Getting Data In Process

Here is an overview of the process:

flowchart TD A([Start: Getting Data In]) --> B subgraph PLAN ["Step 1: Plan Your Data Sources"] B[Identify data sources\ne.g. systems, apps, devices] B --> C[Check Falcon LogScale\nMarketplace for packages] end subgraph TOKEN ["Step 2: Set Up an Ingest Token"] D[Create an ingest token\nfor each data source] end subgraph INGEST ["Step 3: Choose Your Ingest Method"] E{Select ingest method} E --> F[Falcon LogScale\nCollector] E --> G[Syslog] E --> H[API] E --> I[Integration\nPackage] end subgraph PACKAGE ["Step 4: Install a Package - Optional"] J[Install package from\nFalcon LogScale Marketplace] J --> K[Parsers, Dashboards,\nAlerts, Saved Queries] end subgraph PROCESS ["⚙️ Step 5: Define Data Processing"] L[Select or configure\na parser] L --> M[Map fields] M --> N[Apply tags] end subgraph VALIDATE ["Step 6: Validate Data Flow"] O[Check data\nis being received] O --> P[Verify data is\nparsed correctly] P --> Q[Test alerts\nand dashboards] end PLAN --> TOKEN TOKEN --> INGEST INGEST --> PACKAGE PACKAGE --> PROCESS PROCESS --> VALIDATE VALIDATE --> R([Data is flowing\ninto Falcon LogScale!])
flowchart TD A([Start: Getting Data In]) --> B subgraph PLAN ["Step 1: Plan Your Data Sources"] B[Identify data sources\ne.g. systems, apps, devices] B --> C[Check Falcon LogScale\nMarketplace for packages] end subgraph TOKEN ["Step 2: Set Up an Ingest Token"] D[Create an ingest token\nfor each data source] end subgraph INGEST ["Step 3: Choose Your Ingest Method"] E{Select ingest method} E --> F[Falcon LogScale\nCollector] E --> G[Syslog] E --> H[API] E --> I[Integration\nPackage] end subgraph PACKAGE ["Step 4: Install a Package - Optional"] J[Install package from\nFalcon LogScale Marketplace] J --> K[Parsers, Dashboards,\nAlerts, Saved Queries] end subgraph PROCESS ["⚙️ Step 5: Define Data Processing"] L[Select or configure\na parser] L --> M[Map fields] M --> N[Apply tags] end subgraph VALIDATE ["Step 6: Validate Data Flow"] O[Check data\nis being received] O --> P[Verify data is\nparsed correctly] P --> Q[Test alerts\nand dashboards] end PLAN --> TOKEN TOKEN --> INGEST INGEST --> PACKAGE PACKAGE --> PROCESS PROCESS --> VALIDATE VALIDATE --> R([Data is flowing\ninto Falcon LogScale!])

Figure 3. Getting started steps


Plan Your Data Sources

Before you begin ingesting data, it is important to identify what data sources you want to bring into LogScale. These could include:

  • Operating systems and servers

  • Applications and services

  • Network devices such as firewalls and routers

  • Cloud platforms and services

  • Security tools and endpoints

Once you have identified your data sources, check the LogScale Package Marketplace for pre-built packages. These packages can significantly simplify the ingestion and analysis process by providing ready-made parsers, dashboards, alerts, and saved queries for many common data sources.

Set up an Ingest Token

An ingest token is required to authenticate data being sent to LogScale. You should create a dedicated ingest token for each data source.

This makes it easier to manage and audit your data ingestion, and allows you to revoke access for a specific source if needed without affecting others.

Choose Your Ingest Method

Falcon LogScale supports multiple methods for ingesting data, giving you the flexibility to choose the approach that best suits your environment:

  • Falcon LogScale Collector - A lightweight agent that can be deployed on your systems to collect and forward log data to LogScale.

  • Syslog - Many systems and devices support the Syslog protocol natively, making this a straightforward option for network devices, firewalls, and other infrastructure components.

  • API - Falcon LogScale provides a powerful API that allows you to send data programmatically, giving you full control over the ingestion process.

  • Integration Package - For supported data sources, an integration package from the LogScale Package Marketplace might provide a streamlined, pre-configured ingestion method.

Install a Package (Optional)

If a package is available in the Falcon LogScale Marketplace for your data source, installing it can save significant time and effort. Packages typically include:

  • Parsers - To automatically structure and interpret your incoming log data.

  • Dashboards - Pre-built visualizations to help you monitor your data source at a glance.

  • Alerts - Pre-configured alerts for common threat scenarios and operational issues.

  • Saved Queries - Ready-to-use queries to help you get immediate value from your data.

Define Data Processing

Once your data is flowing into LogScale, you need to ensure it is being processed correctly. This involves:

  • Selecting or configuring a parser - Parsers interpret your raw log data and structure it into a consistent format that LogScale can work with effectively.

  • Mapping fields - Ensure that the fields in your log data are correctly mapped so that they can be searched and analyzed as expected.

  • Applying tags - Tags help categorize and organize your data, making it easier to filter and query.

Validate Your Data Flow

Before considering your setup complete, it is important to validate that everything is working as expected:

  • Check that data is being received - Confirm that LogScale is receiving data from your source.

  • Verify that data is parsed correctly - Review incoming events to ensure they are being structured and interpreted as expected.

  • Test alerts and dashboards - Confirm that any alerts and dashboards are functioning correctly and reflecting your incoming data.

Summary

Getting data into Falcon LogScale is the essential first step to unlocking the full power of the platform. By centralizing your log data, you gain the visibility, speed, and insight needed to detect threats, investigate incidents, and keep your environment secure and compliant.

Follow the steps above to get started, and refer to the Falcon LogScale documentation for detailed guidance on each ingestion method.