DOCSEARCHbyAlgolia
Submit Docs

CrowdStrike LogScale Community Content

repository·main·Indexed 43 days ago

https://github.com/crowdstrike/logscale-community-content

A collection of community-contributed CQL (CrowdStrike Query Language) content for LogScale and Next-Gen SIEM. Includes parsers, dashboards, queries, and complete log source packages for vendors such as Cisco, AppOmni, Armis, Asimily, Airlock Digital, and 1Password.

Tokens
16.4K
Snippets
23
Records
101
Agent score
56%

What's inside LogScale Community Content

  1. Overview of Kubernetes Fluent-Bit Logging package contents

    main

    This package provides assets to parse, search, and visualize Kubernetes logging data forwarded by the fluent-bit log shipper. It requires the Fluent-Bit Logging LogScale Integration to function.

    Parsers

    • fluentbit

    Actions (File Uploads)

    • Kubernetes Cluster Hostnames Lookup
    • Kubernetes Container Actions Lookup
    • Kubernetes Network Interfaces Lookup

    Dashboards

    System & Events:

    • Kubernetes Daemons: Overview of Kubernetes system daemons
    • Kubernetes Events: Overview of Kubernetes events
    • Kubernetes Container Search: Overview of Kubernetes containers
    • Kubernetes Control-Plane Summary: Overview of Kubernetes control-plane
    • Audit Events: Overview of Kubernetes audit events
    • Docker Events: Overview of Docker events

    Node Metrics:

    • CPU Metrics: Overview of node cpu metrics
    • Disk Metrics: Overview of node disk metrics
    • Memory Metrics: Overview of node memory metrics
    • Network Metrics: Overview of node network metrics

    Scheduled Searches

    • Collect Kubernetes Cluster Hostnames
    • Collect Kubernetes Container Actions
    • Collect Kubernetes Network Interfaces

  2. Overview of LogScale and FLTR Community Content

    main
    This repository contains individual, ad-hoc assets for LogScale and FLTR, including dashboards, queries, and alerts. Unlike the official LogScale Package Marketplace, this content is intended for sharing community-driven examples (such as those from 'Cool Query Friday') and serves primarily as a resource for learning and experimentation.

  3. Overview of Google Chrome Enterprise Dashboards

    main

    The package includes several pre-built dashboards to help SecOps and ITOps teams monitor Chrome and ChromeOS security events:

    • Security Overview: A high-level summary and breakdown of key security events.
    • Event Information: A detailed view of all logs, including filtering capabilities and time charts showing event volumes.
    • Extension Monitoring: Provides a quick view for monitoring extension installations on Chrome Browsers and ChromeOS.
    • ChromeOS Overview: Focuses on ChromeOS-specific security events such as logons, USB Drive logs, and Chrome Remote Desktop (CRD) usage.
    • ChromeOS Data Controls: Provides visibility into ChromeOS Data Controls to help protect users from data leakage on endpoints.

  4. Overview of Asimily IoMT Package

    main

    The Asimily IoMT package provides tools for organizations to perform advanced device and risk analyses for unmanaged devices, including IoT, IoMT (Internet of Medical Things), and OT (Operational Technology).

    Package Components

    • Parser: Specifically designed for Asimily anomaly data.
    • Alert Dashboard: A pre-configured dashboard for visualizing security events and risks.

    Deployment Behavior

    Installing this package automatically deploys the Asimily parser, saved searches, and alerts directly into the LogScale repository where the package is installed.

  5. Overview of Tausight/ePHI-Risk-Posture

    main
    The Tausight/ePHI-Risk-Posture package integrates Tausight's Electronic Protected Health Information (ePHI) intelligence into CrowdStrike Falcon® LogScale. It is designed for SecOps and ITOps teams to proactively mitigate cyber risks related to ePHI by visualizing risks across healthcare environments, including ePHI at-rest, ePHI usage, and ePHI movement (e.g., via email or removable media).

  6. Overview of the LogScale Internal Monitoring Package

    main

    The LogScale Internal Monitoring Package provides visibility into humio-* views and repositories within a Cloud organization.

    Included components:

    • Dashboards: Comprehensive dashboards covering all internal sources.
    • Parsers: Parsers specifically designed for Log Collector debug logs.
    • Alerts: Pre-configured alerts to monitor log ingestion health.

  7. Overview of AppOmni LogScale Content

    main

    The AppOmni package provides a parser and dashboards designed to ingest SaaS application logs from AppOmni into LogScale or CrowdStrike Next-Gen SIEM.

    AppOmni normalizes SaaS audit logs into a modified Elastic Common Schema (ECS) format. The content helps detect suspicious activity such as:

    • Highly privileged misconfigurations
    • Configuration changes
    • Unusual user behavior
    • Excessive data consumption within the SaaS ecosystem

    The package includes threat intelligence enrichment and applies AppOmni threat detection rules to identify malicious sequences of events.

  8. Overview of CrowdStrike FLTR LOLbins queries

    main
    The crowdstrike/fltr-lolbins package provides a collection of queries designed for SecOps use cases. These queries are based on the CrowdStrike whitepaper "8 LOLBins Every Threat Hunter Should Know" by CrowdStrike Falcon OverWatch Elite, helping threat hunters identify Living-off-the-Land Binaries (LOLBins) used in malicious activity.

  9. Overview of Zoom QSS QoS Telemetry package contents

    main

    This package provides the assets required to parse, search, and visualize Zoom QSS (Quality of Service) telemetry data. It is designed for DevOps and SecOps use cases to support operational troubleshooting and security monitoring.

    Included Assets

    Parsers

    • zoom_qss: The primary parser for incoming telemetry.

    Dashboards

    • QSS Overview: Provides a high-level summary of Zoom meetings and webinars.
    • Zoom Event Metrics: Provides a detailed view of Zoom events, allowing for inspection of specific meetings or webinars.

    Lookup Files (Actions)

    The package includes several file-upload actions for enrichment:

    • Connection Types
    • Network Types
    • Zoom Devices
    • Zoom Event Types
    • Zoom Version
    • county_codes__iso_3166.csv (Country code to country name lookup)

    Scheduled Searches

    Automated searches to gather metadata:

    • Gather Connection Types
    • Gather Network Types
    • Collect Zoom Devices
    • Zoom Event Types
    • Gather Zoom Versions

  10. Overview of Palo Alto Firewall Logs package contents

    main

    This package provides parsing logic and visualization tools for Palo Alto Networks firewall data in Falcon LogScale. It includes:

    Parser

    • Palo Alto Firewall log parser: Converts incoming raw log events into searchable fields.

    Dashboards

    • Summary Dashboard: High-level overview of firewall activity.
    • Metrics Dashboard: Key performance and security metrics.
    • Data Transmission Ratio by Source/Destination IPs: Analyzes traffic volume between network endpoints.
    • External Traffic by Action & Geo location: Visualizes external traffic patterns based on firewall actions and geographic origin.
    • Event View: A view of all events with custom filters for granular analysis.

  12. Overview of CQL Community Content

    main

    The logscale-community-content repository (referred to as CQL Community Content) provides community and field-contributed content for both NG-SIEM and LogScale. The content is written in CrowdStrike Query Language (CQL) and is compatible with both platforms.

    Available content types include:

    • Complete Packages
    • Queries
    • Dashboards
    • Alerts
    • Lookup Files
    • Tutorials and FAQs

    Note: This repository is intended to complement, not replace, the official documentation or the LogScale Package Marketplace.