Skip to main content

CrowdStrike FDR

CrowdStrike Falcon Data Replicator (FDR) is a powerful feature of the CrowdStrike Falcon platform designed to collect and replicate telemetry data from endpoints. It provides organizations with detailed visibility into endpoint activities by capturing data such as:

  • Process executions: Records of applications and processes running on the system.
  • File and network activity: Logs of file changes and network connections.
  • Security events: Details of threats detected and actions taken by Falcon.

This data is essential for security monitoring, threat hunting, and incident response.

Configuring CrowdStrike FDR for S3 Storage​

CrowdStrike FDR can be configured to export its telemetry data to an Amazon S3 bucket for storage and further processing. To set this up, refer to the official CrowdStrike documentation for the detailed instructions on how to configure FDR to send logs to your S3 bucket.

Integrating with AlphaSOC​

Once CrowdStrike FDR is configured to store logs in an S3 bucket, you can integrate this data with AlphaSOC. To proceed, visit the Collecting Data / Amazon S3 section of the AlphaSOC documentation. This guide explains how to configure AlphaSOC to ingest and analyze the FDR telemetry data from your S3 bucket.

Conclusion​

This integration allows AlphaSOC to leverage CrowdStrike FDR logs for advanced threat detection and response.