The CrowdStrike Falcon Identity Protection Add-on for Splunk Add-on allows ingestion of the CrowdStrike identity data into Splunk enabling the data to be used with other Splunk Apps, such as Enterprise Security.
I don't know if this is a bug or a feature..
In your GraphQL query you set "learned=false" and this limits a lot your results based on Crowdstrike learning status.
Is there a motivation behind this choice?
Thanks in advance.
Bug description
Hi Zach!
I don't know if this is a bug or a feature.. In your GraphQL query you set "learned=false" and this limits a lot your results based on Crowdstrike learning status. Is there a motivation behind this choice? Thanks in advance.
Related links
TA-crowdstrike-identities Version
1.0.0
Splunk Version
9.0.1