Non Cloud VM detection doesn't get processed (But does by SIEM)

[MrCNeale]

Background
Installed CS agent on ARC based remote VM, non cloud hosted.
Triggered detection

Expected result
FIG would read detection and write to Log Analytics in Azure

Observed Result
No entry written to falconintegration log in LogAnalytics
Nothing in Debug Log apart from "fig cs_refresh DEBUG Refresh of streaming session succeeded"

Additional tests/debug/info
Expected result occurs for same detection type on a Cloud (Azure) hosted VM.
Debug Log shows detection for Cloud(Azure) hosted VM.
FIG Version 3.0.6*
*(I think...not sure how to query the running container to get version. We deploy it from a private repo, not latest quay.io image)
ARC (non-cloud) VM detection shows in Falcon Portal
ARC VM detection shows in SIEM server logs and in Log Analytics (scraped by OMS Agent custom log).

Despite Debug Mode we don't see any failure based on the flow diagram in
https://github.com/CrowdStrike/falcon-integration-gateway/blob/main/docs/developer_guide.md

[MrCNeale]

After digging.
I believe it's due to
class Runtime():
RELEVANT_EVENT_TYPES = ['DetectionSummaryEvent']

def __init__(self):
    log.info("Azure Backend is enabled.")

def is_relevant(self, falcon_event): return falcon_event.cloud_provider == 'AZURE'
Can a way be added to override the filter, e.g. "ALL" or "" ?
Not sure what, if anything is returned in your second query to find the cloud provider for an ARC vm.

[MrCNeale]

Final comment/improvement request.
Ability to specify allowed types, AWS/GCP/AZURE/None
And a preferred output, e.g. output to Log Analytics.

Another option is "how does the metadata get populated in the hosts api?"
as from an AWS/VMware VM, that is running ARC agent, you can query (like the azure metadata service) another agent to find out what cloud it's in.

[isimluk]

Hello Chris,

I am closing this issue as falcon-integration-gateway 3.1.5 has been released with Azure Arc support.

FIG with Azure Arc support will perform RTR based autodiscovery of Azure Arc settings on systems outside Azure.

To enable this functionality please:

• set arc_autodiscovery=true inside [azure] section in your config.ini
• grant extra Falcon permission to API keys

  Real Time Response: [Read, Write]
  

Please let me know if anything else can be done on this front.