Crowdstrike Detection Summary

Description

Forwards any alerts generated by CrowdStrike to your Panther destinations.

Query · python

from panther_core import PantherEvent
from panther_crowdstrike_event_streams_helpers import cs_alert_context


def rule(event: PantherEvent):
    return event.deep_get("metadata", "eventType") == "EppDetectionSummaryEvent"


def title(event: PantherEvent):
    alert_title = event.deep_get("event", "Name", default="New CrowdStrike Detection")
    alert_desc = event.deep_get("event", "Description")
    return f"{alert_title}: {alert_desc}" if alert_desc else alert_title


def dedup(event: PantherEvent):
    if alert_id := event.deep_get("event", "CompositeId"):
        return alert_id
    # Else, fall back on title string
    return title(event)


def severity(event: PantherEvent):
    # First, try returning the severity based on the SeverityName
    sevname = str(event.deep_get("event", "SeverityName")).upper()
    allowed_values = ("INFO", "LOW", "MEDIUM", "HIGH", "CRITICAL")
    if sevname == "INFORMATIONAL":
        sevname = "INFO"
    if sevname in allowed_values:
        return sevname

    # Else, fallback on the numerical value, falling back on MEDIUM if we still don't have a value
    sevval = event.deep_get("event", "Severity") // 20
    return {0: "INFO", 1: "LOW", 2: "MEDIUM", 3: "HIGH", 4: "CRITICAL", 5: "CRITICAL"}.get(
        sevval, "DEFAULT"
    )


def reference(event: PantherEvent):
    return event.deep_get("event", "FalconHostLink", default="")


def alert_context(event: PantherEvent):
    context = cs_alert_context(event)
    context.update(
        {
            "FalconLink": event.deep_get("event", "FalconHostLink", default="<NO LINK PROVIDED>"),
            "CompositeId": event.deep_get("event", "CompositeId", default="<NO ID PROVIDED>"),
            "FileName": event.deep_get("event", "FileName", default="<NO FILENAME PROVIDED>"),
            "FilePath": event.deep_get("event", "FilePath", default="<NO FILEPATH PROVIDED>"),
            "UserName": event.deep_get("event", "UserName", default="<NO USERNAME PROVIDED>"),
        }
    )
    return context

Analyst notes

Followup with the alert according to CrowdStrike's recommendations.

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Medium
Status: Stable
Query type: python
Created: 2024-12-06
Modified: 2026-02-13
Authored by: panther-labs
Source ID
Upstream: rules/crowdstrike_rules/event_stream_rules/crowdstrike_detection_summary.yml
Type: rule
Version: 3
Data sources: Crowdstrike.EventStreams