feat: Crowdstrike pack (#540)

* feat: a pack for crowdstrike * chore: we now require panther_analysis_tool of at least 0.16.1
panther-labs · Oct 25, 2022 · 6c9dfe7 · 6c9dfe7
1 parent 14f0b28
commit 6c9dfe7
Show file tree

Hide file tree

Showing 3 changed files with 81 additions and 58 deletions.
diff --git a/Pipfile b/Pipfile
@@ -10,7 +10,7 @@ click = "~=8.1"
 decorator = "~=5.1"
 isort = "~=5.10.0"
 mypy = "~=0.950"
-panther-analysis-tool = "*"
+panther-analysis-tool = "~=0.16.1"
 pylint = "~=2.15.0"
 pylint-print = "~=1.0.0"
 

diff --git a/Pipfile.lock b/Pipfile.lock
diff --git a/packs/crowdstrike.yml b/packs/crowdstrike.yml
@@ -0,0 +1,12 @@
+AnalysisType: pack
+PackID: PantherManaged.Crowdstrike
+Description: Group of all Crowdstrike detections
+PackDefinition:
+  IDs:
+    - Crowdstrike.Detection.passthrough
+    - Crowdstrike.DNS.Request
+    # Standard.MaliciousSSODNSLookup requires configuration and is disabled-by-default
+    - Standard.MaliciousSSODNSLookup
+    # Globals used in these detections
+    - panther_base_helpers
+DisplayName: Panther Crowdstrike Pack