Latest Version: 2.0 - Release Date: 11/05/2026

This project integrates CrowdStrike Falcon Insight XDR and VMRay FinalVerdict / TotalInsight. It equips customers with extra intel regarding the threats detected by CrowdStrike Falcon Insight XDR on their endpoints. Depending on the configuration, the Connector collects unique SHA256 hash values from:

• Detections
• Quarantines

It then downloads and submits respective samples into the VMRay Analyzer for detonation and deep dynamic analysis. After the submission, it retrieves the verdict and IOC values from VMRay and updates Detection and Quarantine Objects, and creates IOCs.

The connector supports the following VMRay products:

• Final Verdict
• Total Insight

app                             # Main project directory
├─── config                     # Configuration directory
│   └─── __init__.py
│   └─── constants.py           # Shared constants (IOC tags, actions, limits)
│   └─── crowdstrike_conf.py    # CrowdStrike configuration file
│   └─── general_conf.py        # General configuration file
│   └─── vmray_conf.py          # VMRay configuration file
├─── downloads                  # Directory for extracted binaries
├─── lib                        # Library directory
│   └─── __init__.py
│   └─── CrowdStrike.py         # CrowdStrike API functions
│   └─── VMRay.py               # VMRay API functions
│   └─── Sample.py              # Sample class for tracking samples through the pipeline
├─── log                        # Log directory for connector
│   └─── cs-connector.log       # Log file for connector
└─── __init__.py
└─── connector.py               # Main connector application
└─── requirements.txt           # Python library requirements
.env.example                    # Example environment variable file
Dockerfile                      # Docker build file
docker-entrypoint.sh            # Docker container entrypoint script

• Python >3.10 with required packages (Required Packages)
• CrowdStrike Falcon Insight XDR
• VMRay Analyzer
• Docker (optional)

Clone the repository into a local folder.

git clone https://github.com/vmray/crowdstrike-falcon.git

Install the requirements.

pip install -r app/requirements.txt

Copy .env.example to .env and populate your credentials:

# Linux / macOS
cp .env.example .env

# Windows (CMD)
copy .env.example .env

Edit the vmray_conf.py, general_conf.py, and crowdstrike_conf.py files and update with your configurations.

• Create a Custom Access Level with the permissions below with a web interface for API at Create API section. (Support and Resources > API client and keys)

• Edit the CrowdStrikeConfig class in crowdstrike_conf.py file

• Create API Key with web interface. (Analysis Settings > API Keys)

• Edit the VMRayConfig class in vmray_conf.py file.

• Edit the GeneralConfig class in general_conf.py file.

You can start the connector with the command line after completing the configurations. You need to set RUNTIME_MODE as RUNTIME_MODE.CLI in the GeneralConfig. Also, you can create a cron job for continuous processing.

The connector must be run from the app/ directory:

cd app
python connector.py

You can create and start a Docker image with Dockerfile after completing the configurations. You need to set RUNTIME_MODE as RUNTIME_MODE.DOCKER in the GeneralConfig.

docker build -t cs_connector .

# Linux / macOS
docker run -d -v $(pwd)/app/log:/app/log --env-file .env -t cs_connector

# Windows (PowerShell)
docker run -d -v ${PWD}/app/log:/app/log --env-file .env -t cs_connector

# Windows (CMD)
docker run -d -v %cd%/app/log:/app/log --env-file .env -t cs_connector

After running the Docker container, you can see connector logs in the log directory on your host machine.