prex55/cs-stream-logscale-connector repository overview

⁠CrowdStrike Streaming API to LogScale Connector

Getting CS logs via streaming api, and send it to LogScale Community Edition. Logs are sent every minute.

Japanese document is here⁠.

⁠Usage

⁠LogScale Console

1. Create a LogScale Community Edition account here⁠.
2. Install CrowdStrike siem-connector.
3. Copy ingest token of the siem-connector.

⁠Falcon Console

Create API ID and Secret with the following scope.
Event streams: read

⁠config.env

Save the following text as config.env and modify it.

CS_CLIENT_ID=XXXXXXXXXXXXXXXXXXXXXXXXXXXX
CS_CLIENT_SECRET=XXXXXXXXXXXXXXXXXXXXXXXXXXXX
CS_APIURL=https://api.crowdstrike.com
STREAM_APPID=cs-stream-logscale-connector
LS_URL=https://cloud.community.humio.com/api/v1/ingest/hec/raw
LS_INGEST_TOKEN=XXXXXXXXXXXXXXXXXXXXXXXXXXXX
PROCESS_CHECK_INTERVAL=60

# Option: You can specify an offset to start retrieving events from the specific offset.
CS_STREAM_OFFSET=

⁠Run

Basic command

docker run -d --env-file [config.env path] --name cslc prex55/cs-stream-logscale-connector:[tag]

Example

docker run -d --env-file ./config.env --name cslc prex55/cs-stream-logscale-connector:2.1

⁠Show Logs

 docker logs -f cslc

⁠Notes

1. If the cs streaming API does not send logs for a period of time (usually 5 minutes, depending on the environment), the streaming API connection may be closed. But don't worry, this program will reconnect automatically. (it may take up to 1 hour to reconnect.)

⁠Troubleshooting

1. The following errors indicates that CS_CLIENT_ID or CS_CLIENT_SECRET are invalid.

Mon Dec 19 00:19:30 UTC 2022 --- Query offset -
Mon Dec 19 00:19:30 UTC 2022 --- getting oauth2 token
curl: (22) The requested URL returned error: 401 Unauthorized
Mon Dec 19 00:19:31 UTC 2022 --- getting streaming url
curl: (22) The requested URL returned error: 401 Unauthorized

1. The following error indicates that STREAM_APPID is duplicated with another application, please change STREAM_APPID in config.env. If you believe there is no another application, this is a temporary error; wait 30 minutes and this error should go away.

jq: error (at <stdin>:1): Cannot iterate over null (null)

⁠Source Code

https://github.com/p-rex/cs-stream-logscale-conector⁠