Skip to content

[CrowdStrike] Handle deprecating Threat fields #15856

@navnit-elastic

Description

@navnit-elastic

The crowdstrike.falcon integration is using TacticId, TacticIds, Tactic, Tactics, TechniqueId, TechniqueIds Technique and Techniques fields to populate threat.* ECS fields for various detection events.

According to CrowdStirke documentation these fields are deprecated and these fields are moved under MitreAttack object.

Though the deprecating fields are still show up in the live logs, It would be good to switch to the recommended fields.

Deprecating note and schema for MitreAttack object:
Image

Metadata

Metadata

Labels

Integration:crowdstrikeCrowdStrikeTeam:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]Team:Sit-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]enhancementNew feature or request

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions