NetworkSession ASIM Parser for CrowdStrike Falcon Endpoint Protection
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimNetworkSessionCrowdStrikeFalconHost |
| Built-in Parser | _ASim_NetworkSession_CrowdStrikeFalconHost |
| Schema | NetworkSession |
| Schema Version | 0.2.6 |
| Parser Type | 🔌 Source (product-specific) |
| Product | CrowdStrike Falcon Endpoint Protection |
| Parser Version | 0.1.0 (version history) |
| Last Updated | Oct 26, 2023 |
| Unifying Parser | ASimNetworkSession |
| Source File | Parsers\ASimNetworkSession\Parsers\ASimNetworkSessionCrowdStrikeFalconHost.yaml |
Description
This ASIM parser supports normalizing CrowdStrike Falcon Endpoint Protection logs to the ASIM Network Session normalized schema. These events are captured through CrowdStrike Falcon Endpoint Protection data connector which allows you to easily connect your CrowdStrike Falcon Event Stream with Microsoft Sentinel.
Source Tables
This parser reads from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
CommonSecurityLog |
DeviceEventClassID in "FirewallMatchEvent,Network Access In A Detection Summary Event"DeviceEventClassID has "Network Access In A Detection Summary Event"DeviceProduct == "FalconHost"DeviceVendor == "CrowdStrike" |
✓ | ✓ | ? |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
Associated Connectors
The following connectors provide data for this parser:
Solutions: Common Event Format, VirtualMetric DataStream, Zscaler Internet Access
References
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊