CrowdStrike FDR events sensor logs: Field extractions module¶

Use case¶

Use this SPL2 module when you want to preserve the Splunk Add-on for CrowdStrike FDR field-extraction behavior for crowdstrike:events:sensor data in an SPL2 workflow. Modules are reusable building blocks that can be referenced from SPL2 pipelines instead of rewriting sourcetype-specific extraction logic by hand.

Note

This module must not be used with Splunk indexes. It is intended only for exporting to data lakes.

Version 0.1.0¶

Version 0.1.0 of the CrowdStrike FDR events sensor logs: Field extractions module was released with the Splunk Add-on for CrowdStrike FDR v3.1.0 SPL2 content update.

Module details¶

Compatibility¶

This module is compatible with Splunk Add-on for CrowdStrike FDR v3.1.0 and higher.

Module description¶

This module is generated from the add-on’s props.conf and transforms.conf knowledge objects. Its purpose is to preserve the same field-extraction, normalization, calculated-field, and lookup behavior that the add-on defines for the crowdstrike:events:sensor sourcetype, but in reusable SPL2 form.

The module applies JSON field extraction, regular-expression extractions, field aliases, calculated fields, lookup enrichments, bitmask meaning fields, and nested JSON flattening for CrowdStrike FDR sensor events.

Supported sourcetype¶

This module applies to events with the crowdstrike:events:sensor sourcetype.

Module outline¶

The module consists of helper functions followed by one exported function.

Function name	Description	Configuration options
`apply_kv_mode`	Applies JSON field extraction behavior for the sourcetype.	No configuration options.
`apply_extractions`	Applies extraction behavior derived from `REPORT`, `EXTRACT`, and `TRANSFORMS` knowledge objects.	No configuration options.
`apply_normalizations`	Applies field alias behavior derived from `FIELDALIAS` knowledge objects.	No configuration options.
`apply_calculations_on_fields`	Applies calculated-field behavior derived from `EVAL` knowledge objects.	No configuration options.
`bitmask_to_values`	Converts bitmask fields into meaning values.	No configuration options.
`flatten_one_element_mv`	Flattens one-element multivalue results produced by bitmask conversion.	No configuration options.
`apply_lookups`	Applies lookup enrichments derived from `LOOKUP` knowledge objects when present.	No configuration options.
`_flatten_json`	Flattens nested JSON data into top-level fields.	No configuration options.
`crowdstrike_events_sensor_field_extractions_function`	Exported module function for `crowdstrike:events:sensor` events.	No configuration options.

Example usage¶

You can reference the exported function from a pipeline that targets crowdstrike:events:sensor events, for example:

import crowdstrike_events_sensor_field_extractions_function from crowdstrike_events_sensor_field_extractions_module

$pipeline = | from $source
            | crowdstrike_events_sensor_field_extractions_function
            | into $destination