Data

Tools

Indexes

Applications

Experiments

Open Source Science

https://github.com/crowdstrike/fdr

Falcon Data Replicator

https://github.com/crowdstrike/fdr

Science Score: 26.0%

This score indicates how likely this project is to be science-related based on various indicators:

  • ○
    CITATION.cff file
  • ✓
    codemeta.json file
    Found codemeta.json file
  • ✓
    .zenodo.json file
    Found .zenodo.json file
  • ○
    DOI references
  • ○
    Academic publication links
  • ○
    Committers with academic emails
  • ○
    Institutional organization owner
  • ○
    JOSS paper metadata
  • ○
    Scientific vocabulary similarity
    Low similarity (8.4%) to scientific vocabulary

Keywords from Contributors

sequences crowdstrike-apis devsecops crowdstrike falcon falconpy oauth2 projection python37 python38
Last synced: 10 months ago · JSON representation

Repository

Falcon Data Replicator

Basic Info
  • Host: GitHub
  • Owner: CrowdStrike
  • License: unlicense
  • Language: Python
  • Default Branch: main
  • Homepage:
  • Size: 214 KB
Statistics
  • Stars: 32
  • Watchers: 8
  • Forks: 21
  • Open Issues: 4
  • Releases: 0
Created over 5 years ago · Last pushed over 1 year ago
Metadata Files
Readme License Code of conduct Codeowners Security

README.md

CrowdStrike Falcon
Twitter URL

Falcon Data Replicator

Bandit Flake8 Python Lint CodeQL

The Falcon Data Replicator replicates log data from your CrowdStrike environment to a stand-alone target. This target can be a location on the file system, or a cloud storage bucket.

Currently AWS is the only cloud provider implemented.

Requirements

  • Python 3.6+
  • boto3
  • CrowdStrike Falcon FDR credentials
  • CrowdStrike Falcon FDR SQS queue URL ## Stand-alone solution
  • falcondatareplicator.ini - Configuration file
  • standalone/falcondatareplicator.py - Stand-alone solution application file ### Configuration The falcon_data_replicator.ini file contains all of the parameters necessary to configure the solution for replication to the local file system and / or a storage bucket in AWS S3. After retrieving the AWS credentials and SQS queue details from your Falcon console, edit this file to reflect your environment. #### Required parameters The following parameters must be provided in order for the solution to operate.
  • AWS_KEY - AWS client ID provided to you by the CrowdStrike Falcon console
  • AWS_SECRET - AWS client secret provided to you by the CrowdStrike Falcon console
  • QUEUE_URL - AWS SQS queue URL provided to you by the CrowdStrike Falcon console
  • OUTPUT_PATH - File path where downloaded files will be stored, not used for in-memory transfers
  • VISIBILITY_TIMEOUT - Time in seconds before a message is returned back to the SQS queue
  • REGION_NAME - The name of the AWS region where your CrowdStrike SQS queue resides
  • MESSAGE_DELAY - The time in seconds to wait in between the processing of each message
  • QUEUE_DELAY - The time in seconds to wait before each check of the queue for more messages
  • LOG_FILE - The name and path of the the log file #### Destination parameters The following parameters configure our destination details. If not these parameters are not present, upload to our bucket is skipped and the local files are retained after download.
  • TARGET_BUCKET - The name of the AWS bucket we will use for our target destination
  • TARGET_REGION - The name of the AWS region our target bucket resides within
  • REMOVE_LOCAL_FILE - Boolean representing whether or not to remove local files after they are uploaded
  • IN_MEMORY_TRANSFER_ONLY - Transfer the file from the source bucket to the destination bucket without storing the file on the local file system.
  • DO_OCSF_CONVERSION - Boolean representing whether or not to convert the events to the OCSF format
  • TARGET_ACCOUNT_ID - The AWS account ID of the target bucket
  • OCSF_ROLE_NAME - The name of the role to use when writing to the target bucket
  • OCSF_ROLE_EXTERNAL_ID - The external ID to use when assuming the role provided by OCSFROLENAME. Default: CrowdStrikeCustomSource
  • OCSF_INGEST_LATENCY - The maximum amount of time (in minutes) to buffer records before publishing. Min: 5 Max: 60 Default: 5
  • OCSF_MAX_FILE_SIZE - Maximum size of a file in MB before it is uploaded. Min: 1 Max: 200 Default: 200 Note: Security Lake performance is sensitive to the number of files that must be read for a query. Use OCSF_MAX_FILE_SIZE and OCSF_INGEST_LATENCY to tune performance for your use case. ### Running the solution After updating the configuration file to reflect your environment specifics, you can run this solution using: bash python3 falcon_data_replicator.py If your configuration file is not present in the same directory as the application file, you can reference this path using the -f or --configfile_ command line parameters. bash python3 falcon_data_replicator.py -f some_path/falcon_data_replicator.ini ## Container-based Coming soon

Owner

  • Name: CrowdStrike
  • Login: CrowdStrike
  • Kind: organization
  • Email: github@crowdstrike.com
  • Location: United States of America

GitHub Events

Total
  • Issues event: 2
  • Watch event: 3
  • Delete event: 4
  • Issue comment event: 1
  • Push event: 6
  • Pull request review event: 2
  • Pull request event: 11
  • Fork event: 3
  • Create event: 4
Last Year
  • Issues event: 2
  • Watch event: 3
  • Delete event: 4
  • Issue comment event: 1
  • Push event: 6
  • Pull request review event: 2
  • Pull request event: 11
  • Fork event: 3
  • Create event: 4

Committers

Last synced: about 1 year ago

All Time
  • Total Commits: 226
  • Total Committers: 9
  • Avg Commits per committer: 25.111
  • Development Distribution Score (DDS): 0.394
Past Year
  • Commits: 6
  • Committers: 4
  • Avg Commits per committer: 1.5
  • Development Distribution Score (DDS): 0.667
Top Committers
Name Email Commits
dependabot[bot] 4****] 137
Joshua Hiller j****r@c****m 59
ffalor 3****r 22
snyk-bot s****t@s****o 2
sbmpacific s****h@y****m 2
Martin Westergaard Jørgensen M****J 1
Gabe Alford r****s@g****m 1
Suresh Muthu s****u@c****m 1
Christopher Schmitt c****t@c****m 1
Committer Domains (Top 20 + Academic)
crowdstrike.com: 3 snyk.io: 1

Issues and Pull Requests

Last synced: 11 months ago

All Time
  • Total issues: 6
  • Total pull requests: 134
  • Average time to close issues: about 2 months
  • Average time to close pull requests: 4 days
  • Total issue authors: 4
  • Total pull request authors: 9
  • Average comments per issue: 0.5
  • Average comments per pull request: 0.54
  • Merged pull requests: 76
  • Bot issues: 0
  • Bot pull requests: 111
Past Year
  • Issues: 1
  • Pull requests: 6
  • Average time to close issues: 3 months
  • Average time to close pull requests: about 1 hour
  • Issue authors: 1
  • Pull request authors: 4
  • Average comments per issue: 2.0
  • Average comments per pull request: 0.0
  • Merged pull requests: 6
  • Bot issues: 0
  • Bot pull requests: 2
View more stats
Top Authors
Issue Authors
  • ffalor (2)
  • tirthrajchaudhari (1)
  • Res260 (1)
  • hazcod (1)
  • saranVishva (1)
Pull Request Authors
  • dependabot[bot] (77)
  • ffalor (13)
  • jshcodes (4)
  • sbmpacific (2)
  • eric-query (1)
  • redhatrises (1)
  • snyk-bot (1)
  • tankbusta (1)
  • MWEJ (1)
Top Labels
Issue Labels
enhancement (1)
Pull Request Labels
dependencies (77) github_actions (4) bug (2) enhancement (1)

Packages

  • Total packages: 2
  • Total downloads:
    • pypi 106 last-month
  • Total dependent packages: 0
    (may contain duplicates)
  • Total dependent repositories: 0
    (may contain duplicates)
  • Total versions: 2
  • Total maintainers: 1
pypi.org: fdr

CrowdStrike Falcon Data Replicator

  • Versions: 1
  • Dependent Packages: 0
  • Dependent Repositories: 0
  • Downloads: 92 Last month
Rankings
Dependent packages count: 9.9%
Average: 37.5%
Dependent repos count: 65.2%
Maintainers (1)
jshcodes
Last synced: 11 months ago
pypi.org: falcon-data-replicator

CrowdStrike Falcon Data Replicator

  • Versions: 1
  • Dependent Packages: 0
  • Dependent Repositories: 0
  • Downloads: 14 Last month
Rankings
Dependent packages count: 9.9%
Average: 37.5%
Dependent repos count: 65.2%
Maintainers (1)
jshcodes
Last synced: 11 months ago

Dependencies

requirements.txt pypi
  • boto3 ==1.24.61
  • botocore ==1.27.61
  • jmespath ==1.0.1
  • python-dateutil ==2.8.2
  • s3transfer ==0.6.0
  • six ==1.16.0
  • urllib3 ==1.26.12
.github/workflows/bandit.yml actions
  • actions/checkout v3 composite
  • actions/setup-python v4 composite
.github/workflows/codeql-analysis.yml actions
  • actions/checkout v2 composite
  • github/codeql-action/analyze v1 composite
  • github/codeql-action/autobuild v1 composite
  • github/codeql-action/init v1 composite
.github/workflows/linting.yml actions
  • actions/checkout v3 composite
  • actions/setup-python v4 composite
.github/workflows/pylint.yml actions
  • actions/checkout v3 composite
  • actions/setup-python v4 composite
.github/workflows/spelling.yml actions
  • SFLScientific/spellcheck-github-actions master composite
  • actions/checkout v3 composite
Dockerfile docker
  • docker.io/python 3-slim-buster build