Skip to content

Commit 4aac7c1

Browse files
carlosmmatoscarlosmmatos
committed
docs(fig): update readme to reflect recent changes
1 parent 759d1bb commit 4aac7c1

File tree

1 file changed

+93
-8
lines changed
  • helm-charts/falcon-integration-gateway

1 file changed

+93
-8
lines changed

‎helm-charts/falcon-integration-gateway/README.md

+93-8
Original file line numberDiff line numberDiff line change
@@ -15,24 +15,39 @@ The following tables lists the Falcon Sensor configurable parameters and their d
1515

1616
| Parameter | Description | Default |
1717
| :----------------------------------------------------- | :----------------------------------------------------- | :------------------------- |
18-
| `falcon.client_id` | CrowdStrike API Client ID | None (Required) |
19-
| `falcon.client_secret` | CrowdStrike API Client Secret | None (Required) |
18+
| `falcon.client_id` | CrowdStrike API Client ID | None |
19+
| `falcon.client_secret` | CrowdStrike API Client Secret | None |
2020
| `falcon.cloud_region` | CrowdStrike Cloud Region (us-1, us-2, eu-1, us-gov-1) | None (Required) |
21+
| `falcon.existingSecret` | Existing k8s secret name containing the above values | None |
22+
| `credentials_store.store` | Use valid credentials store (ssm, secrets_manager) | None |
23+
| `credentials_store.ssm.region` | AWS region for SSM | None |
24+
| `credentials_store.ssm.client_id` | SSM parameter name for client_id | None |
25+
| `credentials_store.ssm.client_secret` | SSM parameter name for client_secret | None |
26+
| `credentials_store.secrets_manager.region` | AWS region for Secrets Manager | None |
27+
| `credentials_store.secrets_manager.secret_name` | Secrets Manager secret name | None |
28+
| `credentials_store.secrets_manager.client_id_key` | Secrets Manager key for client_id | None |
29+
| `credentials_store.secrets_manager.client_secret_key` | Secrets Manager key for client_secret | None |
2130
| `falcon.integration_gateway.application_id` | Unique string for each FIG instance within your CID | helm-chart-default |
2231
| `falcon.integration_gateway.level` | Logging level (ERROR, WARN, INFO, DEBUG) | INFO |
2332
| `falcon.integration_gateway.severity_threshold` | Filter events based on severity (1-5) | 2 |
24-
| `falcon.integration_gateway.older_than_days_threshold` | Filter events based on age in days | 14 |
33+
| `falcon.integration_gateway.older_than_days_threshold` | Filter events based on age in days | 21 |
2534
| `falcon.integration_gateway.detections_exclude_clouds` | Exclude events based on cloud origination | None |
2635
| `falcon.integration_gateway.worker_threads` | Number of FIG application threads to process events | 4 |
36+
| `falcon.integration_gateway.offset` | Offset number to start the stream from | 0 |
2737
| `push.aws_security_hub.enabled` | Enable event forwarding to AWS Security Hub | `false` |
2838
| `push.aws_security_hub.region` | AWS Region | None |
39+
| `push.aws_security_hub.confirm_instance` | Confirm instance in AWS account supported region | `true` |
40+
| `push.aws_sqs.enabled` | Enable event forwarding to AWS SQS | `false` |
41+
| `push.aws_sqs.region` | AWS Region | None |
42+
| `push.aws_sqs.sqs_queue_name` | AWS SQS Queue Name | None |
2943
| `push.azure_log_analytics.enabled` | Enable event forwarding to Azure Log Analytics | `false` |
3044
| `push.azure_log_analytics.workspace_id` | | None |
3145
| `push.azure_log_analytics.primary_key` | | None |
3246
| `push.azure_log_analytics.arc_autodiscovery` | | `false` |
3347
| `push.chronicle.enabled` | Enable event forwarding to Google Chronicle | `false` |
34-
| `push.chronicle.region` | | None |
35-
| `push.chronicle.security_key` | | None |
48+
| `push.chronicle.region` | Google Cloud Chronicle Region | None |
49+
| `push.chronicle.service_account` | Google Cloud Service Account | None |
50+
| `push.chronicle.customer_id` | Google Chronicle Customer ID | None |
3651
| `push.cloudtrail_lake.enabled` | Enable event forwarding to AWS CloudTrail Lake | `false` |
3752
| `push.cloudtrail_lake.channel_arn` | CloudTrail Lake Channel for sending events | None |
3853
| `push.cloudtrail_lake.region` | AWS Region | None |
@@ -41,11 +56,10 @@ The following tables lists the Falcon Sensor configurable parameters and their d
4156
| `push.vmware_workspace_one.syslog_host` | | None |
4257
| `push.vmware_workspace_one.syslog_port` | | None |
4358
| `push.vmware_workspace_one.token` | | None |
59+
| `push.generic.enabled` | Enable event forwarding to stdout (debugging) | `false` |
4460
| `serviceAccount.annotations` | Annotations for serviceAccount | `{}` |
4561

46-
## Installation
47-
48-
### API Scopes
62+
## API Scopes
4963

5064
- Obtain OAuth2 API credentials for CrowdStrike Falcon
5165
- Navigate to [API Clients and Keys](https://falcon.crowdstrike.com/support/api-clients-and-keys) within CrowdStrike Falcon platform.
@@ -56,6 +70,77 @@ The following tables lists the Falcon Sensor configurable parameters and their d
5670

5771
> ***Consult the [backend](https://github.com/CrowdStrike/falcon-integration-gateway/tree/main#backends-w-available-deployment-guides) guides for additional API scopes that may be required.***
5872
73+
## Authentication
74+
75+
FIG requires the authentication of an API client ID and client secret, along with its associated cloud region, to establish a connection with the CrowdStrike API.
76+
77+
FIG supports auto-discovery of the Falcon cloud region. If you do not specify a cloud region, FIG will attempt to auto-discover the cloud region based on the API client ID and client secret provided.
78+
79+
> [!IMPORTANT]
80+
> Auto-discovery is only available for [us-1, us-2, eu-1] regions.
81+
82+
Below are a few examples of how to provide the Falcon API credentials to the FIG helm chart.
83+
84+
### Via values.yaml
85+
86+
#### Example declaring the Falcon API credentials directly
87+
88+
```yaml
89+
falcon:
90+
client_id: "YOUR_FALCON_CLIENT_ID"
91+
client_secret: "YOUR FALCON_CLIENT_SECRET"
92+
cloud_region: "us-1"
93+
```
94+
95+
#### Example using AWS Secrets Manager
96+
97+
```yaml
98+
falcon:
99+
cloud_region: "us-1"
100+
credentials_store:
101+
store: "secrets_manager"
102+
secrets_manager:
103+
region: "us-west-2"
104+
secret_name: "falcon-k8s-secret"
105+
client_id_key: "client_id"
106+
client_secret_key: "client_secret"
107+
```
108+
109+
#### Example using an existing k8s secret
110+
111+
```yaml
112+
falcon:
113+
existingSecret: "falcon-k8s-secret"
114+
```
115+
116+
### Via Helm CLI
117+
118+
You can also use the helm CLI to provide the Falcon API credentials.
119+
120+
#### Example specifying the Falcon API credentials directly
121+
122+
```bash
123+
helm upgrade --install falcon-fig crowdstrike/falcon-integration-gateway -n falcon-integration-gateway --create-namespace \
124+
--set falcon.client_id=$FALCON_CLIENT_ID \
125+
--set falcon.client_secret=$FALCON_CLIENT_SECRET \
126+
--set falcon.cloud_region=$FALCON_CLOUD
127+
...
128+
```
129+
130+
#### Example using AWS SSM parameter store as the credentials store
131+
132+
```bash
133+
helm upgrade --install falcon-fig crowdstrike/falcon-integration-gateway -n falcon-integration-gateway --create-namespace \
134+
--set falcon.cloud_region=$FALCON_CLOUD \
135+
--set credentials_store.store="ssm" \
136+
--set credentials_store.ssm.region="us-east-2" \
137+
--set credentials_store.ssm.client_id="/falcon/fig/client_id" \
138+
--set credentials_store.ssm.client_secret="/falcon/fig/client_secret"
139+
...
140+
```
141+
142+
## Installation
143+
59144
### Helm Chart
60145

61146
The helm chart is under active development. Contributors are welcomed to install either directly from the git repository or from the helm repository.

0 commit comments

Comments
 (0)