. Click Generate new API key.

   4. Make a copy of the API key and the UUID.

2. Install the Falcon SIEM Connector. Note

   The Falcon SIEM Connector needs to be deployed on premise on a system running either CentOS or RHEL 6.x-7.x. Internet connectivity to the CrowdStrike Cloud is also required.

   Note

   You must have Admin (root) privileges.

   • Use the provided RPM to install the Falcon SIEM Connector.

     rpm -Uhv /path/to/file/cs.falconhoseclient-<build_version>.<OS_version>.rpm

   The Falcon SIEM Connector installs in the /opt/crowdstrike/ directory by default.

   A service is created in the /etc/init.d/cs.falconhoseclientd/ directory.

3. Configure the SIEM Connector to forward LEEF events to JSA.

   The configuration files are located in the /opt/crowdstrike/etc/ directory.

   • Rename cs.falconhoseclient.leef.cfg to cs.falconhoseclient.cfg for LEEF configuration settings. The SIEM Connector uses cs.falconhoseclient.cfg configuration by default.

   The following table describes some of the key parameter values for forwarding LEEF events to JSA.

   Table 1: Key Parameter Values

   Key	Description	Value
   version	The version of authentication to be used. In this case, it is the API Key Authentication version.	2
   api_url	The SIEM connector connects to this endpoint URL.	https://firehose.crowdstrike.com/ sensors/entities/datafeed/v1
   app_id	An arbitrary string identifier for connecting to Falcon Streaming API.	Any string. For example, FHAPI-LEEF
   api_key	The API key is used as the credential for client verification.	Obtained at step 1
   api_uuid	The UUID is used as the credential for client verification.	Obtained at step 1
   send_to_syslog_server	To enable or disable syslog push to syslog server, set the flag to true or false.	true
   host	The IP or host name of the SIEM.	The JSA SIEM IP or host name where the Connector is forwarding the LEEF events.
   header_delim	Header prefix and fields are delimited by this value.	The value must be a pipe (|).
   field_delim	The delimiter value that is used to separate key-value pairs.	The value must be a tab (\t).
   time_fields	This datetime field value is converted to specified time format.	The default field is devTime (device time). If a custom LEEF key is used for setting device time, use a different field name .

4. Start the SIEM Connector service by typing the following command:

   service cs.falconhoseclientd start

   1. If you want to stop the service, type the following command:

      service cs.falconhoseclientd stop

   2. If you want to restart the service, type the following command:

      service cs.falconhoseclientd restart

Verify that Falcon SIEM Connector is configured to send events to JSA.