Splunk® Supported Add-ons

Splunk Add-on for CrowdStrike FDR

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Release notes for the Splunk Add-on for CrowdStrike

Version 1.2.0 of the Splunk Add-on for Crowdstrike FDR was released on April 20, 2022. It is compatible with the following software, CIM versions, and platforms.

Splunk platform versions 8.1, 8.2
Platforms Platform independent
Vendor Products Crowdstrike FDR

New features

Version 1.2.0 of the Splunk Add-on for Crowdstrike FDR contains the following new and changed features:

  • TRUNCATE value increased to 150000
  • Enhanced logging. New logging allows estimating raw data ingestion value per input stanza. Log messages format has been changed to allow search time auto extraction of important information.
  • Configurable ingest start time - allows to ignore/skip batches created earlier than specified time threshold. Can be set via the modular input UI in "Ignore SQS messages older than" field.
  • Added proxy support for communication with AWS REST API endpoints
  • Added us-gov-east-1 and us-gov-west-1 regions in AWS collection configuration
  • Added additional verification to avoid index time resolution lookup overwrite if the collection sync process was not successful. This should prevent lookup corruption and possible ingestion blocking.

Fixed Issues

Version 1.2.0 of the Splunk Add-on for Crowdstrike FDR contrains the following, if any, fixed issues.

Known issues

Version 1.2.0 of the Splunk Add-on for CrowdStrike FDR contains the following issues.

  • In the Splunk Cloud Platform stack, by default there is no connectivity using Splunk REST API port 8089 from IDM to search heads. Additionally, IDM has limited index time field extraction capabilities (in comparison to a heavy forwarder). Both these factors do not allow the add-on to perform a solution for index-time host resolution. Consider using an external heavy forwarder to make index-time host resolution work.
  • If a heavy forwarder is installed on the Windows 2019 Datacenter, then the INGEST_EVAL with lookup() instruction can cause a crash of the Splunk service. This issue means that the Splunk Add-on for Crowdstrike FDR can not be used in such environments. Consider using a Linux host instead
  • If you are deploying this add-on to Splunk Cloud Victoria stacks please first validate that they are 8.2.2201+. Previous releases of Victoria do not include a key performance optimization that is important for high volume FDR even volumes. If your Splunk Cloud Victoria version is below 8.2.2201, for the best performance use the classic approach with IDM/HF.

Third-party software attributions

Version 1.2.0 of the Splunk Add-on for Amazon Web Services incorporates the following third-party libraries. boto3 - http://docs.splunk.com/Documentation/AddOns/released/Overview/boto3 requests - http://docs.splunk.com/Documentation/AddOns/released/Overview/requests222

Last modified on 01 September, 2022
Troubleshoot the Splunk Add-on for CrowdStrike FDR
Release history for the Splunk Add-on for Crowdstrike

This documentation applies to the following versions of Splunk® Supported Add-ons: released

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters