Adding scanned data from CrowdStrike to TrueSight Automation Console via BMC Helix iPaaS, powered by Jitterbit

BMC Helix iPaaS, powered by Jitterbit provides a prebuilt integration template to add scanned data from CrowdStrike Falcon to TrueSight Automation Console (previously BMC Helix Vulnerability Management). To use the integration template with the values defined out of the box, update the project variables with details of your systems and deploy the integration template. The integration template uses the BMC Helix iPaaS HTTP connector for API operations for TrueSight Automation Console (import scan report operation) and Vulnerability Management System vendors (export scan report operation).

The template provides the following capabilities: 

To learn more about CrowdStrike Falcon, see the CrowdStrike documentation.

CrowdStrike Falcon to TrueSight Automation Console data flow

The following image gives an overview of the data flow for adding scanned data to TrueSight Automation Console:

Before you begin

Make sure you have the following items to successfully set up and use this integration:

Task 1: To download and import the integration template project file

1. Download the Import CrowdStrike Vulnerability data in BMC Helix Vulnerability Management 2023-01-01 file to your system.
   This file contains the BMC Helix iPaaS Integration Studio project Import CrowdStrike Vulnerability data in BMC Helix Vulnerability Management.
   

   Important

   Your access to product pages on the EPD website is determined by the license your company purchased.

2. As a developer, log in to BMC Helix iPaaS and navigate to the Integration Studio.
3. On the projects page, click Import.
4. Click Browse, and then select the Import CrowdStrike Vulnerability data in BMC Helix Vulnerability Management.json file you downloaded.
   The Project Name and Organization fields are automatically populated depending on the values defined. 
5. From the Environment list, select the environment to which you want to import this integration template, and then click Import.
   The project opens after the integration template is imported. 
6. To open the project file later, select the environment where the integration templates are available, and then select Import CrowdStrike Vulnerability data in BMC Helix Vulnerability Management, and click View/Edit.

Task 2: To update the project variables for the integration template

1. Click ... next to the Environment name and select Project Variables.

2. To access CrowdStrike Falcon and TrueSight Automation Console, update the following project variables:

   Project variables	Action
   CrowdStrike Falcon
   CROWDSTRIKE_URL	Enter the URL of the CrowdStrike Falcon instance you are using.
   CROWDSTRIKE_CLIENT_ID	Enter the client ID for your CrowdStrike Falcon instance that you generated earlier.
   CROWDSTRIKE_SECRET_ID	Enter the secret ID for your CrowdStrike Falcon instance that you generated earlier.
   CROWDSTRIKEAPI_LIMIT	Enter a value between 1-5000 to limit the items to be returned. By default, CrowdStrike Falcon sends 100 scanned data at a time.
   CROWDSTRIKE_FILTER	Enter a filter condition in the following format to import scanned data from a CrowdStrike Falcon policy: filter=[filter_name]:['value'] For example, enter filter=[severity]:['low']. You can also enter multiple filter conditions in the following format: filter=[filter_name]:['value']%2bfilter_name2:['value2'] For example, enter filter=[severity]:['High','Critical']%2bstatus:['Open','Closed'] To know more about the filters, see Filter Spotlight APIs. Important: Regardless of the severity value you specify in the filter, CrowdStrike Falcon sends data associated with all the severity values.
   CROWDSTRIKE_SCAN_NAME	Enter a name for the scanned file that you want to import from CrowdStrike Falcon. The scanned file in TrueSight Automation Console is generated with the name that you specify.
   TrueSight Automation Console
   HVM_URL	Enter the URL of the TrueSight Automation Console instance.
   HVM_User	Enter the username to access the TrueSight Automation Console instance.
   HVM_Password	Enter the password for the username to access the TrueSight Automation Console instance.
   HVM_Login_Role	Enter the role of the TrueSight Automation Console Instance user.
   HVM_TenantID	Enter the tenant ID of the TrueSight Automation Console Instance. This value is mandatory if the user belongs to multiple tenants.
   HVM_Vendor	Enter CrowdStrike.
   HVM_Cloud_User	Enter one of the following values to define the type of user for the TrueSight Automation Console instance:  True: For a cloud user False: For a Server Automation user

Task 3: To configure the Jitterbit private agent

Perform the following steps only if you are using an on-premises version of BMC Helix iPaaS, powered by Jitterbit:

1. In BMC Helix iPaaS, powered by Jitterbit, click and select Management Console > Agents > Agent Groups.
2. Select the private agent you are using, click the Action list, and select Jitterbit Conf. 
   
   The Jitterbit Conf dialog box is displayed.

3. On the Config tab, click Edit, and perform the following actions:

   Section	Field	Description	Action
   OperationEngine	MaxAsyncOperationChainLength	The number of asynchronous operations needed to import scanned vulnerability data from CrowdStrike Falcon.	Specify the number of operations you want to run based on the amount of vulnerability data you want to import. For example, if you want to import 2000000 vulnerabilities, enter 2000 in this field. If you want to import unlimited data, enter 0 or a negative number. By default, the value of this field is set to 50.

   

4. Click Submit.

Task 4: To deploy and enable the project

1. To deploy the project, click the ellipsis ... next to the project name and then click Deploy Project.
   
2. To enable the project, select 4.0 TSAC Create Policy > 4.1 TSAC Create Policies, click the ellipsis, and then click Run.
   

(Optional) Task 5: To fetch the policy ID by using a scheduler

This integration template provides the TSAC GET Policy operation that you can run automatically by using a scheduler. To do this, you can either use an existing schedule or create a new schedule and assign to a workflow.

To create a new schedule and assign it to a workflow, perform the following steps:

1. In the template, on the WORKFLOWS tab, select 5.0 TSAC GET Policy > 5.0 TSAC GET WRAPPER.
2. Click the ellipsis ..., and then click Settings, as shown in the following image:
   
3. On the Schedules tab, click Create New Schedule.

4. On the New Schedule page, complete the following fields:

   Field name	Action
   SCHEDULE NAME	Enter a meaningful name for the schedule.
   OCCURENCE	Specify when you want the schedule to be run.
   FREQUENCY	Specify how many times you want the schedule to be run.
   DURATION	Specify the start and end dates for the schedule.

   

5. Click Save.
6. On the Schedules tab, from the CONDITION list, select On Schedule.
7. From the SCHEDULE list, select the schedule you created.
8. Click Assign.

For more information about schedules, see Schedules.

How does the template resume a failed import

The following image illustrates how the integration template imports vulnerability data after it failed during the first import process:

If the import process fails due to certain reasons; for example, the agent machine is shut down, the cache functionality stores the point of failure for 24 hours. When you run the template again after the failure, the template starts importing the vulnerability data from the point where the import failed.

Workflows included in the integration template

The integration template includes workflows for the basic configuration and each integration use case. The following tables describe the operations defined in each workflow:

Common

This workflow contains the following operations:

TSAC Workflow

This workflow imports the defined scans into TrueSight Automation Console. 

Crowdstrike

This workflow retrieves the scan data and verifies it for export. The following operations are included in this workflow:

TSAC Create Policy

This workflow imports the defined scans into TrueSight Automation Console. 

TSAC GET Policy

This workflow gets the policy ID from TrueSight Automation Console and fetches data from the corresponding policy in CrowdStrike Falcon.