Getting Data In

How to drop logs from crowdtrike using transform.conf

rtalcik
Path Finder

Hi All,

So first I want to apologize if I don't understand much as I am fairly new to the administration side.

However, I read some documentation that I can use transform.conf to drop logs from coming into splunk.

I am using a universal forwarder and I want a specific powershell script whitelisted.

Can anyone send me a documentation on how I would edit transform.conf to whitelist a specific powershell script? If there is a better way, that would work too.

0 Karma
1 Solution

to4kawa
Ultra Champion
0 Karma

to4kawa
Ultra Champion
0 Karma

rtalcik
Path Finder

you wanna post this as a question so I can accept it

0 Karma

to4kawa
Ultra Champion

roger that!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!