CrowdStrike Falcon

New features

• New connect profile type
• 2 new log schemas
• 3 new loggers
  • Event Streams — detection, incident, audit and remote session events (persistent connection)
  • Scheduled Report Logs — scheduled report executions
  • Scheduled Search Logs — scheduled search executions
• 8 new query commands
  • crowdstrike-falcon-devices — list devices
  • crowdstrike-falcon-ngsiem-query — run an NG SIEM query
  • crowdstrike-falcon-scheduled-reports / -searches — list scheduled report and search executions
  • crowdstrike-falcon-scheduled-report / -search — read a result by execution id
  • crowdstrike-falcon-last-scheduled-report / -search — read the latest execution by name

Note: If you installed an app file delivered outside the store, remove the existing app and install this version as a new one.

First release

• Supports dedicated log parser, log schemas, logger models, and dashboards.