SPL2 modules for CrowdStrike FDR logs

SPL2 modules are reusable SPL2 functions generated from the add-on’s existing knowledge objects, such as props.conf and transforms.conf.

Unlike SPL2 templates, which are end-to-end pipelines, SPL2 modules are intended to provide reusable sourcetype-specific logic that can be referenced from SPL2 workflows.

Note

After you install or upgrade the Splunk Add-on for CrowdStrike FDR, SPL2 modules can take a short time to appear in the product experience while they are compiled.

Module types

As of now, the Splunk Add-on for CrowdStrike FDR provides the following module type:

• Field-extraction modules

Field-extraction modules

Field-extraction modules preserve sourcetype-specific field extraction, normalization, calculated-field, and lookup behavior in reusable SPL2 form.

crowdstrike:events:sensor

Use the crowdstrike:events:sensor field-extraction module for CrowdStrike FDR sensor events. This module applies JSON field extraction, field aliases, calculated fields, lookup enrichments, bitmask meaning fields, and timestamp-related extraction behavior for sensor event data.

Module name	Version	Use case	Availability
CrowdStrike FDR events sensor logs: Field extractions module	0.1.0	Preserve the Splunk Add-on for CrowdStrike FDR crowdstrike:events:sensor sourcetype field-extraction behavior in reusable SPL2 form generated from add-on knowledge objects.	SPL2 workflow