
Summary
The Crowdstrike Detection Summary rule is designed as a threat detection mechanism that forwards alerts generated from the CrowdStrike EPP (Endpoint Protection Platform) to designated Panther destinations. This rule aids in monitoring potentially harmful activities on systems by capturing various event types categorized by their severity: Low, Medium, High, and Critical. Each generated alert comes with detailed information regarding the event, including timestamps, affected files, and links for further investigation on the CrowdStrike console. The alerting mechanism is set to deduplicate events within a 60-minute window, to prevent unnecessary alerts for repeated detections of the same issue. Overall, it serves as an important integration point for threat intelligence and incident response activities.
Categories
- Endpoint
- Windows
- Cloud
Data Sources
- Process
- User Account
- File
- Network Traffic
- Application Log
Created: 2024-12-06