CrowdStrike Falcon Event Streams Technical Add-On
Splunk AppInspect Passed
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
Details
This technical add-on enables customers to create a persistent connect to CrowdStrike's Event Streams API so that the available detection, event, incident and audit data can be continually streamed to their Splunk environment. This connection enables organizations to combine the power of the Splunk platform with the visibility and rich event data of the CrowdStrike platform.
This add-on also is used to support the CrowdStrike Falcon App (https://splunkbase.splunk.com/app/5094/).
This add-on also is used to support the CrowdStrike Falcon App (https://splunkbase.splunk.com/app/5094/).
This add on is designed to be a new installation and will replace the CrowdStrike Falcon Endpoint Add-on (https://splunkbase.splunk.com/app/3944/).
This Technical Add-On provides support for:
Splunk v8+ with Python 3
CrowdStrike OAuth2 Authentication
CrowdStrike US based, EU and GovCloud environments
Multiple customer environments
Offical Documentation can be found here:
CrowdStrike Resource Center: CrowdStrike Falcon Event Streams Add-On Guide
CrowdStrike Resource Center: CrowdStrike Falcon Event Streams Transition Guide
The new CrowdStrike App can be found here:
Release Notes
Version 2.0.4
Sept. 28, 2020
This release provides the following:
1. The Event Streams API call not enforcing the configure proxy settings.
2. Retrieves the TA version from the TA's manifest file.
3. Provides additional logging information.
4. Provides backward compatibility to v7.3.