Getting Data In

How to drop logs from crowdtrike using transform.conf

rtalcik
Path Finder

Hi All,

So first I want to apologize if I don't understand much as I am fairly new to the administration side.

However, I read some documentation that I can use transform.conf to drop logs from coming into splunk.

I am using a universal forwarder and I want a specific powershell script whitelisted.

Can anyone send me a documentation on how I would edit transform.conf to whitelist a specific powershell script? If there is a better way, that would work too.

0 Karma
1 Solution

to4kawa
Ultra Champion
0 Karma

to4kawa
Ultra Champion
0 Karma

rtalcik
Path Finder

you wanna post this as a question so I can accept it

0 Karma

to4kawa
Ultra Champion

roger that!

0 Karma
Get Updates on the Splunk Community!

Observability Unveiled: Navigating OpenTelemetry's Framework and Deployment Options

Observability Unveiled: Navigating OpenTelemetry's Framework and Deployment Options A recent Tech Talk, ...

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...