This App is designed to replace the CrowdStrike App for Splunk and should be leveraged with CrowdStrike OAuth2 based Technical Add-Ons (TAs).
The TAs that are currently needed to support this app are:
[CrowdStrike Intel Indicator Technical Add-On] (https://splunkbase.splunk.com/app/5083/)
[CrowdStrike Falcon Event Streams Technical Add-On] (https://splunkbase.splunk.com/app/5082/)
The dashboards leverage search macros which should be updated to indicate the correct indexes containing the CrowdStrike data. The default for these search macros are all indexes '*' which may cause performance impacts.
CrowdStrike Resource Center: CrowdStrike Splunk App Use and Configuration Guide
[CrowdStrike App] (https://splunkbase.splunk.com/app/5094/)
[CrowdStrike Falcon Event Streams Technical Add-On] (https://splunkbase.splunk.com/app/5082/)
[CrowdStrike Falcon Devices Technical Add-On] (https://splunkbase.splunk.com/app/5570/)
[CrowdStrike Intel Indicator Technical Add-On] (https://splunkbase.splunk.com/app/5083/)
[CrowdStrike Falcon Data Replicator (FDR) Technical Add-On] (https://splunkbase.splunk.com/app/5599)
This release is an updated build release at the request of the Splunk Cloud team.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.