The Falcon Data Replicator replicates log data from your CrowdStrike environment to a stand-alone target. This target can be a location on the file system, or a cloud storage bucket.
Currently AWS is the only cloud provider implemented.
- Python 3.6+
- boto3
- CrowdStrike Falcon FDR credentials
- CrowdStrike Falcon FDR SQS queue URL
- falcon_data_replicator.ini - Configuration file
- standalone/falcon_data_replicator.py - Stand-alone solution application file
The falcon_data_replicator.ini file contains all of the parameters necessary to configure the
solution for replication to the local file system and / or a storage bucket in AWS S3. After
retrieving the AWS credentials and SQS queue details from your Falcon console, edit this file
to reflect your environment.
The following parameters must be provided in order for the solution to operate.
AWS_KEY- AWS client ID provided to you by the CrowdStrike Falcon consoleAWS_SECRET- AWS client secret provided to you by the CrowdStrike Falcon consoleQUEUE_URL- AWS SQS queue URL provided to you by the CrowdStrike Falcon consoleOUTPUT_PATH- File path where downloaded files will be stored, not used for in-memory transfersVISIBILITY_TIMEOUT- Time in seconds before a message is returned back to the SQS queueREGION_NAME- The name of the AWS region where your CrowdStrike SQS queue residesMESSAGE_DELAY- The time in seconds to wait in between the processing of each messageQUEUE_DELAY- The time in seconds to wait before each check of the queue for more messagesLOG_FILE- The name and path of the the log file
The following parameters configure our destination details. If not these parameters are not present, upload to our bucket is skipped and the local files are retained after download.
TARGET_BUCKET- The name of the AWS bucket we will use for our target destinationTARGET_REGION- The name of the AWS region our target bucket resides withinREMOVE_LOCAL_FILE- Boolean representing whether or not to remove local files after they are uploadedIN_MEMORY_TRANSFER_ONLY- Transfer the file from the source bucket to the destination bucket without storing the file on the local file system.
After updating the configuration file to reflect your environment specifics, you can run this solution using:
python3 falcon_data_replicator.pyIf your configuration file is not present in the same directory as the application file, you can reference this path using the -f or --config_file command line parameters.
python3 falcon_data_replicator.py -f some_path/falcon_data_replicator.iniComing soon