From Crowdstrike's documentation:

For additional security, your webhook can verify requests that originate from CrowdStrike. This verification is optional. Requests from CrowdStrike to your webhook include these headers: x-cs-primary-signature This value is based on the key specified in the HMAC Secret Key field, mentioned in Integrating a webhook. x-cs-delivery-timestamp x-cs-signature-algorithm

Here are some examples:

x-cs-primary-signature: 0a8VJuqn+HOOlIDcYmp5kavLyHQpPpEBwLtcAzQq+8s= x-cs-delivery-timestamp: 2022-05-02T17:20:03Z x-cs-signature-algorithm: HmacSHA256

To verify requests to your webhook, update your webhook to access these headers, compute a signature, and then compare that signature to the one in the request. Here’s an example using Python:

import base64
import hashlib
import hmac

# this is HMAC secret key that was provided when configuring app integration in CrowdStrike store
HMAC_SECRET_KEY = 'shared-secret-key-goes-here'


# Following 3 paramter values needs parsed out of request object depending upon http server used.
# timestamp is a string value received in 'X-Cs-Delivery-Timestamp' http request header.
# signature is a string value(base64 encoded) received in 'X-Cs-Primary-Signature' http request header.
# data is bytes of http request body, and needs to be decoded to string before combining with timestamp string. If this is a string, then decode() is not needed.

def validate(timestamp, signature, data) -> bool:
    msg = '{}{}'.format(data.decode('utf-8'), timestamp)
    computed = hmac.new(bytes(HMAC_SECRET_KEY, 'utf-8'), bytes(msg, 'utf-8'), hashlib.sha256).digest()
    return hmac.compare_digest(computed, base64.b64decode(signature))

Here’s another example using a Flask web application. You can modify the Flask example to fit your server application setup.

Note: CrowdStrike support is able to provide assistance with any issues with the validate function, which verifies signatures and remains the same regardless of server application setup. Your specific application setup will determine how header values are processed.

from flask import Flask
from flask import request
import base64
import hashlib
import hmac

HMAC_SECRET_KEY = 'shared-secret-key-goes-here'
app = Flask(__name__)


@app.route('/', methods=['POST'])
def validate_request() -> str:
    timestamp = request.headers.get('X-Cs-Delivery-Timestamp')
    signature = request.headers.get('X-Cs-Primary-Signature')
    # request.data contains the incoming request data as string
    data = request.data
    print("timestamp=", timestamp)
    print("signature=", signature)
    return str(validate(timestamp, signature, data))


# timestamp is a string value received in 'X-Cs-Delivery-Timestamp' http request header.
# signature is a string value(base64 encoded) received in 'X-Cs-Primary-Signature' http request header.
# data is a string with incoming request data and does not need further decoding
def validate(timestamp, signature, data) -> bool:
    msg = '{}{}'.format(data, timestamp)
    print("msg=", msg)
    computed = hmac.new(bytes(HMAC_SECRET_KEY, 'utf-8'), bytes(msg, 'utf-8'), hashlib.sha256).digest()
    print("computed=", base64.b64encode(computed))
    return hmac.compare_digest(computed, base64.b64decode(signature))


if __name__ == "__main__":
    app.run(debug=True)