TISC CrowdStrike Custom Feed - Internal Field Mapping - Support and Troubleshooting

TISC CrowdStrike Custom Feed - Internal Field Mapping Summary .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } This KB outlines the field mapping for the data ingested as part of CrowdStrike Feed.

Observable Fields stored in the sn_sec_tisc_observable_source table when processing CrowdStrike Indicator data:

CrowdStrike Indicator Field(s) Observable Field CrowdStrike Id External Source ID Kill Chain Attack Phases Mapped from Malicious Confidence attribute

Malicious Confidence Reputation Value High, Medium, Low Malicious Unverified Unknown Reputation Mapped from Malicious Confidence attribute

Malicious Confidence Threat Severity Value High Critical Medium High Low Medium Unverified Low Threat Severity Indicator Value Published Date First Seen Malware Families Threat Types Vulnerabilities

Additional Context Published Date

Created Time in Source Last Updated Date

Modified Time in Source Note: The "Confidence" field for TISC Observable is determined by the setting "Mapping of Indicator malicious confidence" in the Additional Settings tab. If this setting is not configured, the Confidence value is taken from the feed configuration. Threat Actor Fields stored in the sn_sec_tisc_threat_actor_source table when processing CrowdStrike Actor data:

CrowdStrike Actor Field(s) Threat Actor Field Name + CrowdStrike Id External Source ID Community Identifiers Aliases Description Description First Seen Date First Seen Objectives (API field) Goals Last Seen Date Last Seen Name Name (first-entry) Motivations Primary Motivation (remaining-entries) Motivations Secondary Motivations Origins Target Countries Target Industries Capabilities Target Regions Additional Context Capabilities (API field) Sophistication Created Date Created Time in Source Last Modified Date Modified Time in Source Threat Report Fields stored in the sn_sec_tisc_threat_report_source table when processing CrowdStrike Report data:

CrowdStrike Report Field(s) Threat Report Field CrowdStrike Id External Source ID Name Name Published Date Published Report Type Report Types Description Description Tags TISC Tags Target Industries Actors Target Countries Motivations Additional Context Created Date Created Time in Source Last Modified Date Modified Time in Source Note: The "Confidence" field for Threat Actor and Threat Report is taken from the feed configuration.

On the configuration page for the CrowdStrike feed, the Fetch Date From field serves as a filter for the Last Modified Date or Last Updated Date from the CrowdStrike API. This allows Indicators, Actors, or Reports to be retrieved from that specified timestamp onward.