SPL2 templates and modules for CrowdStrike FDR

SPL2 content for CrowdStrike FDR currently includes two artifact types:

• Templates, which are end-to-end SPL2 pipelines for transforming or reducing log data.
• Field-extraction modules, which are reusable SPL2 functions generated from add-on knowledge objects such as props.conf and transforms.conf.

Templates and modules are available for the Edge Processor and Ingest Processor. See the following documentation for more information:

• Edge Processor
• Ingest Processor

Templates

Template name	Version	Use case	Availability
CrowdStrike FDR fields reduction in events	0.0.1	Reduce the size of CrowdStrike FDR sensor events emitted by the Splunk Add-on for CrowdStrike FDR by removing unnecessary data, null fields in the events, filtering out events with same local IP, removing noisy events. The compatibility with the Splunk Common Information Model (CIM) and Security Detections is preserved.	Edge Processor and Ingest Processor

See the Release notes for SPL2 template release notes.

Modules

For information about available SPL2 modules, see the SPL2 modules overview.