All Apps and Add-ons

How to do log filtering on Splunk Add-on for Crowdstrike FDR?

fredd
Explorer

Hello,

I have a question about the Splunk Add-on for Crowdstrike FDR developed by Splunk - I would like to filter out events in addition to what the add-on provides - that is filtering by event_simpleName. My exact use case is I want to drop events with IsOnRemovableDisk\"\:\"1 in the raw message. I tried to do it using props/transforms applying to the appropriate sourcetype, yet it does not seem to be applied at all. Even with such a simple config like this:

props.conf:

 

[crowdstrike:events:sensor]
TRANSFORMS-usb = do_not_index

 

transforms.conf:

 

[do_not_index]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

 


Where I expected all the events to be dropped, it does not get applied and all the events except what is configured with the Event Filter in the add-on are ingested into Splunk.

Am I missing anything there? Is it even possible to filter events more in detail with Splunk Add-on for Crowdstrike FDR based on the raw data of events?

Labels (1)
0 Karma
1 Solution

m_pham
Splunk Employee
Splunk Employee

I might be wrong but can you try putting your configs under this stanza?

props.conf

[forward_to_crowdstrike_fdr_ta]
TRANSFORMS-usb = do_not_index

View solution in original post

m_pham
Splunk Employee
Splunk Employee

I might be wrong but can you try putting your configs under this stanza?

props.conf

[forward_to_crowdstrike_fdr_ta]
TRANSFORMS-usb = do_not_index

fredd
Explorer

That is the right answer, thank you!

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...