Overview

Details

This technical add-on enables customers to create a persistent connect to CrowdStrike's Event Streams API so that the available detection, event, incident and audit data can be continually streamed to their Splunk environment. This connection enables organizations to combine the power of the Splunk platform with the visibility and rich event data of the CrowdStrike platform.

This add-on also is used to support the CrowdStrike Falcon App (https://splunkbase.splunk.com/app/5094/).

This add on is designed to be a new installation and will replace the CrowdStrike Falcon Endpoint Add-on (https://splunkbase.splunk.com/app/3944/).

This Technical Add-On provides support for:

Splunk v8+ with Python 3
CrowdStrike OAuth2 Authentication
CrowdStrike US based, EU and GovCloud environments
Multiple customer environments
Multiple connections to a single Event Streams API, providing the AppID is unique within the CrowdStrike environment

Offical Documentation can be found here:

For TA Version 2.x:

CrowdStrike Resource Center: CrowdStrike Falcon Event Streams Add-On Guide
CrowdStrike Resource Center: CrowdStrike Falcon Event Streams Transition Guide

For TA Version 3.x:

CrowdStrike Resource Center: CrowdStrike Falcon Event Streams Add-On Guide v3

CrowdStrike Splunk Integrations:

CrowdStrike App

CrowdStrike Falcon Event Streams Technical Add-On

CrowdStrike Falcon Devices Technical Add-On

CrowdStrike Intel Indicator Technical Add-On

CrowdStrike Falcon Spotlight Technical Add-On

Release Notes

Version 3.6.5

Dec. 1, 2025

Updates/Modifications/Bug Fixes in this version:
Restores EVAL-dest, EVAL-vendor_account field mappings to their previous configurations
Added eventtype crowdstrike_customIOC_event
Added tag crowdstrike_customIOC_event
Added crowdStrike_cloud_security_IOM_event
Added detection and error handling to gracefully handle Application ID collisions

The following events and their associated tags have been marked for removal in an upcoming release. Please plan accordingly:
CrowdStrike_CustomIOC_Event
crowdStrike_customIOC_event
CrowdStrike_IdentityProtection_Event
crowdStrike_identity_protection_event
crowdstrike_identity_protection_Event

Version 3.6.1

July 30, 2025

This Version Replaces All other Versions

This version provides the following enhancements:

Updates the available CrowdStrike Cloud options to collect from CrowdStrike GovCloud 2.

Version 3.6.0

June 30, 2025

This Version Replaces All other Versions

This version provides the following enhancements:

Updates to the input filter selections to provide support for new event type APIActivityAuditEvent.
Updates Splunk and FalconPy SDK libraries used up to their latest versions.

SPLUNK CLOUD CUSTOMERS:

Due to an extreme backlog in the Splunk Cloud vetting process, CrowdStrike TA's maybe released prior to the completion of the Splunk Cloud certification process (specifically the manual checks for AppInspect).

Please contact Splunk support if you would like to upgrade to this version on Splunk Cloud prior to it being certified.

Version 3.5.0

Nov. 22, 2024

This Version Replaces All other Versions

This version provides the following enhancements:

Updates to the input filter selections to provide support for new event types such as EppDSEs.
Updates to CIM field mappings.
Updates Splunk and FalconPy SDK libraries used up to their latest versions.
Updates some event names in Splunk to align better with the CrowdStrike event name in the event data.
Additions to navigation options to include dashboard, report and resource tabs

SPLUNK CLOUD CUSTOMERS:

Due to an extreme backlog in the Splunk Cloud vetting process, CrowdStrike TA's maybe released prior to the completion of the Splunk Cloud certification process (specifically the manual checks for AppInspect).

Please contact Splunk support if you would like to upgrade to this version on Splunk Cloud prior to it being certified.

72,698

Downloads

Share Subscribe

Version

Built by

CrowdStrike

Support

Questions on Splunk Answers Flag as inappropriate

App Contents: Alert Actions

Compatibility

Products: Splunk Enterprise, Splunk Cloud

Platform: Platform Independent

CIM Versions: 6.x, 5.x

Platform: Platform Independent

CIM Versions: 6.x

Platform: Platform Independent

CIM Versions: 6.x, 5.x

Platform: Platform Independent

CIM Versions: 6.x, 5.x

Licensing

End User License Agreement for Third-Party Content

Category & Contents

Categories: Security, Fraud & Compliance

App Type: Add-on

Subscribe Share

My Account

Support & Services

CrowdStrike Falcon Event Streams Technical Add-On

Overview

Details

This add on is designed to be a new installation and will replace the CrowdStrike Falcon Endpoint Add-on (https://splunkbase.splunk.com/app/3944/).

This Technical Add-On provides support for:

Offical Documentation can be found here:

For TA Version 2.x:

For TA Version 3.x:

CrowdStrike Splunk Integrations:

Release Notes

Version 3.6.5

Version 3.6.1

This version provides the following enhancements:

Version 3.6.0

This version provides the following enhancements:

SPLUNK CLOUD CUSTOMERS:

Due to an extreme backlog in the Splunk Cloud vetting process, CrowdStrike TA's maybe released prior to the completion of the Splunk Cloud certification process (specifically the manual checks for AppInspect).

Please contact Splunk support if you would like to upgrade to this version on Splunk Cloud prior to it being certified.

Version 3.5.0

This version provides the following enhancements:

SPLUNK CLOUD CUSTOMERS:

Due to an extreme backlog in the Splunk Cloud vetting process, CrowdStrike TA's maybe released prior to the completion of the Splunk Cloud certification process (specifically the manual checks for AppInspect).

Please contact Splunk support if you would like to upgrade to this version on Splunk Cloud prior to it being certified.

Version

Built by

Support

Compatibility

Licensing

Category & Contents

Are you a developer?

Splunk Cookie Policy

My Account

Support & Services

Accept License Agreements

Thank You

Downloading CrowdStrike Falcon Event Streams Technical Add-On

To install your download

Flag As Inappropriate

CrowdStrike Falcon Event Streams Technical Add-On

Overview

Details

This add on is designed to be a new installation and will replace the CrowdStrike Falcon Endpoint Add-on (https://splunkbase.splunk.com/app/3944/).

This Technical Add-On provides support for:

Offical Documentation can be found here:

For TA Version 2.x:

For TA Version 3.x:

CrowdStrike Splunk Integrations:

Release Notes

Version 3.6.5

Version 3.6.1

This version provides the following enhancements:

Version 3.6.0

This version provides the following enhancements:

SPLUNK CLOUD CUSTOMERS:

Due to an extreme backlog in the Splunk Cloud vetting process, CrowdStrike TA's maybe released prior to the completion of the Splunk Cloud certification process (specifically the manual checks for AppInspect).

Please contact Splunk support if you would like to upgrade to this version on Splunk Cloud prior to it being certified.

Version 3.5.0

This version provides the following enhancements:

SPLUNK CLOUD CUSTOMERS:

Due to an extreme backlog in the Splunk Cloud vetting process, CrowdStrike TA's maybe released prior to the completion of the Splunk Cloud certification process (specifically the manual checks for AppInspect).

Please contact Splunk support if you would like to upgrade to this version on Splunk Cloud prior to it being certified.

Version

Built by

Support

Compatibility

Licensing

Category & Contents

Are you a developer?