How-To: Export your Cloud PKI Logs to CrowdStrike Falcon

EZCA enables your security team to monitor critical user actions by pushing the information to your SIEM. In this page we will show you how to connect your Cloud PKI logs to CrowdStrike Falcon.

Prerequisites

How To Export Your Cloud PKI Audit Logs to CrowdStrike Falcon

To export your EZCA logs to CrowdStrike Falcon, you will need to enable Audit Log exports in your EZCA subscription, set up your CrowdStrike Falcon environment with the proper endpoint, and then establish a connection from EZCA to CrowdStrike Falcon. The following steps will walk through how to set this up.

How To Enable Log Export in EZCA Portal

  1. Go to the EZCA Portal.

  2. Click on Settings.

    EZCA Cloud PKI Dashboard with Settings option highlighted in the navigation menu

  3. Expand your subscription’s Advanced Settings.

    EZCA Cloud PKI subscription settings page with Advanced Settings section collapsed and expand arrow visible

  4. Enable the Send Audit Logs to SIEM option.

    EZCA Cloud PKI Advanced Settings panel with Send Audit Logs to SIEM checkbox highlighted in red

How to Configure the CrowdStrike Falcon SIEM in EZCA Portal

To complete the connection in EZCA you’ll need to configure your SIEM settings in CrowdStrike Falcon first. Follow these steps to set up EZCA log imports.

How to Create a CrowdStrike Falcon Next-Gen SIEM HEC Data Connector

  1. In another tab, log into CrowdStrike Falcon.

  2. From the left-hand nav menu, click Next-Gen SIEM.

    Navigate to Next-Get SIEM in CrowdStrike Falcon

  3. Under Log management click Data onboarding.

    Navigate to Data Onboarding in Next-Gen SIEM

  4. Click Add connection.

    Click Add Connection button in Next-Gen SIEM

  5. Find and select HEC/HTTP Event Data Connector.

  6. Click Configure.

    New Connection Dialog configure Data Connector in Next-Gen SIEM

  7. Fill in the Connection name.

  8. Under Parsing and enrichment click Create new parser.

    How to Creating a New Parser in Next-Gen SIEM for EZCA

  9. Change the dropdown from Blank template to Import.

  10. Download the EZCA parser template: keytos-ezca.yaml

    Note: This is a template parser for EZCA that is designed to be used as a starting point for your final parser. It is intentionally bare-bones so it can be customized to your needs.

  11. Click Upload file to upload the provided parser.

    How to Upload a New Parser in Next-Gen SIEM for EZCA

  12. Name the parser and click Create.

  13. Check the Terms and Conditions box.

  14. Click Create connection.

  15. Click Close.

  16. It will take a few seconds for the connector to be ready to receive data. Reload the page every few seconds until you see a prompt to Generate API key.

    How to Generate API key in Next-Gen SIEM

  17. Click Generate API key. (This page can only be opened during setup so record you API key.)

  18. Copy your API Key and your API URL.

How to Add Your Next-Gen SIEM HEC Connection Details in EZCA

  1. Go back to your EZCA tab.

  2. Select Splunk Cloud as the SIEM Provider, as Splunk uses the same HTTP Event Collector (HEC) log format used by Next-Gen SIEM.

  3. Paste your API key in Workspace Key.

  4. In EZCA, paste your API URL in Splunk URL. It should look something like this.

    EZCA with Advanced Settings Expanded showing Configuration for Next-GEN SIEM

  5. Click the Test Connection button, this will create a test log in Next-Gen SIEM to make sure EZCA can write to Next-Gen SIEM.

  6. If the connection test was successful, click Save changes at the top of the page.

How To Create a CrowdStrike Falcon LogScale SIEM Data Connector

  1. In another tab, go to your CrowdStrike Falcon LogScale instance.

  2. Click on the Settings tab.

  3. Select the Ingest Tokens menu.

  4. Click on the Add Token button.

    Create Ingest Token in CrowdStrike Falcon LogScale

  5. Enter the token name.

  6. Assign the json parser and click Create.

    Create json parser in CrowdStrike Falcon LogScale

  7. Copy the token and the ingest host name.

    Copy the CrowdStrike Falcon LogScale token for EZCA

How to Add Your LogScale Connection Details in EZCA

  1. Go back to the EZCA tab.

  2. Select CrowdStrike Falcon LogScale as the SIEM Provider.

    Set CrowdStrike Falcon LogScale as the SIEM in EZCA

  3. Paste the ingest host name in the Ingestion Endpoint field.

  4. Paste the token in the Ingestion Token field.

  5. Click the Test Connection button, this will create a test log in LogScale to make sure EZCA can write to LogScale.

    EZCA Advanced Settings showing CrowdStrike Falcon LogScale SIEM configuration with Test Connection button highlighted

  6. If the connection test was successful, click Save changes at the top of the page.

    EZCA Advanced Settings showing CrowdStrike Falcon LogScale SIEM configuration with Save Changes button highlighted

How To Create Alerts in CrowdStrike Falcon LogScale to Monitor Your Cloud PKI Activity

We recommend setting up alerts for any high criticality event, and closely monitor medium and low events. Here are some example queries to get you started:

Certificate Request Denied (Event ID 4888)

Certificate request denied is an event that is created when a user requests a certificate that they do not have permission to request. It is important to alert on this event since it can be an attacker attempting to escalate privileges by requesting a certificate.

LogType = "EZCA_Certificates" and EventID = 4888

CA Permission Changed (Event ID 4882)

CA Permission Changed is an event that is created when a user changes the security permissions for a CA. This event should be monitored since it is a low frequency high impact action that could indicate a compromise to your PKI administrator’s accounts.

LogType = "EZCA_CAs" and EventID = 4882

CA Changes Denied (Event ID 92)

CA Permission Denied is an event that is created when a user attempts to change the security permissions for a CA without having the proper security permissions. It is important to alert on this event since it can be an attacker attempting to escalate privileges by changing the security configuration of your certificate authority.

LogType = "EZCA_CAs" and EventID = 92

Deleted CA (Event ID 19)

CA Deleted is an event that is created when a user deletes a CA. This event should be monitored since it is a low frequency high impact action that could indicate a compromise to your PKI administrator’s accounts.

LogType = "EZCA_CAs" and EventID = 19

What Logs are Sent to CrowdStrike Falcon?

EZCA sends the following log types to your SIEM:

CA Operation Events

Event ID Event Summary Description Potential Criticality
4882 The security permissions for Certificate Services changed A change in CA settings that might give or remove critical permissions High
92 CA change denied due to insufficient permissions A user attempted to change CA settings without the proper permissions High
23 Intermediate CA request rejected A new Intermediate CA request has been rejected High
19 CA deleted This indicates that a CA was deleted High
28 Intermediate CA was imported A new Intermediate CA has been created chaining to an external CA Medium
22 Intermediate CA created with EZCA Root A new Intermediate CA has been created chaining to an EZCA CA Medium
12 CA was renewed A CA has been renewed Low

Certificate Operation Events

Event ID Event Summary Description Potential Criticality
4888 Certificate request denied due to insufficient permissions A user attempted to request a certificate without the proper permissions High
4870 A certificate has been revoked This can cause an outage if was done by mistake or the new certificate is not added to all the endpoints that use the certificate Medium
4872 Publish CRL This is an even that the CRL has been published, this does not have to be tracked as we take care of it for you. Low
4887 Certificate was created This event indicates a certificate was created successfully Low