CrowdStrike Integration

CrowdStrike Integration with TigerTrust

TigerTrust integrates with CrowdStrike Falcon for certificate-aware security operations.

API Configuration

Configure CrowdStrike API access:

yaml
1crowdstrike:
2  client_id: $CROWDSTRIKE_CLIENT_ID
3  client_secret: $CROWDSTRIKE_CLIENT_SECRET
4  base_url: https://api.crowdstrike.com
5
6  features:
7    threat_detection: true
8    endpoint_visibility: true
9    ioc_sharing: true

Certificate IOC Sharing

Share certificate indicators of compromise:

json
1{
2  "type": "certificate",
3  "value": {
4    "thumbprint": "SHA256:abc123...",
5    "common_name": "malicious.example.com",
6    "issuer": "Unknown CA"
7  },
8  "severity": "high",
9  "action": "detect",
10  "description": "Certificate associated with known malware campaign"
11}

Endpoint Certificate Visibility

Query endpoint certificate data:

python
1# Query certificates on endpoints
2crowdstrike.query_certificates(
3    filter="common_name:*example.com",
4    sort="last_seen|desc",
5    limit=100
6)

Alert Correlation

Correlate TigerTrust and CrowdStrike alerts:

yaml
1correlation_rules:
2  - name: Certificate Used in Attack
3    crowdstrike_event: ProcessCreate
4    tigertrust_event: certificate_usage
5    conditions:
6      - process_reputation: malicious
7      - certificate_valid: false
8    action: create_incident
9
10  - name: Unauthorized Certificate
11    crowdstrike_event: TLSConnection
12    tigertrust_event: unknown_certificate
13    conditions:
14      - connection_external: true
15    action: alert_security

Incident Response

Automated response to certificate threats:

yaml
1incident_response:
2  certificate_compromise:
3    actions:
4      - revoke_certificate
5      - isolate_endpoints
6      - collect_forensics
7      - notify_security_team

XDR Integration

Extended detection and response:

• Certificate data in XDR timelines
• Cross-domain threat correlation
• Unified investigation interface
• Automated containment

Enhance certificate security with CrowdStrike and TigerTrust.