Skip to content

CSOAR-5038:CrowdStrike Falcon Intelligence Integration update #6853

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mahendrak-sumo merged 2 commits into from
Jun 30, 2026
Merged

CSOAR-5038:CrowdStrike Falcon Intelligence Integration update #6853

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d65804b
CSOAR-5038:CrowdStrike Falcon Intelligence Integration update
shreyashnaik-sumo Jun 30, 2026
fc5940e
CSOAR-5038:comment resolved
shreyashnaik-sumo Jun 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 19 additions & 2 deletions .../automation-service/app-central/integrations/crowdstrike-falcon-intelligence.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@ import useBaseUrl from '@docusaurus/useBaseUrl';

<img src={useBaseUrl('/img/platform-services/automation-service/app-central/logos/crowdstrike-falcon-intelligence.png')} alt="CrowdStrike Falcon Intelligence icon" width="100"/>

***Version: 1.8
Updated: March 31, 2026***
***Version: 1.9
Updated: June 30, 2026***

CrowdStrike® Falcon Intelligence™ is an automated threat intelligence service built on the CrowdStrike Falcon Platform. It automates incident investigations and streamlines breach response so you can make faster, more confident cyber security decisions. Organizations, regardless of size or sophistication, learn from the attacks in their environment applying that knowledge to proactively prevent future attacks. Falcon Intelligence provides insight into global threats, tracked by CrowdStrike’s elite team of intelligence experts.

Expand All @@ -30,6 +30,22 @@ CrowdStrike® Falcon Intelligence™ is an automated threat intelligence service
* **Submit File** (*Enrichment*) - Submit a file for sandbox analysis. The time required for analysis varies but is usually less than 15 minutes, by using the **Submission Status Polling** action.
* **Submit URL** (*Enrichment*) - Submit a URL for sandbox analysis. The time required for analysis varies but is usually less than 15 minutes, by using the **Submission Status Polling** action.

## Sandbox Environments

The following sandbox environments are available for file and URL analysis:

| ID | Environment | Status |
|---|---|---|
| 430 | macOS Tahoe ARM | Current |
| 400 | macOS Catalina 10.15 | Deprecated → falls back to 430 |
| 330 | Linux Ubuntu 24, 64-bit | Current |
| 310 | Linux Ubuntu 20, 64-bit | Deprecated → falls back to 330 |
| 200 | Android (static analysis) | Current |
| 140 | Windows 11, 64-bit | Current |
| 160 | Windows 10, 64-bit | Current |
| 110 | Windows 7, 64-bit | Current |
| 100 | Windows 7, 32-bit | Current |

## CrowdStrike Falcon Intelligence configuration

Create API clients to grant various levels of API access for Falcon Intelligence.
Expand Down Expand Up @@ -85,3 +101,4 @@ For information about CrowdStrike Falcon Intelligence, see [CrowdStrike document
* June 30, 2023 (v1.5) - Updated the integration with Environmental Variables
* March 4, 2024 (v1.7) - Updated code for compatibility with Python 3.12
* March 31, 2026 (v1.8) - Upgraded the `python3_generic` Docker image (Python 3.8) to `python3_12_generic` (Python 3.12) to address Python 3.8 end-of-life and improve security and performance.
* June 30, 2026 (v1.9) - Updated the available sandbox environments to align with the latest platform support. Ubuntu 16.04 has been removed, Ubuntu 20 is now deprecated, and Ubuntu 24 has been added