Overview

Details

This technical add-on enables customers to create a persistent connect to CrowdStrike's Event Streams API so that the available detection, event, incident and audit data can be continually streamed to their Splunk environment. This connection enables organizations to combine the power of the Splunk platform with the visibility and rich event data of the CrowdStrike platform.

This add-on also is used to support the CrowdStrike Falcon App (https://splunkbase.splunk.com/app/5094/).

This add on is designed to be a new installation and will replace the CrowdStrike Falcon Endpoint Add-on (https://splunkbase.splunk.com/app/3944/).

This Technical Add-On provides support for:

Splunk v8+ with Python 3
CrowdStrike OAuth2 Authentication
CrowdStrike US based, EU and GovCloud environments
Multiple customer environments
Multiple connections to a single Event Streams API, providing the AppID is unique within the CrowdStrike environment

Offical Documentation can be found here:

For TA Version 2.x:

CrowdStrike Resource Center: CrowdStrike Falcon Event Streams Add-On Guide
CrowdStrike Resource Center: CrowdStrike Falcon Event Streams Transition Guide

For TA Version 3.x:

CrowdStrike Resource Center: CrowdStrike Falcon Event Streams Add-On Guide v3

CrowdStrike Splunk Integrations:

CrowdStrike App
CrowdStrike Falcon Event Streams Technical Add-On
CrowdStrike Falcon Devices Technical Add-On
CrowdStrike Intel Indicator Technical Add-On
CrowdStrike Falcon Spotlight Technical Add-On

Release Notes

Version 3.5.0

Nov. 22, 2024

This Version Replaces All other Versions

This version provides the following enhancements:

Updates to the input filter selections to provide support for new event types such as EppDSEs.
Updates to CIM field mappings.
Updates Splunk and FalconPy SDK libraries used up to their latest versions.
Updates some event names in Splunk to align better with the CrowdStrike event name in the event data.
Additions to navigation options to include dashboard, report and resource tabs

SPLUNK CLOUD CUSTOMERS:

Due to an extreme backlog in the Splunk Cloud vetting process, CrowdStrike TA's maybe released prior to the completion of the Splunk Cloud certification process (specifically the manual checks for AppInspect).

Please contact Splunk support if you would like to upgrade to this version on Splunk Cloud prior to it being certified.

Version 3.2.1

Jan. 23, 2024

Update to align with Splunk Cloud requirements.

Note that an update in v3.1.6 corrected an issue where an incorrect sourcetype was previously being applied. If updating from a version prior to v3.1.6 please check the sourcetype(s) being applied and update search macros and queries appropriately.

SPLUNK CLOUD CUSTOMERS:

Due to an extreme backlog in the Splunk Cloud vetting process the TA is being released prior to the completion of the Splunk Cloud certification process (specifically the manual checks for AppInspect).

Please contact Splunk support if you would like to upgrade to this version on Splunk Cloud

Version 3.1.8

April 5, 2023

PLEASE REVIEW PUBLISHED DOCUMENTATION PRIOR TO INSTALLATION OR UPGRADE

Click here for the CrowdStrike Event Streams Add on for Splunk Guide V3

v3.1.8 replaces all previous versions

Major Improvements:

Bug Fixes:

3.1.8- props.conf file was updated to address field mapping issues and to provide better calculated field coverage for the 'action' field.

Notes:

Ensure that each inputs AppIDs are unique within the CrowdStrike Falcon environment

32,588

Downloads

Share Subscribe

Version

Built by

CrowdStrike

Support

Developer Supported

Contact Developer Questions on Splunk Answers Flag as inappropriate

App Contents: Alert Actions

Compatibility

Products: Splunk Enterprise, Splunk Cloud

Splunk Versions: 9.4, 9.3, 9.2, 9.1

Platform: Platform Independent

CIM Versions: 6.x, 5.x

Splunk Versions: 9.4, 9.3, 9.2, 9.1, 9.0

Platform: Platform Independent

CIM Versions: 5.x

Splunk Versions: 9.4, 9.3, 9.2, 9.1, 9.0, 8.2

Platform: Platform Independent

CIM Versions: 5.x

Licensing

End User License Agreement for Third-Party Content

Category & Contents

Categories: Security, Fraud & Compliance

App Type: Add-on

Subscribe Share

My Account

Support & Services

CrowdStrike Falcon Event Streams Technical Add-On

Overview

Details

This Technical Add-On provides support for:

Offical Documentation can be found here:

For TA Version 2.x:

For TA Version 3.x:

CrowdStrike Splunk Integrations:

Release Notes

Version 3.5.0

This version provides the following enhancements:

SPLUNK CLOUD CUSTOMERS:

Due to an extreme backlog in the Splunk Cloud vetting process, CrowdStrike TA's maybe released prior to the completion of the Splunk Cloud certification process (specifically the manual checks for AppInspect).

Please contact Splunk support if you would like to upgrade to this version on Splunk Cloud prior to it being certified.

Version 3.2.1

Note that an update in v3.1.6 corrected an issue where an incorrect sourcetype was previously being applied. If updating from a version prior to v3.1.6 please check the sourcetype(s) being applied and update search macros and queries appropriately.

SPLUNK CLOUD CUSTOMERS:

Due to an extreme backlog in the Splunk Cloud vetting process the TA is being released prior to the completion of the Splunk Cloud certification process (specifically the manual checks for AppInspect).

Please contact Splunk support if you would like to upgrade to this version on Splunk Cloud

Version 3.1.8

PLEASE REVIEW PUBLISHED DOCUMENTATION PRIOR TO INSTALLATION OR UPGRADE

v3.1.8 replaces all previous versions

Major Improvements:

Bug Fixes:

Notes:

Ensure that each inputs AppIDs are unique within the CrowdStrike Falcon environment

Version

Built by

Support

Compatibility

Licensing

Category & Contents

Are you a developer?

Splunk Cookie Policy

My Account

Support & Services

Accept License Agreements

Thank You

Downloading CrowdStrike Falcon Event Streams Technical Add-On

To install your download

Flag As Inappropriate

CrowdStrike Falcon Event Streams Technical Add-On

Overview

Details

This Technical Add-On provides support for:

Offical Documentation can be found here:

For TA Version 2.x:

For TA Version 3.x:

CrowdStrike Splunk Integrations:

Release Notes

Version 3.5.0

This version provides the following enhancements:

SPLUNK CLOUD CUSTOMERS:

Due to an extreme backlog in the Splunk Cloud vetting process, CrowdStrike TA's maybe released prior to the completion of the Splunk Cloud certification process (specifically the manual checks for AppInspect).

Please contact Splunk support if you would like to upgrade to this version on Splunk Cloud prior to it being certified.

Version 3.2.1

Note that an update in v3.1.6 corrected an issue where an incorrect sourcetype was previously being applied. If updating from a version prior to v3.1.6 please check the sourcetype(s) being applied and update search macros and queries appropriately.

SPLUNK CLOUD CUSTOMERS:

Due to an extreme backlog in the Splunk Cloud vetting process the TA is being released prior to the completion of the Splunk Cloud certification process (specifically the manual checks for AppInspect).

Please contact Splunk support if you would like to upgrade to this version on Splunk Cloud

Version 3.1.8

PLEASE REVIEW PUBLISHED DOCUMENTATION PRIOR TO INSTALLATION OR UPGRADE

v3.1.8 replaces all previous versions

Major Improvements:

Bug Fixes:

Notes:

Ensure that each inputs AppIDs are unique within the CrowdStrike Falcon environment

Version

Built by

Support

Compatibility

Licensing

Category & Contents

Are you a developer?