About the Splunk Add-on for CrowdStrike
|Vendor Products||CrowdStrike FDR (Falcon Data Replicator)|
|Visible||No. This add-on does not contain any views.|
The Splunk Add-on for CrowdStrike FDR lets you collect event data stored in CrowdStrike and bring it into your own Splunk instance for retention and further analysis.
Crowdstrike FDR events must be fetched from an AWS S3 bucket that is provisioned for you. The integration utilizes AWS SQS to support scaling horizontally if required.
If you deploy to Splunk Cloud Victoria, make sure that you are running version 8.2.2201 or later of Splunk Cloud Victoria. version 8.2.2201 provides a key performance optimization for high FDR event volumes.
Index-time host resolution is not supported in Splunk Cloud Platform (SCP) stacks. For Splunk Cloud Platform stacks, utilize a heavy forwarder with connectivity to the search heads to deploy index-time host resolution or migrate to an SCP Victoria stack version 8.2.2201 or later.
Download the Splunk Add-on for Crowdstrike FDR from Splunkbase at http://splunkbase.splunk.com/app/5579.
Hardware and software requirements for the Splunk Add-in for CrowdStrike FDR
This documentation applies to the following versions of Splunk® Supported Add-ons: released