Skip to content

Commit

Permalink
docs: update readme with toc and new version info
Browse files Browse the repository at this point in the history
  • Loading branch information
carlosmmatos committed Dec 20, 2024
1 parent d672c68 commit a3a1bf6
Showing 1 changed file with 39 additions and 15 deletions.
54 changes: 39 additions & 15 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,13 +1,33 @@
![CrowdStrike](https://raw.githubusercontent.com/CrowdStrike/falcon-integration-gateway/main/docs/assets/cs-logo.png)

# falcon-integration-gateway [![Python Lint](https://github.com/CrowdStrike/falcon-integration-gateway/actions/workflows/linting.yml/badge.svg)](https://github.com/CrowdStrike/falcon-integration-gateway/actions/workflows/linting.yml) [![Container Build on Quay](https://quay.io/repository/crowdstrike/falcon-integration-gateway/status "Docker Repository on Quay")](https://quay.io/repository/crowdstrike/falcon-integration-gateway)
# falcon-integration-gateway [![Python Lint](https://github.com/CrowdStrike/falcon-integration-gateway/actions/workflows/linting.yml/badge.svg)](https://github.com/CrowdStrike/falcon-integration-gateway/actions/workflows/linting.yml) [![Container Build on Quay](https://quay.io/repository/crowdstrike/falcon-integration-gateway/status "Docker Repository on Quay")](https://quay.io/repository/crowdstrike/falcon-integration-gateway) ![PyPI](https://img.shields.io/pypi/v/falcon-integration-gateway)

Falcon Integration Gateway (FIG) forwards threat detection findings and audit events from the CrowdStrike Falcon platform to the [backend](fig/backends) of your choice.

Detection findings and audit events generated by CrowdStrike Falcon platform inform you about suspicious files and behaviors in your environment. You will see detections on a range of activities from the presence of a bad file (indicator of compromise (IOC)) to a nuanced collection of suspicious behaviors (indicator of attack (IOA)) occurring on one of your hosts or containers. You can learn more about the individual detections in [Falcon documentation](https://falcon.crowdstrike.com/support/documentation/40/mitre-based-falcon-detections-framework).

This project facilitates the export of the individual detections and audit events from CrowdStrike Falcon to third-party security dashboards (so called backends). The export is useful in cases where security operation team workflows are tied to given third-party solution to get early real-time heads-up about malicious activities or unusual user activities detected by CrowdStrike Falcon platform.

## Table of Contents

- [Python Compatibility](#python-compatibility)
- [API Scopes](#api-scopes)
- [Authentication](#authentication)
- [Direct Configuration](#direct-configuration)
- [Environment Variables](#environment-variables)
- [Credential Store](#credential-store)
- [Configuration](#configuration)
- [Deployment](#deployment)
- [Backends w/ Available Deployment Guide(s)](#backends-w-available-deployment-guides)
- [Alternative Deployment Options](#alternative-deployment-options)
- [Installation to Kubernetes using the helm chart](#installation-to-kubernetes-using-the-helm-chart)
- [With Docker/Podman](#with-dockerpodman)
- [From the Python Package Index (PyPI)](#from-the-python-package-index-pypi)
- [From Git Repository](#from-git-repository)
- [Developers Guide](#developers-guide)
- [Statement of Support](#statement-of-support)


## Python Compatibility

> [!IMPORTANT]
Expand Down Expand Up @@ -94,7 +114,9 @@ secrets_manager_client_secret_key = client_secret_key_name

Please refer to the [config.ini](./config/config.ini) file for more details on the available options along with their respective environment variables.

## Backends w/ Available Deployment Guide(s)
## Deployment

### Backends w/ Available Deployment Guide(s)

| Backend | Description | Deployment Guide(s) | General Guide(s) |
|:--------|:------------|:--------------------|:-------------------|
Expand All @@ -106,15 +128,15 @@ Please refer to the [config.ini](./config/config.ini) file for more details on t
| Workspace ONE | Pushes events to VMware Workspace ONE Intelligence | *Coming Soon* | [Workspace ONE backend](fig/backends/workspaceone) |
| Generic | Displays events to STDOUT (useful for dev/debugging) | N/A | [Generic Backend](fig/backends/generic) |

## Alternative Deployment Options
### Alternative Deployment Options

> :exclamation: Prior to any deployment, ensure you refer to the [configuration options](./config/config.ini) available to the application :exclamation:
### Installation to Kubernetes using the helm chart
#### Installation to Kubernetes using the helm chart

Please refer to the [FIG helm chart documentation](https://github.com/CrowdStrike/falcon-helm/tree/main/helm-charts/falcon-integration-gateway) for detailed instructions on deploying the FIG via helm chart for your respective backend(s).

### With Docker/Podman
#### With Docker/Podman

To install as a container:

Expand Down Expand Up @@ -142,12 +164,14 @@ To install as a container:
docker logs <container>
```

### From the Python Package Index (PyPI)
#### From the Python Package Index (PyPI)

> [!IMPORTANT]
> Falcon Integration Gateway (FIG) versions below 3.2.1 on PyPI are broken and will not install correctly. Please ensure you install version 3.2.1 or higher from PyPI.
Falcon Integration Gateway (FIG) is available on the [Python Package Index](https://pypi.org/project/falcon-integration-gateway/).

> [!WARNING]
> Falcon Integration Gateway (FIG) versions below 3.2.2 on PyPI are broken and will not install correctly. Please ensure you install version 3.2.2 or higher from PyPI.

1. Install the package using pip:
1. Install the package:

```bash
python3 -m pip install falcon-integration-gateway
Expand Down Expand Up @@ -178,15 +202,15 @@ To install as a container:
python3 -m fig
```

#### Updating the FIG from PyPI
##### Updating the FIG from PyPI

To update the FIG package from PyPI, run:

```bash
python3 -m pip install --upgrade falcon-integration-gateway
python3 -m pip install falcon-integration-gateway --upgrade
```

### From Git Repository
#### From Git Repository

> [!NOTE]
> This method requires Python 3.7 or higher and a python package manager such as `pip` to be installed on your system.
Expand All @@ -212,11 +236,11 @@ python3 -m pip install --upgrade falcon-integration-gateway
python3 -m fig
```

#### Updating the FIG from the Git Repository
##### Updating the FIG from the Git Repository

Depending on which configuration method you are using, follow the steps below to update the FIG from the Git repository.

##### config.ini
###### config.ini

If you have made any changes to the `config.ini` file, you can update the FIG by following these steps:

Expand All @@ -242,7 +266,7 @@ python3 -m fig

This method ensures that your configuration settings are preserved while updating the FIG to the latest version.

#### Environment Variables (only)
##### Environment Variables (only)

If you are only using environment variables to configure the FIG, you can update the FIG by following these steps:

Expand Down

0 comments on commit a3a1bf6

Please sign in to comment.