Managing Repositories for Falcon LTR
Falcon LTR repositories offer a way to analyze your existing Falcon data easily. Your FDR data is set up to flow into a dedicated repository, which comes preinstalled with an FDR parser and relevant dashboards through the official crowdstrike/fdr package.
Figure 50. Falcon Repository
The Falcon repository is labeled as Managed in the list of repositories, meaning that some of its settings are locked and managed externally.
Note
The organization owner cannot change the Falcon LTR from Managed to Default in the repository list.
As a Managed repository, Falcon LTR has the following restrictions:
You are prevented from changing these settings: dataspace type, FDR settings, retention settings, parsers.
You won't be able to configure ingest tokens — your Falcon data will only be ingested automatically.
You can create views on top of your Managed repository without the above limitations, but you can't enrich the data from this repository during parsing.
However, you are still able to create dashboards, alert, scheduled searches and manage permissions for this repository.
Authentication and Adding Collaborators
If you are using Falcon LTR, you will be able to access the product through Falcon SSO. You can add collaborators by creating additional Falcon users on the company account. Then the LogScale organization owner can add additional users with the right permissions and eventually share the sign up URL (company-specific subdomain, e.g. https://mycompany.us.humio.com/) with them.
You could also set up alternative authentication methods (see Security & Authentication) — in this case, you will need to start to login from your IDP (for example through an Okta tile).