All Apps and Add-ons

How to do log filtering on Splunk Add-on for Crowdstrike FDR?

fredd
Explorer

Hello,

I have a question about the Splunk Add-on for Crowdstrike FDR developed by Splunk - I would like to filter out events in addition to what the add-on provides - that is filtering by event_simpleName. My exact use case is I want to drop events with IsOnRemovableDisk\"\:\"1 in the raw message. I tried to do it using props/transforms applying to the appropriate sourcetype, yet it does not seem to be applied at all. Even with such a simple config like this:

props.conf:

 

[crowdstrike:events:sensor]
TRANSFORMS-usb = do_not_index

 

transforms.conf:

 

[do_not_index]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

 


Where I expected all the events to be dropped, it does not get applied and all the events except what is configured with the Event Filter in the add-on are ingested into Splunk.

Am I missing anything there? Is it even possible to filter events more in detail with Splunk Add-on for Crowdstrike FDR based on the raw data of events?

Labels (1)
0 Karma
1 Solution

m_pham
Splunk Employee
Splunk Employee

I might be wrong but can you try putting your configs under this stanza?

props.conf

[forward_to_crowdstrike_fdr_ta]
TRANSFORMS-usb = do_not_index

View solution in original post

m_pham
Splunk Employee
Splunk Employee

I might be wrong but can you try putting your configs under this stanza?

props.conf

[forward_to_crowdstrike_fdr_ta]
TRANSFORMS-usb = do_not_index

fredd
Explorer

That is the right answer, thank you!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...