Crowdstrike is a SaaS (software as a service) system security solution. Deploy this integration to ship Crowdstrike events from your Crowdstrike account to Logz.io using FluentD.
Fluentd will fetch all existing logs, as it is not able to ignore older logs.
This integration includes:
- Establishing communication between the Crowdstrike connector and your Crowdstrike account
- Configuring a FluentD agent on your device
- Establishing communication between the FluentD agent and your Logz.io account
Upon deployment, the Crowdstrike connector connects to your Crowdstrike account to collect events. This data is written into a file on your device. The FluentD agent collects the data from this file, connects to your Logz.io account and sends the events to Logz.io.
Before you begin, you'll need:
- an active account with Crowdstrike
- an active account with Logz.io
- FluentD agent on your machine
- Crowdstrike connector installed on your machine
Configure Crowdstrike connector
- Open the configuration file located at
- Enter the Client ID value into the
- Enter the Client Secret value into the
- Make sure that the base URL in
request_token_urlcorresponds to the base URL for your account.
- Save the changes.
Install Ruby gems for FluentD
- Install the fluent-plugin-concat gem. This gem concatenates multiline logs.
- Install the fluent-plugin-logzio gem. This gem enables communication between your FluentD agent and Logz.io.
- Write down your Logz.io listener URL and logs shipping token by navigating to your Logz.io account and selecting Settings > Tools > Manage Tokens. The Listener URL for your account is displayed above the token table.
- Create a new configuration file for your FluentD. For example,
- Copy and paste the code block below into the configuration file. The log_level setting defines which events are recorded in the log. In order of verbosity, the log level can be defined as fatal, error, warn, info, debug or trace. The default for the log level is info: The info level records all events categorized as info and higher in verbosity. To learn more about the settings used in the configuration file, see Logz.io plugin for Fluentd.
# Tailing the default path Crowdstrike's SIEM Connector
# Concatenating the event as one log
# This adds type to the log && removes key log & message. If you change the type in this code section, the data is not parsed into the relevant fields for the Crowdstrike integration.
# Sending to Logz.io
chunk_limit_size 16m # Logz.io bulk limit is decoupled from chunk_limit_size. Set whatever you want.
# Exclude fluentd logs
If you change
type in the
@type record_transformer section, the data is not parsed into the relevant fields for the Crowdstrike integration.
<<LISTENER-HOST>> with the host for your region. For example,
listener.logz.io if your account is hosted on AWS US East, or
listener-nl.logz.io if hosted on Azure West Europe. The required port depends whether HTTP or HTTPS is used: HTTP = 8070, HTTPS = 8071.
<<LOG-SHIPPING-TOKEN>> with the token of the account you want to ship to.
- Save the changes.
Start the Crowdstrike connector
Run the following command:
- For Ubuntu 14.x:
sudo start cs.falconhoseclientd
- For Ubuntu 16.04 and later:
sudo systemctl start cs.falconhoseclientd.service
- For CentOS:
sudo service cs.falconhoseclientd start
Start your FluentD agent with the configuration file created for this integration.
For example, run
fluentd -c <<PATH-TO-YOUR-FLUENTD-CONFIG-FILE>>.
Check Logz.io for your events
Give your events some time to get from your system to ours, and then open Open Search Dashboards. You can filter for data of type
crowdstrike to see the incoming Crowdstrike events.
If you still don't see your logs, see Filebeat troubleshooting.