CrowdStrike Falcon Devices Technical Add-On

The CrowdStrike Falcon Sensor is able to collect an extensive amount of data about the endpoint that it resides on. This information is valuable not only to the security team but the IT organization as a whole. This add-on is designed to allow CrowdStrike customers to pull that data into Splunk so that it can be leveraged for use cases such as: Data Enrichment: Use the device data to enrich other data sets to get a more complete picture of the environment and the situation CMDB: Ensure that endpoint information (such as OS, BIOS and last seen data) in configuration management platforms is up to date and track which OS versions are running on what endpoint CrowdStrike Host configuration: Maintain a history of device policy configurations, monitor for changes and ensure proper policy alignment