CrowdStrike Plugin for Threat Exchange

This document explains how to configure the CrowdStrike v2.3.0 plugin with the Threat Exchange module of the Netskope Cloud Exchange platform. This plugin fetches Threat IoCs of type Hash (MD5 and SHA256), Domains, IPv4, IPv6 from CrowdStrike’s Endpoint detections and the IoC management page.

This plugin supports sharing the Threat IoCs to CrowdStrike’s IoC management page and can perform Isolate/Remediate actions for hosts. Only file hash IoCs activate prevention; Domain, IPv4, IPv6 don’t trigger prevention in CrowdStrike. Sharing URL information from Netskope Cloud Exchange to CrowdStrike is not recommended, as CrowdStrike currently only supports ingesting SHA256, MD5, Domain, IPv4, and IPv6.

To access the plugin, you need the API credentials. This plugin supports the pull and push retraction of IoCs from Crowdstrike.

Prerequisites

To complete this configuration, you need:

• A Netskope tenant (or multiple, for example, production and development/test instances).
• A File Profile on your Netskope tenant.
• A URL List on your Netskope tenant
• A Netskope Cloud Exchange tenant with the Tenant plugin and Threat Exchange plugin already configured.
• A CrowdStrike instance.
• Connectivity to any one of the following hosts:
  • Commercial cloud (api.crowdstrike.com)
  • US 2 (api.us-2.crowdstrike.com)
  • Falcon on GovCloud (api.laggar.gcw.crowdstrike.com)
  • EU cloud (api.eu-1.crowdstrike.com)
• If you have the IP allowlist configured on CrowdStrike, make sure to add the public IP of the machine where cloud exchange is running. For more information, refer to the documentation.

CrowdStrike Plugin Support

This plugin fetches Threat IoCs of type Hash (MD5 and SHA256), Domains, IPv4, IPv6 from CrowdStrike’s Endpoint detections and IoC management page. This plugin supports sharing the Threat IoCs to CrowdStrike’s IoC management page and can perform Isolate/Remediate actions for hosts. Only file hash IoCs activate prevention; Domain, IPv4, IPv6 don’t trigger prevention in CrowdStrike. Sharing URL information from Cloud Exchange to CrowdStrike is not recommended, as CrowdStrike currently only supports ingesting SHA256, MD5, Domain, IPv4, and IPv6. To access the plugin, you need the API credentials. This plugin supports pull and push retraction of IoCs from Crowdstrike.

IoC Retraction

IoC Retraction (Pull): Indicators will be fetched from CrowdStrike, and in the subsequent pull cycles, if some indicators are deleted on CrowdStrike, then they will be marked as Retracted in Cloud Exchange.

IoC Retraction (Push): Retracted indicators present on Cloud Exchange will be deleted from CrowdStrike during sharing.

Permissions

Mappings

Here are the fields that are pulled and pushed from CrowdStrike and mapped in Cloud Exchange.

Endpoint Detection Page Mappings

Severity Mappings for Endpoint Detection

IoC Management Page Mappings

Severity Mappings for IoC Management

Mappings for Pushed IoCs

Note that Severity will only be mapped for CrowdStrike supported actions only. So, the severity will not be mapped for actions like Block, Hide Detection, and Allow.

{
    "access_token": "",
    "expires_in": 1799,
    "token_type": "bearer"
}

{
    "meta": {
        "query_time": 0.138995532,
        "pagination": {
            "total": 142,
            "limit": 100,
            "after": "eyJ2ZXJzaW9uIjoidjEiLCJ0b3RhbF9oaXRzIjoxNDIsInRvdGFsX3JlbGF0aW9uIjoiZXEiLCJjbHVzdGVyX2lkIjoiZjNjMiIsImFmdGVyIjpbMTc0ODUyNjI2NTk0MywxNzQ4NTI5ODY3NTc1LCJjMTdmM2E4MGRlZDA0MThlYjEwN2RiM2QyNmEyNzk4MzppbmQ6MDNkY2FjNGI4NzJmNGQyNjg0NjQzZDIyOTJjMzhiMDE6MjU4Mjk0MDkwODQzNC01NzM0LTEzOTI0MzY4Il0sInRvdGFsX2ZldGNoZWQiOjEwMH0="
        },
        "powered_by": "detectsapi",
        "trace_id": "1aa55d82-077e-4725-b390-25429b6a0f4c"
    },
    "errors": [],
    "resources": [
        {
            "agent_id": "7c566a5cc4ee4248a83d0405d7273a49",
            "aggregate_id": "aggind:7c566a5cc4ee4248a83d0405d7273a49:137439072286",
            "alleged_filetype": "exe",
            "associated_files": [],
            "child_process_ids": [
                "pid:7c566a5cc4ee4248a83d0405d7273a49:297786408684"
            ],
            "cid": "c17f3a80ded0418eb107db3d26a27983",
            "cloud_indicator": "true",
            "cmdline": "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{856B848F-38B5-4946-921B-FB2F7713213E}\\MicrosoftEdge_X64_137.0.3296.68.exe\" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable",
            "composite_id": "c17f3a80ded0418eb107db3d26a27983:ind:7c566a5cc4ee4248a83d0405d7273a49:297785683156-5311-1935186763644973143",
            "confidence": 100,
            "context_timestamp": "2025-06-18T04:57:29Z",
            "control_graph_id": "ctg:7c566a5cc4ee4248a83d0405d7273a49:137439072286",
            "crawled_timestamp": "2025-06-18T05:57:51.199159695Z",
            "created_timestamp": "2025-06-18T04:58:51.562849229Z",
            "data_domains": [
                "Endpoint"
            ],
            "description": "A SHA256 hash matched a Custom Intelligence Indicator (Custom IOC) with low severity.",
            "device": {
                "agent_load_flags": "0",
                "agent_local_time": "2025-06-17T22:47:44.249Z",
                "agent_version": "7.24.19607.0",
                "bios_manufacturer": "VMware, Inc.",
                "bios_version": "VMW201.00V.24006586.B64.2406042154",
                "cid": "c17f3a80ded0418eb107db3d26a27983",
                "config_id_base": "65994767",
                "config_id_build": "19607",
                "config_id_platform": "3",
                "device_id": "7c566a5cc4ee4248a83d0405d7273a49",
                "external_ip": "61.219.78.165",
                "first_seen": "2025-02-17T17:21:36Z",
                "groups": [
                    "1012add21d3e4e08b146dbfdb37c5ca0"
                ],
                "hostinfo": {
                    "domain": ""
                },
                "hostname": "DESKTOP-LQDIGUR",
                "last_seen": "2025-06-18T05:48:27Z",
                "local_ip": "10.66.2.89",
                "mac_address": "00-0c-29-ee-47-37",
                "machine_domain": "",
                "major_version": "10",
                "minor_version": "0",
                "modified_timestamp": "2025-06-18T05:52:52Z",
                "os_version": "Windows 10",
                "ou": null,
                "platform_id": "0",
                "platform_name": "Windows",
                "product_type": "1",
                "product_type_desc": "Workstation",
                "status": "contained",
                "system_manufacturer": "VMware, Inc.",
                "system_product_name": "VMware20,1"
            },
            "display_name": "CustomIOCHashLow",
            "email_sent": true,
            "external": true,
            "falcon_host_link": "https://falcon.crowdstrike.com/activity-v2/detections/c17f3a80ded0418eb107db3d26a27983:ind:7c566a5cc4ee4248a83d0405d7273a49:297785683156-5311-1935186763644973143?_cid=g03000nb3ghi5x4fappp2bjsndr5ej4q",
            "filename": "MicrosoftEdge_X64_137.0.3296.68.exe",
            "filepath": "\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{856B848F-38B5-4946-921B-FB2F7713213E}\\MicrosoftEdge_X64_137.0.3296.68.exe",
            "files_written": [
                {
                    "filename": "setup.exe",
                    "filepath": "\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\{856B848F-38B5-4946-921B-FB2F7713213E}\\EDGEMITMP_60DE1.tmp",
                    "timestamp": "1749829318"
                }
            ],
            "global_prevalence": "common",
            "grandparent_details": {
                "cmdline": "C:\\Windows\\system32\\services.exe",
                "filename": "services.exe",
                "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\services.exe",
                "local_process_id": "904",
                "process_graph_id": "pid:7c566a5cc4ee4248a83d0405d7273a49:296364257770",
                "process_id": "296364257770",
                "sha256": "4a912dc98c977788131aad0ae468d86792211ed225f80b2c344a3690b4437428",
                "timestamp": "2025-06-13T04:55:18.990Z",
                "user_graph_id": "uid:7c566a5cc4ee4248a83d0405d7273a49:S-1-5-18",
                "user_id": "S-1-5-18",
                "user_name": "DESKTOP-LQDIGUR$"
            },
            "id": "ind:7c566a5cc4ee4248a83d0405d7273a49:297785683156-5311-1935186763644973143",
            "indicator_id": "ind:7c566a5cc4ee4248a83d0405d7273a49:297785683156-5311-1935186763644973143",
            "ioc_context": [
                {
                    "ioc_source": "primary_module",
                    "ioc_type": "sha256",
                    "ioc_value": "5219f66e6cab3aa843f6e89ee3d47d32,d757eb8b567d76eb19f7009adbb9d013c7cf1861f45b18a023d6866e8baa2a2d",
                    "type": "ioc"
                }
            ],
            "ioc_source": "primary_module",
            "ioc_type": "sha256",
            "ioc_value": "5219f66e6cab3aa843f6e89ee3d47d32,d757eb8b567d76eb19f7009adbb9d013c7cf1861f45b18a023d6866e8baa2a2d",
            "local_prevalence": "unique",
            "local_process_id": "1868",
            "logon_domain": "WORKGROUP",
            "md5": "5219f66e6cab3aa843f6e89ee3d47d32",
            "name": "CloudDetect-CustomerIOC-SHA256-Low",
            "objective": "Falcon Detection Method",
            "parent_details": {
                "cmdline": "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /svc",
                "filename": "MicrosoftEdgeUpdate.exe",
                "filepath": "\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe",
                "local_process_id": "4336",
                "md5": "c019e421d9f897108e51666cbae2c8b0",
                "process_graph_id": "pid:7c566a5cc4ee4248a83d0405d7273a49:297758877134",
                "process_id": "297758877134",
                "sha256": "3096d8e82917a9b73f322f4b1743e52e9b0c8b3c5933a957e73e29d6973cdd5b",
                "timestamp": "2025-06-16T10:26:29Z",
                "user_graph_id": "uid:7c566a5cc4ee4248a83d0405d7273a49:S-1-5-18",
                "user_id": "S-1-5-18",
                "user_name": "DESKTOP-LQDIGUR$"
            },
            "parent_process_id": "297758877134",
            "pattern_disposition": 0,
            "pattern_disposition_description": "Detection, standard detection.",
            "pattern_disposition_details": {
                "blocking_unsupported_or_disabled": false,
                "bootup_safeguard_enabled": false,
                "containment_file_system": false,
                "critical_process_disabled": false,
                "detect": false,
                "fs_operation_blocked": false,
                "handle_operation_downgraded": false,
                "inddet_mask": false,
                "indicator": false,
                "kill_action_failed": false,
                "kill_parent": false,
                "kill_process": false,
                "kill_subprocess": false,
                "mfa_required": false,
                "operation_blocked": false,
                "policy_disabled": false,
                "prevention_provisioning_enabled": false,
                "process_blocked": false,
                "quarantine_file": false,
                "quarantine_machine": false,
                "registry_operation_blocked": false,
                "response_action_already_applied": false,
                "response_action_failed": false,
                "response_action_triggered": false,
                "rooting": false,
                "sensor_only": false,
                "suspend_parent": false,
                "suspend_process": false
            },
            "pattern_id": 5311,
            "platform": "Windows",
            "poly_id": "AADBfzqA3tBBjrEH2z0monmDgEHElB4TLZI4zzCC9NmU_gAATiEItOfbNan5F65GbEhxGr5sIpuo7GVQmBmbrXDpFsSf8Q==",
            "priority_explanation": [
                "[MOD] The parent process was identified as: MicrosoftEdgeUpdate.exe"
            ],
            "priority_value": 87,
            "process_id": "297785683156",
            "process_start_time": "1749829315",
            "product": "epp",
            "scenario": "intel_detection",
            "seconds_to_resolved": 0,
            "seconds_to_triaged": 0,
            "severity": 30,
            "severity_name": "Low",
            "sha1": "0000000000000000000000000000000000000000",
            "sha256": "d757eb8b567d76eb19f7009adbb9d013c7cf1861f45b18a023d6866e8baa2a2d",
            "show_in_ui": true,
            "source_products": [
                "Falcon Insight"
            ],
            "source_vendors": [
                "CrowdStrike"
            ],
            "status": "new",
            "tactic": "Custom Intelligence",
            "tactic_id": "CSTA0005",
            "technique": "Indicator of Compromise",
            "technique_id": "CST0005",
            "timestamp": "2025-06-18T04:57:29.681Z",
            "tree_id": "137439072286",
            "tree_root": "297785683156",
            "triggering_process_graph_id": "pid:7c566a5cc4ee4248a83d0405d7273a49:297785683156",
            "type": "ldt",
            "updated_timestamp": "2025-06-18T05:57:51.199148989Z",
            "user_id": "S-1-5-18",
            "user_name": "DESKTOP-LQDIGUR$"
        }
    ]
}

{
  "meta": {
    "query_time": 0.035081512,
    "pagination": {
      "limit": 1,
      "total": 640,
      "offset": 1,
      "after": "WzE2ODkyNjE2NjI2MjcsIjM4MDI2Yzk5MzQ1ZGI5NDE4NGMwYTY3MTIwOGUwZGQwNWY4NmNjNzlhMmI2NTRjNTVjNzg0NTQ5YzZiYmMxNzAiXQ=="
    },
    "powered_by": "ioc-manager",
    "trace_id": "0dddfbcf-e93f-4ae0-b143-6c79912224cb"
  },
  "errors": null,
  "resources": [
    {
      "id": "38026c99345db94184c0a671208e0dd05f86cc79a2b654c55c784549c6bbc170",
      "type": "md5",
      "value": "00000d9007e7a6b0842e802957137079",
      "source": "Netskope_CSPlugin_v3",
      "action": "detect",
      "severity": "high",
      "metadata": {
        "filename": "unused"
      },
      "platforms": [
        "windows"
      ],
      "expired": false,
      "deleted": false,
      "applied_globally": true,
      "from_parent": false,
      "created_on": "2023-07-13T15:21:02.627637187Z",
      "created_by": "cc5fc723039543d29a796a349d2f1525",
      "modified_on": "2023-07-13T15:21:02.627637187Z",
      "modified_by": "cc5fc723039543d29a796a349d2f1525"
    }
  ]
}

{
    "meta": {
        "query_time": 0.022017219,
        "pagination": {
            "limit": 100,
            "total": 1,
            "offset": 1,
            "after": "WzE3MTI1NjE2NTU2MzIsImY4NjU1ZDM2OTJiNDllNjVhNWEzMmRmYTM4N2QzZTI3NTk3NTRhOGI0Y2ZjNDI0YzhmODBmZDY1NzZjMGJjOGEiXQ=="
        },
        "powered_by": "ioc-manager",
        "trace_id": "8ab48640-e2ef-4cf0-b631-d33f897defb1"
    },
    "errors": null,
    "resources": [
        {
            "id": "f8655d3692b49e65a5a32dfa387d3e2759754a8b4cfc424c8f80fd6576c0bc8a",
            "type": "md5",
            "value": "4309e189b0e68c2c0f554dd4202d00bd",
            "source": "Netskope_CSPlugin_v3",
            "action": "detect",
            "severity": "high",
            "metadata": {
                "filename": "testpdv_5e67ccdec797303d7973900c3c1ed399_4309e189b0e68c2c0f554dd4202d00bd_1712561301_sha256-blacklist-sample.txt"
            },
            "platforms": [
                "windows"
            ],
            "expired": false,
            "deleted": false,
            "applied_globally": true,
            "from_parent": false,
            "created_on": "2024-04-04T15:42:22.809754471Z",
            "created_by": "cc5fc723039543d29a796a349d2f1525",
            "modified_on": "2024-04-08T07:34:15.632004689Z",
            "modified_by": "cc5fc723039543d29a796a349d2f1525"
        }
    ]
}

{
    "meta": {
        "query_time": 0.253615007,
        "pagination": {
            "limit": 0,
            "total": 1
        },
        "powered_by": "ioc-manager",
        "trace_id": "8dd3a607-8bec-46f5-a79c-9692d6d92818"
    },
    "errors": null,
    "resources": [
        {
            "id": "f8655d3692b49e65a5a32dfa387d3e2759754a8b4cfc424c8f80fd6576c0bc8a",
            "type": "md5",
            "value": "4309e189b0e68c2c0f554dd4202d00bd",
            "source": "Netskope_CSPlugin_v3",
            "action": "no_action",
            "severity": "critical",
            "description": "This is a test indicator.",
            "metadata": {
                "filename": "testpdv_5e67ccdec797303d7973900c3c1ed399_4309e189b0e68c2c0f554dd4202d00bd_1712565995_sha256-blacklist-sample.txt"
            },
            "platforms": [
                "windows"
            ],
            "tags": [
                "netskope-ce"
            ],
            "expired": false,
            "deleted": false,
            "applied_globally": true,
            "from_parent": false,
            "created_on": "2024-04-04T15:42:22.809754471Z",
            "created_by": "cc5fc723039543d29a796a349d2f1525",
            "modified_on": "2024-04-08T08:52:28.142410877Z",
            "modified_by": "61794791c7554fecab6a975090f98f6d"
        }
    ]
}

{
    "meta": {
        "query_time": 6.8e-8,
        "pagination": {
            "offset": "",
            "limit": 100
        },
        "trace_id": "2039578c-1e94-4e56-a2c7-58bea1c12857",
        "entity": "/devices/entities/devices/v1{?ids*}"
    },
    "resources": [
        "9d4f598cec024ac2bf3c5e2afdc69129",
        "331c40581b7a4d4a81863bf630edc868"
    ],
    "errors": []
}

{
  "meta": {
    "query_time": 0.228808146,
    "pagination": {
      "limit": 0,
      "total": 1
    },
    "powered_by": "ioc-manager",
    "trace_id": "be320583-bf85-4edd-bace-f851b784dbe6"
  },
  "errors": null,
  "resources": null
}

{
    "meta": {
        "query_time": 6.8e-8,
        "pagination": {
            "offset": "",
            "limit": 100
        },
        "trace_id": "2039578c-1e94-4e56-a2c7-58bea1c12857",
        "entity": "/devices/entities/devices/v1{?ids*}"
    },
    "resources": [
        "9d4f598cec024ac2bf3c5e2afdc69129",
        "331c40581b7a4d4a81863bf630edc868"
    ],
    "errors": []
}

{
    "meta": {
        "query_time": 17.960566309,
        "powered_by": "device-api",
        "trace_id": "d7fa97da-83c3-4349-b870-e19d85983605"
    },
    "resources": [
        {
            "id": "331c40581b7a4d4a81863bf630edc868",
            "path": "/devices/entities/devices/v1"
        }
    ],
    "errors": []
}

Performance Matrix

Here is the performance reading conducted by pulling and sharing 100K indicators from/to CrowdStrike on a Large Cloud Exchange Stack with these specifications.

User Agent

The user agent for this plugin is in the following format:

 <vendor>-<integration name>/<version>

For example:

netskope-ce-5.1.2-cte-crowdstrike/2.3.0

Workflow

Watch a Video

Click play to watch a video.

Get your CrowdStrike Client ID and Client Secret

1. Log in to your CrowdStrike platform and go to Support and Resources > API Client and Keys.

   

2. Click Create API Client. Add the Client name and provide the scopes listed in the Permissions section.

3. Copy the Client ID and Secret, and then click Create.

Get your Host ID for the Isolate/Remediate Hosts Action

To perform the Isolate/Remediate Hosts action it is mandatory to have the hosts for the IoCs on whom you want to perform the action for present on the CrowdStrike platform or the host on which you want to perform action on CrowdStrike should have some IoCs associated to that Hosts . To check the same follow these steps:

1. Copy the IoC that you want to use for performing the Isolate/Remediate action.
2. Go to the CrowdStrike platform and search the IoC on CrowdStrike’s Endpoint Detection page from the top left menu’s Endpoint Security.

   

3. You’ll see the detections listed as shown in above screenshot. Click on any one of the listed detections, and click See full detection on the bottom of the page.

   

4. Go to details, and scroll down to Hosts, you will find the host ID. Copy the Host ID.

   

Configure the CrowdStrike Plugin

1. In Cloud Exchange, go to Settings > Plugins.
2. Search for and select the CrowdStrike v2.3.0 (CTE) plugin box.

   

3. Enter the Basic Information:
   • Configuration Name: Plugin configuration name.
   • Sync Interval: Interval to fetch data from this plugin source.
   • Aging Criteria: Expire indicators after a specific time.
   • Override Reputation: Set value to override reputation of indicators received from this configuration. Leave empty to keep default.
   • Tags Aggregate Strategy: Select an option from the dropdown.
   • Enable SSL Validation: Enable SSL Certificate validation.
   • Use System Proxy: If using a proxy, use system proxy configured in Settings.

   

4. Click Next.
5. Enter the Configuration Parameters:
   • Base URL: Base URL of CrowdStrike instance, like https://api.crowdstrike.com.
   • Client ID: Client ID generated from the CrowdStrike platform.
   • Client Secret: Client Secret generated from the CrowdStrike platform.
   • Enable Polling: Enable/Disable polling Threat IoCs from CrowdStrike. Disable if you only need to push Threat IoCs to CrowdStrike.
   • Indicator Source Page: The source page from which plugin should pull the indicators.
   • Type of Threat data to pull: Type of Threat data to pull. Allowed values are SHA256, MD5, Domain, IPv4 and IPv6.
   • Exclude Pattern Disposition values: Indicators with these pattern disposition values will not be pulled from the Endpoint Detections page. Add multiple values separated by comma(Example Format: 1,2,3). All indicators without a pattern_disposition field will be pulled. Refer the CrowdStrike Documentation to get the Pattern Disposition values.
   • Retraction Interval (in days): Retraction Interval days to run IoC(s) retraction for CrowdStrike indicators. Note that this parameter will only be considered if IoC(s) Retraction is enabled in Threat Exchange Settings.
   • Initial Range: Number of days Threat IoCs to pull in the initial run.
   • Indicator Batch Size: The origin of this Threat IoC. This field can be utilized to trace the origin of the IoC on the CrowdStrike Custom IOC. Limited to 200 characters.

   

Note that IoCs present on the IoC Management and Endpoint Detection pages in Crowdstrike UI won’t be pulled if the source is starting from Netskope – Cloud Threat Exchange.

6. Click Save.

   

Configure a Threat Exchange Business Rule for CrowdStrike

A Business Rule is used to filter out the indicators that are to be shared. In order to share IoCs with CrowdStrike, create a business rule using these steps:

1. Go to Threat Exchange > Business Rules and click Create New Rule.

   

2. Add the Rule name and select the fields through which you want to filter the IoCs.

   

   

   

3. Click Save.

Configure Threat Exchange Sharing for CrowdStrike

CrowdStrike v2.3.0 supports performing Remediate and Isolate actions on the Hosts. This plugin also updates the already shared Indicators on CrowdStrike when reshared.

CrowdStrike Actions

Perform Action

• No Action: Save the indicator for future use, but take no action. No severity is required.
• Allow: This applies to hashes only. Allow the indicator and do not detect it. Severity does not apply and should not be provided.
• Block, Hide Detection: This applies to hashes only. Block and detect the indicator, but hide it from Endpoint security > Monitor > Endpoint detections. Has a default severity value.
• Block: This applies to hashes only. Add the indicator to the Block list using which the prevention policy will block the processes on the host from which this indicator is generated.
• Detect Only: Show it as detection and take no action on it.

Isolate/Remediate Hosts

• Contain: Contains the host and stops any network communications to locations other than the CrowdStrike cloud and IPs specified in your containment policy.
• Lift Containment: Lifts containment on the host and returns its network communications to normal.
• Hide Host: Deletes a host. After the host is deleted, no new detections for the host will be reported via the UI or API. A maximum of 100 hosts can be hidden at a time.
• Unhide Host: Restores a host if deleted. Detection reporting resumes after the host is restored.

To configure sharing:

1. Go to Threat Exchange > Sharing and click Add Sharing Configuration.

   

2. Select Source configuration (Source from which you want to share data to CrowdStrike), select a Business Rule, and Destination.
3. Select a Target value and Action type.

   

   

   

4. Click Save.

Validate the CrowdStrike Plugin

Validate the Pull

Indicators from CrowdStrike are pulled from these pages:

• Endpoint security > Endpoint Detection
• Endpoint security > IoC Management

Note that:

• IoCs that have a Source other than Netskope – Cloud Threat Exchange will be pulled from CrowdStrike.
• In the CrowdStrike UI, Netskope – Cloud Threat Exchange will be displayed as Netskope Cloud Threat Exchange.

Indicators stored in Cloud Exchange can be verified at Threat Exchange > Threat IoCs. Search the CrowdStrike IoCs by filtering indicators from CrowdStrike.

Example: Add a query on the Threat IoCs page like “sources.source Is equal “CTE CrowdStrike” && type IN (“<IOC_TYPE>”)“

You can also verify the indicators pulled in Cloud Exchange from the logs available at Logging in Cloud Exchange.

CTE CrowdStrike [CTE CrowdStrike]: Successfully fetched 141 indicator(s) for 141 alert(s) from CrowdStrike Endpoint Detections. 

CTE CrowdStrike [CTE CrowdStrike]: Successfully fetched 6978 indicator(s) from CrowdStrike Custom IOC Management in total 4 pages.

Validate the Push

Shared IoCs to CrowdStrike can be verified from the logs available at Logging in Netskope Cloud Exchange.

Note that if the IoCs are already present on the CrowdStrike, it will be updated.

CTE CrowdStrike [CTE CrowdStrike]: Successfully shared 4 indicator(s) with CrowdStrike Custom IOC Management. 0 indicator(s) failed to be shared.

CTE CrowdStrike [CTE CrowdStrike]: Successfully filtered 4 indicators out of 4, received from the business rule.

IoCs shared on CrowdStrike can be verified from the Endpoint security > IoC Management page.

To verify the original source of indicator from which this was pulled in Cloud Exchange and shared to CrowdStrike. Check the Source Field for their particular IoC.

For example if indicator is shared from Netskope Threat Exchange plugin to CrowdStrike plugin then it will be shown as Netskope – Cloud Threat Exchange | Netskope Threat Exchange. Similarly if IOC is shared from MISP then it will be shown as Netskope – Cloud Threat Exchange | MISP. Check below screen-shot for reference.

When the IoCs shared from CrowdStrike to Third Party will be retracted it will be marked as “<plugin-config-name>: retracted” in the Retraction Result. If they are not deleted from the Third party the Retraction Result will be pending.

IoCs shared to perform isolate/remediate host action on the specific host on CrowdStrike can be verified from Host setup and management > Host Management.

• Search the host ID for associated with the particular hash for which the action has been performed and check the Containment Status.
• Currently, the Status of the Host is Normal.

Add sharing to perform the Contain Operation on the host. After sharing has been initiated. Go to Logging and search for Successfully executed.

Go back to the CrowdStrike platform and check if the status has been changed or not. Follow the same steps for other Isolate/Remediate actions.

Validate the Retraction

For verifying the Retracted IoCs from CrowdStrike, check the logs for IoC Retraction example: ‘message Like CTE CrowdStrike [configuration_name] [Retraction]’

Note that the IoCs that are deleted on the CrowdStrike and fall outside the Retraction Interval will be marked as Retracted in Cloud Exchange.

To check the retracted IoCs in Cloud Exchange, go to Threat IoCs and search for “sources.source Like “CTE CrowdStrike” && sources.retracted Is equal true”.

This plugin also supports push retraction, which means IoCs pulled from 3rd-party platforms that were shared to CrowdStrike platforms, and were marked as retracted in Cloud Exchange, will also get deleted from the shared platform if that platform supports deletion of IoCs. You can verify the same through the Retraction result field.

Troubleshooting the CrowdStrike Plugin

Getting error while updating CrowdStrike from older version to v2.3.0

Due to change in the permissions for the new API endpoints, you will encounter an error while upgrading the plugin from the older version.

What to do: Before upgrading the plugin in Cloud exchange, update the permissions for Client ID and Secret. It should have below mentioned permissions:

Once you upgrade your plugin then you can remove the permissions for ‘Detections’.

If you are receiving an error while updating the plugin using the plugin repository, follow the below steps:

• Close the plugin repo page once you pull and download the plugin updates.
• Go to the Threat Exchange > Plugins.
• Edit the plugin, go to the Configuration parameter page > remove the selected value from the “Type of Threat Data to pull” field, and select the IOC type that you want to pull.
• Select the source page from the “Indicator Source Page” dropdown.
• Save the plugin.
• Click on the enable plugin icon and enable the plugin. The plugin will be updated with the latest changes and start working as expected.

Receiving the same IoC from Crowdstrike Endpoint detection, that was shared to Crowdstrike’s Custom IoC Management page with action Detect Only (Loopback Issue)

If you are facing the loopback issue that is receiving the same IoC from Crowdstrike Endpoint detection, that was shared to Crowdstrike’s Custom IoC Management page with action Detect Only, follow the below steps

What to do:

Update the plugin to the latest version (2.3.0), as the issue is addressed in that.

The plugin keeps pulling IoCs in a loop

If your plugin keeps pulling same batch of IOCs in again and again then, follow the below steps

What to do:

Update the plugin to the latest version (2.3.0), as the issue is addressed in that. Thus, the plugin will not pull the same IOCs again and again.

Receiving an error while configuring the plugin

If you are facing an issue while configuring the CrowdStrike plugin, follow the below steps

What to do:

Make sure correct credentials are provided, and the generated credentials have the needed permissions.

Receiving 403 forbidden error while configuring the plugin

If you are receiving 403 error, verify the below scenarios:

1. Check if the provided Client ID and Client Secret values are correct.
2. The API client has proper permissions:
   1. Check if you have proper permissions provided to the API Client.
   2. If you are upgrading the plugin follow the steps mentioned in Getting error while updating CrowdStrike from older version to v2.3.0 section.
3. You have IP groups added in the IP Allowlist Management page.

Follow the below steps to add your CE’s public IP to CrowdStrike’s IP allowlist:

1. On your CrowdStrike tenant, navigate to `Host setup and management > Falcon users > IP Allowlist Management` page and check if any IP groups are added. If added, it will be listed on the page. If not, your screen will look as below. Follow the below steps in case you have the IP groups added in the IP Allowlist Management page. 

2. If you have some IP allowlist groups configured on your CrowdStrike tenant, make sure to add the `Public IP Address` of the virtual machine where cloud exchange is running into an existing group, or you can create a new IP allowlist Group. While adding that, make sure you have Access Type `API` selected as shown below.

Unable to pull data from the CrowdStrike Platform

If you are facing an issue while pulling the data from the CrowdStrike plugin, follow the below steps.

What to do:

1. Go to the Logging page, verify if any error has occurred and try to fix it.
2. Go to the CrowdStrike UI, and verify if Client ID/Secret are present, and not expired.

Note that some of the IoCs on CrowdStrike may not have the type or value field or those fields are empty. Such IoCs will not be pulled to Cloud Exchange.

Receiving a 500 Server error while updating/sharing the IoCs to CrowdStrike

If you are receiving the below error message in logs while sharing the IoCs to CrowdStrike, it might be because of the batch size provided in the plugin configuration for sharing being large.

What to do: Change the batch size for the sharing from the plugin configuration:

1. Edit the CrowdStrike plugin in Threat Exchange > Plugins.
2. Reduce the Indicator Batch Size parameter and save the plugin.

Not able to share IoCs from Cloud Exchange to the CrowdStrike plugin

If you are not able to share IoCs from Netskope to CrowdStrike, that could be due to below-mentioned reason:

• The IoCs present for Netskope plugin are of invalid type.
• Proper Permissions are not set for the Client ID, Client Secret for CrowdStrike.

What to do:

1. Make sure that valid types of IoCs are present. CrowdStrike does not support URLs, if you are trying to share URL types of IoCs it will not be shared.
2. Make sure that all the needed permissions are set for Client ID, Client Secret for CrowdStrike.

Known Behaviors

• Crowdstrike supports sharing of only 1M IoCs to the IoC Management Page so if the page already has exceeded the limit IoCs won’t be shared from Netskope Cloud Exchange and the user will first have to delete the existing IoCs.
• We have observed that some of the IoCs on CrowdStrike may not have the type or value field or those fields are empty. Such IoCs will not be pulled to Netskope Cloud Exchange.
• We have observed that the CrowdStrike platform does not support providing severity while performing some actions (‘Allow’, ‘Block, hide detection’), so while sharing IoCs from Netskope Cloud Exchange the severity will not be shared.
• We have observed that the CrowdStrike APIs do not return data in sorted form sometimes, due to which the details pulled in Cloud Exchange might not be as per latest detection. So, it is possible that a particular IoCs might have multiple occurrences and the pull details of that IoC in Cloud Exchange might not be the latest one.
• We have observed that CrowdStrike allows to store multiple IoCs in the value field for Endpoint Detection page where the type of that IoCs can be different to that of all the IoCs present in the value field. The plugin will store the IoC with respect to type field and the rest of the IoCs will be skipped and will not be stored. In the below example you can see that the type is sha256 and the ioc_value field contains 2 values out of which one is of type md5. In this case, sha256 will be stored in Cloud Exchange and other values will not be stored.

{ "agent_id": "7c566a5cc4ee4248a83d0405d7273a49", "aggregate_id": "aggind:7c566a5cc4ee4248a83d0405d7273a49:137439072286", "alleged_filetype": "exe", "associated_files": [], "child_process_ids": [ "pid:7c566a5cc4ee4248a83d0405d7273a49:297786408684" ], "cid": "c17f3a80ded0418eb107db3d26a27983", "cloud_indicator": "true", "cmdline": "\"C:
Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\\\
{856B848F-38B5-4946-921B-FB2F7713213E}

\\MicrosoftEdge_X64_137.0.3296.68.exe\" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable",
"composite_id": "c17f3a80ded0418eb107db3d26a27983:ind:7c566a5cc4ee4248a83d0405d7273a49:297785683156-5311-1935186763644973143",
"confidence": 100,
"context_timestamp": "2025-06-18T04:57:29Z",
"control_graph_id": "ctg:7c566a5cc4ee4248a83d0405d7273a49:137439072286",
"crawled_timestamp": "2025-06-18T05:57:51.199159695Z",
"created_timestamp": "2025-06-18T04:58:51.562849229Z",
"data_domains": [
"Endpoint"
],
"description": "A SHA256 hash matched a Custom Intelligence Indicator (Custom IOC) with low severity.",
"device": {
"agent_load_flags": "0",
"agent_local_time": "2025-06-17T22:47:44.249Z",
"agent_version": "7.24.19607.0",
"bios_manufacturer": "VMware, Inc.",
"bios_version": "VMW201.00V.24006586.B64.2406042154",
"cid": "c17f3a80ded0418eb107db3d26a27983",
"config_id_base": "65994767",
"config_id_build": "19607",
"config_id_platform": "3",
"device_id": "7c566a5cc4ee4248a83d0405d7273a49",
"external_ip": "61.219.78.165",
"first_seen": "2025-02-17T17:21:36Z",
"groups": [
"1012add21d3e4e08b146dbfdb37c5ca0"
],
"hostinfo":
{ "domain": "" }

,
"hostname": "DESKTOP-LQDIGUR",
"last_seen": "2025-06-18T05:48:27Z",
"local_ip": "10.66.2.89",
"mac_address": "00-0c-29-ee-47-37",
"machine_domain": "",
"major_version": "10",
"minor_version": "0",
"modified_timestamp": "2025-06-18T05:52:52Z",
"os_version": "Windows 10",
"ou": null,
"platform_id": "0",
"platform_name": "Windows",
"product_type": "1",
"product_type_desc": "Workstation",
"status": "contained",
"system_manufacturer": "VMware, Inc.",
"system_product_name": "VMware20,1"
},
"display_name": "CustomIOCHashLow",
"email_sent": true,
"external": true,
"falcon_host_link": "https://falcon.crowdstrike.com/activity-v2/detections/c17f3a80ded0418eb107db3d26a27983:ind:7c566a5cc4ee4248a83d0405d7273a49:297785683156-5311-1935186763644973143?_cid=g03000nb3ghi5x4fappp2bjsndr5ej4q",
"filename": "MicrosoftEdge_X64_137.0.3296.68.exe",
"filepath": "\\Device
HarddiskVolume3
Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\\\{856B848F-38B5-4946-921B-FB2F7713213E}
MicrosoftEdge_X64_137.0.3296.68.exe",
"files_written": [
{ "filename": "setup.exe", "filepath": "\\Device\\HarddiskVolume3
Program Files (x86)\\Microsoft\\EdgeUpdate\\Install\\\\
{856B848F-38B5-4946-921B-FB2F7713213E}
EDGEMITMP_60DE1.tmp",
"timestamp": "1749829318"
}
],
"global_prevalence": "common",
"grandparent_details":
{ "cmdline": "C:\\Windows\\system32\\services.exe", "filename": "services.exe", "filepath": "\\Device\\HarddiskVolume3\\Windows\\System32\\services.exe", "local_process_id": "904", "process_graph_id": "pid:7c566a5cc4ee4248a83d0405d7273a49:296364257770", "process_id": "296364257770", "sha256": "4a912dc98c977788131aad0ae468d86792211ed225f80b2c344a3690b4437428", "timestamp": "2025-06-13T04:55:18.990Z", "user_graph_id": "uid:7c566a5cc4ee4248a83d0405d7273a49:S-1-5-18", "user_id": "S-1-5-18", "user_name": "DESKTOP-LQDIGUR$" }
,
"id": "ind:7c566a5cc4ee4248a83d0405d7273a49:297785683156-5311-1935186763644973143",
"indicator_id": "ind:7c566a5cc4ee4248a83d0405d7273a49:297785683156-5311-1935186763644973143",
"ioc_context": [
{ "ioc_source": "primary_module", "ioc_type": "sha256", "ioc_value": "5219f66e6cab3aa843f6e89ee3d47d32,d757eb8b567d76eb19f7009adbb9d013c7cf1861f45b18a023d6866e8baa2a2d", "type": "ioc" }
],
"ioc_source": "primary_module",
"ioc_type": "sha256",
"ioc_value": "5219f66e6cab3aa843f6e89ee3d47d32,d757eb8b567d76eb19f7009adbb9d013c7cf1861f45b18a023d6866e8baa2a2d",
"local_prevalence": "unique",
"local_process_id": "1868",
"logon_domain": "WORKGROUP",
"md5": "5219f66e6cab3aa843f6e89ee3d47d32",
"name": "CloudDetect-CustomerIOC-SHA256-Low",
"objective": "Falcon Detection Method",
"parent_details":
{ "cmdline": "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe\" /svc", "filename": "MicrosoftEdgeUpdate.exe", "filepath": "\\Device\\HarddiskVolume3\\Program Files (x86)\\Microsoft\\EdgeUpdate\\MicrosoftEdgeUpdate.exe", "local_process_id": "4336", "md5": "c019e421d9f897108e51666cbae2c8b0", "process_graph_id": "pid:7c566a5cc4ee4248a83d0405d7273a49:297758877134", "process_id": "297758877134", "sha256": "3096d8e82917a9b73f322f4b1743e52e9b0c8b3c5933a957e73e29d6973cdd5b", "timestamp": "2025-06-16T10:26:29Z", "user_graph_id": "uid:7c566a5cc4ee4248a83d0405d7273a49:S-1-5-18", "user_id": "S-1-5-18", "user_name": "DESKTOP-LQDIGUR$" }
,
"parent_process_id": "297758877134",
"pattern_disposition": 0,
"pattern_disposition_description": "Detection, standard detection.",
"pattern_disposition_details":
{ "blocking_unsupported_or_disabled": false, "bootup_safeguard_enabled": false, "containment_file_system": false, "critical_process_disabled": false, "detect": false, "fs_operation_blocked": false, "handle_operation_downgraded": false, "inddet_mask": false, "indicator": false, "kill_action_failed": false, "kill_parent": false, "kill_process": false, "kill_subprocess": false, "mfa_required": false, "operation_blocked": false, "policy_disabled": false, "prevention_provisioning_enabled": false, "process_blocked": false, "quarantine_file": false, "quarantine_machine": false, "registry_operation_blocked": false, "response_action_already_applied": false, "response_action_failed": false, "response_action_triggered": false, "rooting": false, "sensor_only": false, "suspend_parent": false, "suspend_process": false }
,
"pattern_id": 5311,
"platform": "Windows",
"poly_id": "AADBfzqA3tBBjrEH2z0monmDgEHElB4TLZI4zzCC9NmU_gAATiEItOfbNan5F65GbEhxGr5sIpuo7GVQmBmbrXDpFsSf8Q==",
"priority_explanation": [
"[MOD] The parent process was identified as: MicrosoftEdgeUpdate.exe"
],
"priority_value": 87,
"process_id": "297785683156",
"process_start_time": "1749829315",
"product": "epp",
"scenario": "intel_detection",
"seconds_to_resolved": 0,
"seconds_to_triaged": 0,
"severity": 30,
"severity_name": "Low",
"sha1": "0000000000000000000000000000000000000000",
"sha256": "d757eb8b567d76eb19f7009adbb9d013c7cf1861f45b18a023d6866e8baa2a2d",
"show_in_ui": true,
"source_products": [
"Falcon Insight"
],
"source_vendors": [
"CrowdStrike"
],
"status": "new",
"tactic": "Custom Intelligence",
"tactic_id": "CSTA0005",
"technique": "Indicator of Compromise",
"technique_id": "CST0005",
"timestamp": "2025-06-18T04:57:29.681Z",
"tree_id": "137439072286",
"tree_root": "297785683156",
"triggering_process_graph_id": "pid:7c566a5cc4ee4248a83d0405d7273a49:297785683156",
"type": "ldt",
"updated_timestamp": "2025-06-18T05:57:51.199148989Z",
"user_id": "S-1-5-18",
"user_name": "DESKTOP-LQDIGUR$"
}

You might see logs like these in your Cloud Exchange:

CTE CrowdStrike [CTE CrowdStrike]: Successfully fetched 143 indicator(s) for 142 alert(s) from CrowdStrike Endpoint Detections.
Completed storing the batch of 142 indicator(s) for configuration 'CTE CrowdStrike'.

• Here, the fetch count is greater than the store count because of the IoCs shown in the above example, which is having multiple values in the ioc_value field only the value which is a valid sha265 will be stored in the Cloud Exchange
• When sharing file hashes with CrowdStrike IoC Management, previously deleted file hashes may cause issues. If a user deletes file hashes for any reason and they are successfully removed from the UI and not returned via the GET /iocs/combined/indicator/v1 endpoint, the plugin will treat them as new indicators. Consequently, it will attempt to share them using the POST /iocs/entities/indicators/v1 endpoint. This results in a 409 Conflict error due to the hash pairs already existing in the system, as indicated by the following API response:

{
 "meta": {
  "query_time": 24.138019618,
  "powered_by": "ioc-manager",
  "trace_id": "bc6c0a83-b883-4289-8d1e-d9ad37aec273"
 },
 "errors": [
  {
   "code": 409,
   "message": "type sha256 and value 7440f5212e00eaa2b9425e0cb29f7e92c481e82a9cefc313177aa61fbb9e8a60 pair already exists."
  },
  {
   "code": 409,
   "message": "type md5 and value 328f95a67c92885fbaf9946c913149bd pair already exists."
  },
  {
   "code": 409,
   "message": "type sha256 and value e8ce6cee6554f2699605da7a59abe4ff81d96c5f2e4066e2314ddac92363fdd3 pair already exists."
  }
 ],
 "resources": []
}