Configuring App

After you install Veeam App for CrowdStrike Falcon LogScale, you need to configure data ingestion. To do this, perform the following steps:

  1. Add an ingest token.
  2. Create a log collector configuration.

Adding Token

To add an ingest token, do the following:

  1. Log in to CrowdStrike and select a repository.
  2. In the CrowdStrike bar, click Settings.
  3. In the Ingest section, click Ingest tokens > Add token.
  4. Specify the name of the token. In the Assigned parser field, select veeam-veeamdataplatform.
  5. Click Create token.

Configuring App 

Creating Log Collector Configuration

To create a log collector configuration, do the following:

  1. Copy the ID of the ingest token you created. To do this, click See token and click the copy icon.
  2. In the CrowdStrike bar, click Home. Then, click Data Ingest.
  3. In the Config overview section, click New config.
  4. Specify the configuration name, select Empty config and click Create new.

Configuring App 

  1. In the draft editor, do the following:
  1. In the sources section, specify the minimum settings for collecting syslog messages:
  • type — Source type. Specify syslog.
  • mode — Transport protocol used by the syslog server. Default values are TCP, UDP or TLS.
  • port — Port number used by the syslog server. Default values are 514 (for TCP and UDP) and 6514 (for TLS).
  • sink — Name of the destination for syslog messages specified in the sinks section.
  • maxEventSize — Maximum allowed syslog event size. Recommended value is 1048576.
  1. In the sinks section, specify your ingest token ID.

For more information about all configuration parameters, see Falcon Log Collector documentation.

  1. Test your configuration and click Publish.

Configuring AppConfiguration Example

 

sources:

 # Collect syslog udp 514.

 syslog_udp_514:

   type: syslog

   mode: udp

   port: 514

   sink: logscale

   maxEventSize: 1048576

 # Collect syslog tcp 514.

 syslog_tcp_514:

   type: syslog

   mode: tcp

   port: 514

   sink: logscale

   maxEventSize: 1048576

sinks:

 logscale:

   type: humio

   # Replace with your ingest token.

   token: 1b6203ea-ee2d-491b-a3e8-d83c2901ef88

   # Replace with the "Ingest URL" on the FLC download page. It must include the "https://" at the beginning.

   url: https://example.com

Important

To display data correctly, the format of syslog messages sent to Veeam App for CrowdStrike Falcon LogScale must be the same as on Veeam Backup & Replication and Veeam ONE. For more information, see Specifying Syslog Servers in the Veeam Backup & Replication User Guide and Syslog Integration in the Veeam ONE Monitoring Guide.