Important

This package should be installed in a view linked to your FLTR repo. It is not necessary or recommended to install this directly into the FLTR repo. The FLTR repo should already have the additional crowdstrike/fdr package installed, which contains the parser necessary for this data.

If both packages are mistakenly installed in the FLTR repo, go to Alerts → Scheduled Searches → FDR aidmaster Scheduled Search and uncheck Enable scheduled search followed by Save Scheduled Search. Otherwise both packages will be attempting to generate the same file. You only need the FLTR aidmaster Generation scheduled search running.