All Apps and Add-ons

CEF Format Crowdstrike Data to Splunk



I am sending Crowdstrike Streaming data to Splunk in CEF format. Sample log pasted below
How do I get Splunk to recognize all the CEF fields from this stream?

6:26:31.000 PM

CEF:0|CrowdStrike|FalconHost|1.0|validateEntitlementsHmac|validateEntitlementsHmac|1|cat=AuthActivityAuditEvent duser=Customer deviceProcessName=CrowdStrike Authentication cn3Label=Offset cn3=354 outcome=true deviceCustomDate1Label=Timestamp deviceCustomDate1=Jun 25 2019 18:26:31 rt=1561512391596
host = source = tcp:6514 sourcetype = cef_data_stream

6:25:31.000 PM

CEF:0|CrowdStrike|FalconHost|1.0|validateEntitlementsHmac|validateEntitlementsHmac|1|cat=AuthActivityAuditEvent destinationTranslatedAddress=10.xx.11.190 duser=Customer deviceProcessName=CrowdStrike Authentication cn3Label=Offset cn3=353 outcome=true deviceCustomDate1Label=Timestamp deviceCustomDate1=Jun 25 2019 18:25:30 rt=1561512330948
host = source = tcp:6514 sourcetype = cef_data_stream

There are TA and other Apps for Crowdstrike but I wasn't able to get it working. Splunk receives the logs correctly but isn't able to parse all CEF log fields correctly

It only parses following 3?

host = source = tcp:6514 sourcetype = cef_data_stream.


0 Karma


We use Crowdstrike app which works perfectly fine (sending data on Test environment). The only CEF format i have used it in the past is from CyberArk.

You can refer the above document.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...