Skip to main content
Sumo Logic

Install the CrowdStrike Falcon App and view the Dashboards

This page has instructions for installing the Sumo App for CrowdStrike Falcon Platform and descriptions of each of the app dashboards.

This page provides instructions for installing the Sumo App for CrowdStrike Falcon, as well as examples for each of the app dashboards.

Install the App

This section demonstrates how to install the CrowdStrike Falcon App.

To install the app, do the following:

Locate and install the app you need from the App Catalog. If you want to see a preview of the dashboards included with the app before installing, click Preview Dashboards.

  1. From the App Catalog, search for and select the app. 
  2. To install the app, click Add to Library and complete the following fields.
    1. App Name. You can retain the existing name, or enter a name of your choice for the app.

    2. Data Source. Select either of these options for the data source.

      • Choose Source Category, and select a source category from the list.

      • Choose Enter a Custom Data Filter, and enter a custom source category beginning with an underscore. Example: (_sourceCategory=MyCategory).

    3. Advanced. Select the Location in Library (the default is the Personal folder in the library), or click New Folder to add a new folder.
  3. Click Add to Library.

Once an app is installed, it will appear in your Personal folder, or other folder that you specified. From here, you can share it with your organization. 

Panels will start to fill automatically. It's important to note that each panel slowly fills with data matching the time range query and received since the panel was created. Results won't immediately be available, but with a bit of time, you'll see full graphs and maps. 

Dashboard filters

Each dashboard has a set of filters that you can apply to the entire dashboard, as shown in the following example. Click the funnel icon in the top dashboard menu bar to display a scrollable list of filters that are applied across the entire dashboard.

CSF_Platform_Dashboard_filter.png

Each panel has a set of filters that are applied to the results for that panel only, as shown in the following example. Click the funnel icon in the top panel menu bar to display a list of panel-specific filters.

CSF_Platform_Panel_Filters.png

CrowdStrike - Falcon - Overview Dashboard

The CrowdStrike - Falcon - Overview dashboard provides high-level visibility into the state of endpoints that are managed by the ClowdStrike Falcon platform. Panels provide insights into events, detections, authentications, and detection status updates for overall security posture and an analysis of user activities.

Use this dashboard to:

  • Understand the overall security posture of your environment as analyzed by CrowdStrike Falcon deployed in your network.
  • Analyze user activities within the Falcon Console.
  • Review all detection updates.

CSF_Platform_Overview.png

CrowdStrike - Falcon - Authentication Dashboard

The CrowdStrike - Falcon - Authentication dashboard provides visibility into authentication related user activities and their geographic locations. Panels also display detailed information for authentication comparisons and trends, requested auth secrets, 2 factor authentication, API client events, and failed events.  

Use this dashboard to:

  • Analyze user activities within your Falcon Console and geographic location of the users responsible for these activities.
  • Identify failed authentication events, user logins with and without 2 factor authentication.
  • Detect OAuth2 API key access events.

CSF_Platform_Authentication.png

CrowdStrike - Falcon - Detections Dashboard

The CrowdStrike - Falcon - Detections dashboard provides visibility into malicious behavior in your environment, where you can analyze group detections, discover blocked detections, and analyze detection trends by type. Panels also display detailed analysis of detected malware and help quickly identify hosts with the most detected malware.

Use this dashboard to:

  • Investigate malicious behavior across your endpoints.
  • Analyze group detections by users, tactic, technique, and objective.
  • Discover trending IOCs in your network.
  • Identify malicious attempts that were blocked by CrowdStrike Falcon.
  • Review detailed analysis of malware detected in the Detection Summary panel.
  • Find hosts in your network with the most detected malware. Use pre-built links toto go to the Falcon Console, so as to assign detection events and take action.

CSF_Platform_Detections.png

CrowdStrike - Falcon - Detection Status Update Dashboard

The CrowdStrike - Falcon - Detection Status Update dashboard provides high-level and detailed insights into the status of severity event detection in your CrowdStrike environment. Panels display event geographic locations, event classification by operation, details on quarantined files, and updates on policies and groups.

Use this dashboard to:

  • Find and analyze any updates to malware detections by CrowdStrike Falcon users.
  • Identify quarantined files.

CSF_Platform_Detection_Status_Update.png