CrowdStrike Falcon Intelligence Add-on
Splunk Cloud
This app has been archived. Learn more about app archiving.
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Details
NOTE THIS ADD-ON HAS BEEN REPLACED:
CUSTOMERS USING SPLUNK V8.X AND CROWDSTRIKE'S OAUTH2 APIS SHOULD DEPLOY THIS ADD-ON: https://splunkbase.splunk.com/app/5083/
CrowdStrike Falcon Intelligence Add-on use to fetch data from Falcon Intelligence and indexes it in Splunk for further analysis.
CUSTOMERS USING SPLUNK V8.X AND CROWDSTRIKE'S OAUTH2 APIS SHOULD DEPLOY THIS ADD-ON: https://splunkbase.splunk.com/app/5083/
CrowdStrike Falcon Intelligence Add-on use to fetch data from Falcon Intelligence and indexes it in Splunk for further analysis.
CrowdStrike Falcon Intelligence Add-on
OVERVIEW
CrowdStrike Falcon Intelligence Add-on use to fetch data from Falcon Intelligence and indexes it in Splunk for further analysis.
- Author - CrowdStrike
- Version - 1.0.0
- Build - 1
- Creates Index - False
- Compatible with:
- Splunk Enterprise version: 6.4.x, 6.5.x, 6.6.x, 7.0.x and 7.1.x
- OS: Platform independent
RELEASE NOTES
- Version 1.0.0
- Account setup to fetch data from Falcon Intelligence.
APPLICATION SETUP
-
On Splunk Forwarder:
- Install the TA bundle on Splunk Forwarder as mentioned under installation section.
- Navigate to CrowdStrike Falcon Intelligence Add-on, click on "Configuration" and add "Account" with authorized credentials.
- Click on "Input" and fill the "Account", "Interval" and "Starting Date" fields, using which REST API Calls will be called.
- In case needed index name can also be updated here to drive data into specific index name.
- Splunk Indexer’s IP address needs to be given in outputs.conf to send data to specific Splunk Indexer.
- Restart the instance once and that should start pushing data onto the Splunk Indexer.
-
On Splunk Indexer Nodes:
- On Splunk Indexer, No TA configurations are needed. In case of custom Index, the custom Index should be created.
-
On Splunk Search Head:
- On Splunk Search head, Install TA but configurations are not needed.
** Note: By default, all data is indexed to the main index. If you want to use a custom index then kindly update "cs_get_intelligence_index" macro in CrowdStrike Falcon Intelligence Add-on.
TROUBLESHOOTING
A good test to see that you are receiving all of the data we expect is to run below search after several minutes:
- Execute below search in case TA-crowdstrike_falcon_intel Addon has been installed and configured.
searchcs_get_intelligence_index| stats count by sourcetype
In particular, you should see below sourcetype:
* crowdstrike:falcon:intelligence
- To troubleshoot Crowdstrike Intel Addon, check $SPLUNK_HOME/var/log/splunk/ta_crowdstrike_falcon_intel_falcon_intelligence_data_input.log file.
SUPPORT
- Support Offered: Yes
- Support Email: integrations@crowdstrike.com
Copyright (C) by CrowdStrike. All Rights Reserved.
Release Notes
Version 1.0.1
April 23, 2018
* Version 1.0.1
- Updated README file.
* Version 1.0.0
- Account setup to fetch data from Falcon Intelligence.