CrowdStrike Integration with WazuH

[Operation Consultant]

Hi All, 

Any Suggestion, 

How to Integrated  CrowdStrike with WazuH. 

Best Wishes,

[Carlos Ezequiel Bordon]

Hi,

The main configuration from Wazuh perspective is collecting the logs from the CrowdStrike file (assuming the location is /var/log/crowdstrike/falconhoseclient/output ) using :

multi-line-regex /var/log/crowdstrike/falconhoseclient/output ^{

Then you should create custom decoders/rules similar to those mentioned in wazuh/wazuh#8129 (comment) if the format of the received logs is different.

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/e0bea7e5-3bb2-45e9-906d-7e7fab6a75a7n%40googlegroups.com.

--

Carlos Bordon CICD/DevOps

[Operation Consultant]

where we call API details under wazuH-manager. 

[Operation Consultant]

Any Suggestion here. 

[Varad Gunjkar]

Refer this

[Vishak Jaisimha]

i dont think sudo apt-get install wazuh-integration-crowdstike exists is there any other way to do it ?
thanks