You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-fdr-source.md
+1-2Lines changed: 1 addition & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -48,7 +48,6 @@ To configure a CrowdStrike FDR Source:
48
48
1. Search for and select **CrowdStrike FDR**.
49
49
1. Enter a **Name** for the Source. The description is optional.
50
50
1. (Optional) For **Source Category**, enter any string to tag the output collected from the Source. Category metadata is stored in a searchable field called `_sourceCategory`.
51
-
1.**Forward to SIEM**. Check the checkbox to forward your data to Cloud SIEM. When configured with the **Forward to SIEM** option no fields are set.
52
51
1. (Optional) **Fields.** Click the **+Add Field** link to define the fields you want to associate, each field needs a name (key) and value.
53
52
* A green circle with a check mark is shown when the field exists in the Fields table schema.
54
53
* An orange triangle with an exclamation point is shown when the field doesn't exist in the Fields table schema. In this case, an option to automatically add the nonexistent fields to the Fields table schema is provided. If a field is sent to Sumo that does not exist in the Fields schema it is ignored, known as dropped.
@@ -84,7 +83,7 @@ Sources can be configured using UTF-8 encoded JSON files with the Collector Ma
84
83
| name | String | Yes |`null`| Type a desired name of the source. The name must be unique per Collector. This value is assigned to the [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) field `_source`. |`"mySource"`|
85
84
| description | String | No | `null` | Type a description of the source. | `"Testing source"`
86
85
| category | String | No | `null` | Type a category of the source. This value is assigned to the [metadata](/docs/search/get-started-with-search/search-basics/built-in-metadata) field `_sourceCategory`. See [best practices](/docs/send-data/best-practices) for details. | `"mySource/test"`
87
-
| fields | JSON Object | No |`null`| JSON map of key-value fields (metadata) to apply to the Collector or Source. Use the boolean field `_siemForward` to enable forwarding to SIEM.|`{"_siemForward": false, "fieldA": "valueA"}`|
86
+
| fields | JSON Object | No |`null`| JSON map of key-value fields (metadata) to apply to the Collector or Source. |`{"fieldA": "valueA"}`|
88
87
| secretAccessKey` | String | Yes || The AWS Secret Access Key you got from CrowdStrike. ||
89
88
| SqsQueueURL | String | Yes |`null`| The SQS Queue URL you got from CrowdStrike. ||
90
89
| accessKeyId | String | Yes |`null`| The AWS Access Key ID you got from CrowdStrike. ||
0 commit comments