CrowdStrike LogScale Plugin for Log Shipper

This document explains how to ingest Netskope Alerts, Events, and Web transaction logs in JSON format from your Netskope tenant to the CrowdStrike LogScale using Cloud Exchange with the CLS CrowdStrike LogScale plugin. The plugin transforms and ingests the alerts, events, and WebTX logs into the CrowdStrike LogScale HTTP Event Collector.

Prerequisites

To complete this configuration, you need:

LogScale Plugin Support

The Crowdstrike LogScale plugin is used to ingest Netskope Events, Netskope Alerts data and Web Transaction data in JSON format to the LogScale platform.

Data Type	Support
Event Support	Yes
Alert Support	Yes
WebTx Support	Yes (via Netskope LogStreaming)

All Netskope events, alert logs, and web transaction logs will be shared.

Permissions

For generating the Ingest Token, make sure your user account has the Change ingest tokens option. If not, contact your Organization Owner to generate and provide the Change ingest tokens access for your user.

API Details

List of APIs Used

API Endpoint	Method	Use Case
/api/v1/ingest/hec	POST	Ingest data to Crowdstrike LogScale

Ingest Data

API Endpoint: https://cloud.community.humio.com/api/v1/ingest/hec
Method: POST
Parameters:
N/A
Headers:
Authorization: Bearer <API Token>
Content-Type: application/json
Data:

{"event": {"_id": "224663acb2caf3ed8f833dd2", "justification_type": 23, "_insertion_epoch_timestamp": 1659017873, "access_method": "Client", "severity": "medium", "activity": "Upload", "activity_status": "Access Denied", "alert": "no", "app": "Alfresco", "app_session_id": 3606717343140728736, "appcategory": "Business Process Management", "browser": "Chrome", "browser_session_id": 2888757212810986401, "browser_version": "54.0.2840.90", "category": "Business Process Management", "cci": 56, "ccl": "low", "policy": "abc_ga_ti", "alert_name": "Malware found", "connection_id": 465830538214629538, "count": 1, "device": "Windows Device", "device_classification": "unmanaged", "dst_country": "US", "dst_geoip_src": 1, "dst_latitude": 47.682899, "dst_location": "Redmond", "dst_longitude": -122.120903, "dst_region": "Washington", "dst_timezone": "America/Los_Angeles", "dst_zipcode": "98052", "dstip": "13.107.6.151", "file_size": 105224532, "instance_id": "autoskope", "managed_app": "yes", "md5": "018c06f8ebef9e4c2ee6075db5825e24", "object": "TestResult_20170904-002256_demo.jpg", "object_type": "File", "organization_unit": "", "os": "Windows Server 2012", "os_version": "Windows Server 2012", "other_categories": ["Cloud Storage"], "page": " ", "page_site": "alfresco.com", "parent_id": "/personal/autotest3_autoskope_com/Documents", "referer": "https:// ", "site": "Alfresco.com", "slc_latitude": 13.0878400803, "slc_longitude": 80.2784729004, "src_country": "IN", "src_geoip_src": 2, "src_latitude": 12.8996, "src_location": "Chennai", "src_longitude": 80.2209, "src_region": "Tamil Nadu", "src_timezone": "N/A", "src_zipcode": "600001", "srcip": "52.172.6.204", "telemetry_app": "", "traffic_type": "CloudApp", "transaction_id": 1131464417688413744, "type": "nspolicy", "ur_normalized": "valeri.bradshaw@kkrlogistics.com", "url": "autoskope-my.sharepoint.com/personal/autotest3_autoskope_com/_api/web/GetFolderByServerRelativeUrl(@a1)/Files/Add(url=@a2,overwrite=@a3)", "user": "Valeri.Bradshaw@kkrlogistics.com", "userip": "10.0.0.5", "userkey": "v@kkrlogistics.com", "@timestamp": "2022-07-28T14:17:49Z"}}

Sample API Response:

 {
    "text": "Success",
    "code": 0,
    "eventCount": 2
}

Performance Matrix

This performance reading is for a Large Stack CE tested with these VM specifications. These readings are added considering that it will ingest 10K alerts and events in 15 seconds.

Description	Specification
Stack details	Size: Large RAM: 32 GB CPU: 16 Cores
Events, Alerts ingested to third-party SIEM	200K EPM

User Agent

netskope-ce-5.0.0-cls-crowdstrike-logscale/1.1.0

Workflow

Click play to watch a video.

Get your LogScale Configuration Parameters

Following configuration parameters are needed to configure the CrowdStrike LogScale plugin for Netskope Log Shipper.

• CrowdStrike LogScale Host: URL of your CrowdStrike LogScale Platform.
• Ingest Token: An Ingest Token is a unique string that identifies a repository and allows you to send data to that repository.

Generate an Ingest Token

1. Log in to your CrowdStrike LogScale instance.
2. Select your repository from the repositories and views page and click Settings.
3. Go to Ingest tokens and click Add token.
   
4. Add a Token name and select a JSON parser by selecting a JSON parser from the Assigned parser list.
   
5. Click Save.
6. Click on the eye icon on the Ingest Token page for the token you have created, you will see your Ingest token value. Copy it to use while configuring the plugin.

Configure the CrowdStrike LogScale Plugin

1. Go to Settings > Plugin Store. Search for and select the CrowdStrike LogScale v1.1.0 (CLS) plugin.
   

   

2. Add a Configuration Name and make sure the CrowdStrike LogScale Default Mapping is selected.

   Disable the toggle button that is used to transform the raw logs, as the plugin only supports sharing of JSON formatted data.

   

3. Click Next and enter these parameters:
   • CrowdStrike LogScale Host
   • Ingest Token

   

4. Click Save. Your new plugin configuration can be seen at Log Shipper > Plugin.

Configure a Log Shipper Business Rule for LogScale

1. Go to Log Shipper > Business Rules, and by default, there’s a business rule that filters all alerts and events.
   

   

2. If you want to filter out any specific type of alert or event, click Create New Rule and configure a new business rule by adding the rule name and filter. When finished, click Save.
   

   

Configure Log Shipper Log Delivery for LogScale

1. Go to Log Shipper > Log Delivery and click Add Log Delivery Configuration.
2. For alerts and events, select the Source plugin (Netskope CLS), and Destination plugin (CrowdStrike LogScale), select a business rule, and click Save.
3. For WebTx, select the Source plugin (AWS Netskope LogStreaming or Azure Netskope LogStreaming), Destination plugin (CrowdStrike LogScale), and click Save.
4. After the Log Delivery configuration is added, the data will start to be pulled from the Netskope tenant and ingested into the Crowdstrike LogScale platform.

Validate the LogScale Plugin

Validate the Pull

In Cloud Exchange, go to Logging search for the pulled logs with the filter message contains pulled.

Validate the Push

Validate in Cloud Exchange

1. Go to Logging.
2. Search for ingested alerts with the filter message contains ingested.
3. The ingested logs will be filtered.

Validate in CrowdStrike LogScale

1. Go to the Search tab.
2.  Apply filters to see specific data.
   

   

Troubleshooting

Ingested data is not visible on the LogScale Platform.

The LogScale cloud community has a data retention of 7 days. Any data older than the data retention period will not be available on the CrowdStrike LogScale platform.
What to do: Check the data retention time on your platform from Settings > Data retention.
Update the data retention time. If you do not have access to update the data retention time, contact your CrowdStrike LogScale administration team.