Discover CrowdStrike/VirtualGHOST Open Source project by @CrowdStrike

AutoMacTC: Automated Mac Forensic Triage Collector

696

automactc

The CrowdStrike Falcon SDK for Python

491

falconpy

PowerShell for CrowdStrike's OAuth2 APIs

348

psfalcon

Scripts and code referenced in CrowdStrike blog posts

346

Forensics

Visualize hierarchical timeline data. Built with Ember.js and D3.js

325

Tortilla

281

ember-timetree

A python script developed to process Windows memory images based on triage type.

273

SuperMem

Auxiliary documentation and scripts around "A Reasonably Safe Travel Burner Laptop"

258

travel-laptop

C++

225

falcon-orchestrator

CrowdStrike Falcon Orchestrator provides automated workflow and response capabilities

The CrowdDetox plugin for Hex-Rays automatically removes junk code and variables from Hex-Rays function decompilations.

181

CrowdDetox

C++

157

cs-bro

Bro scripts written by CrowdStrike Services

Zeek

147

Cloud-AWS

A collection of projects supporting AWS Integration

This repository contains Community and Field contributed content for LogScale

141

logscale-community-content

CrowdStrike Feed Management System. CrowdFMS is a framework for automating collection and processing of samples from VirusTotal, by leveraging the Private API system. This framework automatically downloads recent samples, which triggered an alert on the users YARA notification feed.

131

CrowdFMS

CrowdStrike's Protocol Buffers library

123

csproto

122

falcon-scripts

Scripts to streamline the deployment and use of the CrowdStrike Falcon sensor

Unleash the power of the Falcon Platform at the CLI

117

Falcon-Toolkit

Welcome to the Falcon Query Assets GitHub page.

108

falcon-query-assets

Comprehensive toolkit for streamlining your interactions with the CrowdStrike Falcon platform.

ansible_collection_falcon

CrowdStrike Archive Scan Tool

xwf-yara-scanner

CAST

Tensorflow to Rust is a tool to convert trained Tensorflow models to pure Rust code.

tf2rust

Helm Charts for running CrowdStrike Falcon with Kubernetes

falcon-helm

Smarty

gofalcon

Golang-based SDK to CrowdStrike's APIs

pyspresso

The pyspresso package is a Python-based framework for debugging Java.

Services for interacting with browser APIs so that you can have fine-grained control in tests.

falcon-operator

ember-browser-services

Import CrowdStrike Threat Intelligence into your instance of MISP

MISP-tools

The hero we all need to defeat the kraken that is Go module dependency graphs

detection-container

PHP

perseus

gotel

GoTel - Scheduled job monitoring

community

CrowdStrike's Open Source Policy & Contribution Guide

HTML

falcon-windows-host-recovery

Automated Windows host recovery

Rich Text Format

caracara

Developer enhancements (DX) for FalconPy, the CrowdStrike Python SDK

Code to scan a container with CrowdStrike and return response codes indicating pass/fail status.

container-image-scan

Automation to help create container images pre-loaded with the CrowdStrike Falcon sensor.

Dockerfiles

Mitre chopshop network decoder framework

chopshop

FDR

Falcon Data Replicator

A different take on WebDriver browser testing

faltest

Headless forms with a11y and validation support built in

ember-headless-form

Discover for Cloud and Containers Azure

Cloud-Azure

Code for the paper "EMBERSim: A Large-Scale Databank for Boosting Similarity Search in Malware Analysis"

embersim-databank

Go package implementing Age-Partitioned Bloom Filters (APBF)

apbf

go-metrics-sliding-window

A sliding window sampling implementation for the rcrowley/go-metrics library.

ember-headless-table

ARIA utilities for helping create some of the more complex ARIA design patterns. Follows https://www.w3.org/TR/wai-aria-practices/

ember-aria-utilities

proof-of-concept example of using eBPF to Monitor for eBPF Map tampering

bpfmon-example

falcon-windows-repair

Scripts to aid in diagnosing and repairing unhealthy Windows Falcon Sensor installations

Resources for async functions in Ember

ember-resource-tasks

Falcon Integration Gateway (FIG)

falcon-integration-gateway

Cloud deployment size calculation utilities

cloud-resource-estimator

Support for in/inter page linking / scrolling with hashes in EmberJS

ember-url-hash-polyfill

Tensorflow Layers provides Rust implementations of Tensorflow model layers

tf-layers

Rust

tailwind-toucan-base

Base Tailwind config for the Toucan design system.

aws-ssm-distributor

Data Analytics Library for Python

omigo-data-analytics

List of helpful publicly available CrowdStrike material.

helpful-links

ivan

Falcon Image Vulnerability Analysis (IVAN) is a command-line image assessment tool.

container-image-scan-action

CrowdStrike Container Image Scan Github Action

This is the integration to feed Falcon X IOC data into zscaler's platform

zscaler-FalconX-integration

Ember Velcro sticks one element to another with Floating UI.

ember-velcro

OWASSRF

Kafka replicator is a tool used to mirror and backup Kafka topics across regions

kafka-replicator

falconjs

CrowdStrike Falcon API JS library for the browser and Node

Rust bindings for CrowdStrike Falcon API

rusty-falcon

Rust

Identity-Protection

Detach monorepo packages from normal linking

monorepo-next

NotPetyaDecryptor

ember-toucan-core

aws-security-lake

Integration guide for CrowdStrike and Amazon Security Lake

Module to manage CrowdStrike Falcon Sensor and the Kubernetes Protection Agent on a Kubernetes cluster.

puppet-falcon

Ruby

terraform-kubectl-falcon

A collection of projects supporting GCP integration

Cloud-GCP

https://registry.terraform.io/providers/CrowdStrike/crowdstrike/latest/docs

terraform-provider-crowdstrike

cloud-tools-image

Command-line tools for remote communication with public and private cloud environments.

Integration details between CrowdStrike Falcon Zero Trust Assessments (ZTA) and AWS Verified Access

aws-verified-access

HEC-Log-Shipper

This repository contains examples of code used to send data to Humio instances

image-scan-example

Container-Security

Event driven solution to automatically hide hosts from CrowdStrike upon termination.

cloud-scripts-hide-host

Scalable RTR sample Foundry app

foundry-sample-scalable-rtr

A Shiny Ruby SDK of our Falcon API

foundry-fn-go

crimson-falcon

Ruby

ember-toucan-styles

Ember wrapper, CSS, and JS utilities for working with the Toucan design system

ember-three

Ember.js three.js shim

Triage with MITRE Attack sample Foundry app

foundry-sample-mitre

CSS

foundry-sample-rapid-response

Rapid Response sample Foundry app

LogScale Azure Event Hub Collector

falcon-cli

logscale-azure-event-hub-collector

cloud-pov

devdays

cs.aws_account

chronicle-intel-bridge

CrowdStrike to Chronicle Intel Bridge

Plug-in to kubectl command-line tool that helps with manipulation of Falcon Container.

kubectl-falcon

upb-cloud-workshop

A cloud workshop organised by Crowdstrike in Bucharest, Romania for the students of Universitatea Politehnica Bucharest

opensource.crowdstrike.com

CrowdStrike-Spotlight-Humio-Package-Integration

Ember.js number-to-words shim

ember-number-to-words-shim