Crowdstrike Core FLTR Package
This package contains a robust set of content for use with Falcon Long Term Repository (FLTR).
This package should be installed in a view linked to your FLTR repo. It is not necessary or recommended to install this directly into the FLTR repo. The FLTR repo should already have the additional crowdstrike/fdr package installed, which contains the parser necessary for this data.
If both packages are mistakenly installed in the FLTR repo, go to Enable scheduled search followed by . Otherwise both packages will be attempting to generate the same file. You only need the FLTR aidmaster Generation scheduled search running.→ → and uncheck
This package is supported by CrowdStrike. For any assistance with installing or using the package please contact us via the support portal, or by email at email@example.com.