elastic / elastic/integrations

[crowdstrike/fdr] logfile input not compatible with falcon_data_replicator.py

Open
#2,194 9 comments 1 reaction 1 assignee Assigned to @sharad-elastic View on GitHub
bug Category: Integration quality Integration:crowdstrike Team:SDE-Crest Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 18h
Merged PRs (30d)
182

Description

The Crowdstrike FDR data stream contains a logfile input with the implied purpose of reading the logs written by https://github.com/CrowdStrike/FDR/blob/main/standalone/falcon_data_replicator.py. This script dumps `.gz` files from the S3 bucket onto the local filesystem. (The script can also replicate the files to your own S3 bucket. This along with SQS notification on your own bucket can be used with the s3 input part of the the integration.)

The problem is that the logfile input does not support reading from gzip files. So there's no way this can be compatible until https://github.com/elastic/beats/issues/637 is implemented. (The aws-s3 input can uncompress the gzip files so that's not a problem.)

Either we need to enhance the logfile input to support gzip or we need to remove the input from this integration since it cannot work.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.