Skip to content

Commit dd791e1

Browse files
authored
Update crowdstrike-falcon-filevantage.md
1 parent 624c837 commit dd791e1

File tree

1 file changed

+6
-7
lines changed

1 file changed

+6
-7
lines changed

docs/integrations/saas-cloud/crowdstrike-falcon-filevantage.md

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,15 +24,15 @@ Use cases for the CrowdStrike Falcon FileVantage app include:
2424
- **Threat investigation**. Investigate suspicious file modifications to uncover potential breaches or insider threats.
2525
- **Host Activity Analysis**. Analyze file changes at the host level to identify risky behaviors or compromised endpoints.
2626

27-
The Sumo Logic app for CrowdStrike Falcon FileVantage is an essential tool for security teams. It provides the visibility and intelligence needed to detect and respond to file-related threats, ensuring data integrity and compliance across the organization.
27+
The Sumo Logic app for CrowdStrike Falcon FileVantage is an essential tool for security teams. It provides the visibility and intelligence needed to detect and respond to file-related threats, ensuring data integrity, and compliance across the organization.
2828

2929
:::info
30-
This app includes [built-in monitors](#crowdstrike-falcon-filevantage-monitors). For details on creating custom monitors, refer to [Create monitors for CrowdStrike Falcon FileVantage app](#create-monitors-for-crowdstrike-falcon-filevantage-app).
30+
This app includes [built-in monitors](#crowdstrike-falcon-filevantage-monitors). For details on creating custom monitors, refer to the [Create monitors for CrowdStrike Falcon FileVantage app](#create-monitors-for-crowdstrike-falcon-filevantage-app).
3131
:::
3232

3333
## Log types
3434

35-
This App uses Sumo Logic’s [CrowdStrike FileVantage Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-filevantage-source/) to collect the FileVantage logs from CrowdStrike.
35+
This app uses Sumo Logic’s [CrowdStrike FileVantage Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-filevantage-source/) to collect the FileVantage logs from CrowdStrike platform.
3636

3737
### Sample log message
3838

@@ -131,16 +131,15 @@ import ViewDashboards from '../../reuse/apps/view-dashboards.md';
131131

132132
### Overview
133133

134-
The **CrowdStrike Falcon FileVantage - Overview** dashboard provides a comprehensive overview of file and directory activity, helping security analysts monitor file integrity and identify potential risks. It provides a total count of the file changes, categorizing them by severity**Critical**, **High**, **Medium**, and **Low**to prioritize investigations. Suppressed changes, which are ignored due to predefined policies, are also highlighted.
134+
The **CrowdStrike Falcon FileVantage - Overview** dashboard provides a comprehensive overview of file and directory activity, helping security analysts monitor file integrity, and identify potential risks. It provides a total count of the file changes, categorizing them by severity: **Critical**, **High**, **Medium**, and **Low**, to prioritize investigations. Suppressed changes, which are ignored due to predefined policies are also highlighted.
135135

136-
Key metrics include file change types (**WRITE**, **RENAME**, **READ** **PERMISSION**, **OTHERS**, **DELETE**), displayed in an easy-to-read pie chart for quick analysis. The dashboard tracks changes by operating system, identifies top hosts and users making changes, and highlights threats or anomalies.
136+
Key metrics include file change types (**WRITE**, **RENAME**, **READ** **PERMISSION**, **OTHERS**, and/or **DELETE**), displayed in an easy-to-read pie chart for quick analysis. The dashboard tracks changes by operating system, identifies top hosts and users making changes, and highlights threats or anomalies.
137137

138138
The dashboard also shows the monitoring rules that triggered the most changes, assisting in policy refinement. A detailed table of recent file activities, including timestamps, hostnames, file paths, severities, and associated policies, is provided. Overall, the dashboard strengthens the detection and response to unauthorized or suspicious file activities. <br/> <img src={useBaseUrl('https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/Crowdstrike+Falcon+FileVantage/Crowdstrike+Falcon+FileVantage+dashboard.png')} alt="CrowdStrike Falcon FileVantage Overview" style={{border: '1px solid gray'}} width="800" />
139139

140-
141140
### Security
142141

143-
The **CrowdStrike Falcon FileVantage - Security** dashboard is tailored for security analysts to monitor high-risk file actions and potential policy violations. It categorizes file activities based on severity (**CRITICAL**, **HIGH**, **LOW**, **MEDIUM**) and action types, such as file creation, deletion, renaming, and attribute changes. This categorization helps analysts prioritize their responses to significant security events.
142+
The **CrowdStrike Falcon FileVantage - Security** dashboard is tailored for security analysts to monitor high-risk file actions and potential policy violations. It categorizes file activities based on severity (**CRITICAL**, **HIGH**, **LOW**, and **MEDIUM**) and action types, such as file creation, deletion, renaming, and attribute changes. This categorization helps analysts prioritize their responses to significant security events.
144143

145144
The dashboard tracks high-risk actions over time, enabling security teams to identify patterns or spikes in suspicious activity. There is also a dedicated section for policy violations, which lists instances where file changes conflict with configured security policies. This section includes details such as affected files, associated rules, and timestamps.
146145

0 commit comments

Comments
 (0)