This package is installed from the LogScale Marketplace and requires that Falcon LTR is already provisioned. Installing the package will automatically deploy the Falcon Identity Protection dashboards and saved searches. This is meant to be installed in a view of the Falcon telemetry data, not the repo.

This package assumes the following:

  • CrowdStrike FDR parser has been installed.

  • CrowdStrike Falcon Identity Protection is being sent to LogScale.