Skip to content
LogScale Self-Hosted
This is an archived version of the documentation downloaded from LogScale Documentation Archives. Up to date documentation, and documentation for later versions, is available on LogScale Documentation

### Ingesting FDR Data into a Repository

To ingest any data from FDR, you must have at least one FDR feed established on a Falcon instance with data flowing into it.

### Important

Non-FDR data should not be ingested into an FDR repository.

To set up an FDR feed on your Falcon instance, please follow the instructions in the official Falcon documentation.

### Note

Falcon documentation is only available to CrowdStrike customers; you must have a Falcon instance in order to read it.

Once you have an FDR feed set up in Falcon, you can make LogScale ingest data from it into a particular repository by creating an FDR feed component.

When an FDR feed component has been created, it will spawn a polling process on all designated LogScale nodes, which will then poll data from the FDR feed and ingest it into the LogScale repository.

In Falcon, an FDR Feed consists of two AWS resources, an SQS queue and an S3 bucket.

As log data is generated within Falcon, it will be stored in the S3 bucket as files, and the SQS queue will have messages added to it, which point to those files.

The basic flow of the polling process spawned within LogScale is:

- Pull a message off the SQS queue.

- Identify S3 file identifiers contained within the message.

- Download the files from the S3 bucket.

- Ingest the file contents into the repository.

- Delete the message from the SQS queue, so it is not read again.

To create an FDR feed component so that polling can commence, decide which repository to ingest into and then:

1. Go to `Repositories and Views` page and select a relevant repository.

2. Click Settings, under Ingest in the side menu click CrowdStrike FDR.

3. On the `CrowdStrike FDR` page, click New FDR Feed.

4. In the New FDR feed dialog box, fill out the fields prompted.

   See Parser, Client ID & Client Secret, S3 Identifier, and SQS URL for more details.

5. Click Save.

Alternatively, you can use the GraphQL API to perform FDR related functions: createFdrFeed() to create an FDR feed; updateFdrFeed() to update; and deleteFdrFeed() to delete a feed.

To get a list of FDR feeds, you'll have to use repository() with the fdrFeeds parameter. Use the fdrFeed parameter for details on a particular FDR feed when you have its ID.

In the following, we cover some of the fields that must be set on an FDR feed component during creation.

### Note

The contents of most of these fields can be copied directly from the Falcon UI and relate to the SQS queue and S3 bucket.

You can find them under the API Clients and Keys page for your Falcon instance relating to your particular FDR feed.

#### Parser

Specifies which LogScale parser should be used to parse the FDR data upon ingest.

We recommend that you use the official FDR parser for this, which you can get access to by installing the crowdstrike/fdr package into your repository.

To install it in a repository go to Settings, under Packages in the side menu click Marketplace, select the crowdstrike/fdr application and click Install package.

For more details, read about Package Management.

#### Client ID and Client Secret

The client ID and client secret are AWS credentials used for accessing the AWS resources.

### Important

You are only shown the client secret once in the Falcon UI, so you must make sure to store it in a safe location for later use.

Likewise, LogScale treats the client secret as a confidential field.

This means that it cannot be read. After you have saved your FDR component, it can only be overwritten.

#### S3 Identifier

This URI is a unique identifier for the AWS S3 bucket, which is a part of the FDR Feed.

url

    s3://<BUCKET_NAME>/data

Where `BUCKET_NAME` is an id unique to your bucket.

The identifier is used to validate that messages pulled from the SQS queue point to the expected S3 bucket before any ingest takes place.

#### SQS URL

This URL is an identifier for the AWS SQS queue, which is a part of the FDR Feed.

url

    https://sqs.us-west-2.amazonaws.com/

#### Enter search term