Reduce CrowdStrike Falcon Log Volume for Google SecOps
Reduces CrowdStrike Falcon EDR log volume sent to Google SecOps by 30-50% by dropping high-volume, low-signal event types (sensor housekeeping, redundant process termination, benign DNS resolution, and routine network telemetry), pruning verbose fields from retained events, deduplicating repeated entries, and cleaning empty values — while preserving all detection, alert, authentication, and security-relevant events without exception.
Included Processors
Parse CrowdStrike FDR JSON Body
Parses the raw JSON log body into structured attributes so downstream processors can evaluate fields like event_simpleName, DomainName, etc.
Drop Low-Signal Event Types
Drops high-volume CrowdStrike sensor housekeeping and redundant process events that provide no direct value for threat detection or incident response in Google SecOps.
Drop Benign DNS Requests
Filters out DNS resolution events for known-benign infrastructure domains (Microsoft, Apple, Google, Akamai, etc.) that generate high volume with no detection value.
Drop Routine Internal Network Events
Filters out network connection events to loopback and common internal addresses that represent routine inter-process or LAN communication.
Prune Verbose Fields
Removes high-cardinality and verbose fields (ScriptContentBytes, CommandHistory, ConfigBuild, ConfigStateHash) from retained events to reduce payload size without losing detection-relevant data.
Deduplicate Repeated Events
Deduplicates identical CrowdStrike events within a 30-second window, collapsing sensor retransmissions and duplicate telemetry into single entries with a log_count attribute.
Delete Empty Fields
Removes null values, empty maps, empty lists, and empty strings from all remaining events to minimize payload size before ingest.
Google SecOps Standardization
Sets the Google SecOps log type to CS_EDR so Chronicle activates its native CrowdStrike Falcon parser for UDM normalization.
Example Telemetry
Log
| Name | Before | After |
|---|---|---|
| observed_time | 2026-03-17T14:32:01Z | 2026-03-17T14:32:01.000Z |
| time | 2026-03-17T14:32:00.812Z | 2026-03-17T14:32:00.812Z |
| severity_text | INFO | INFO |
| severity_number | 9 | 9 |
Body
{"timestamp":"1742222520812","event_simpleName":"ProcessRollup2","aid":"a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4","ComputerName":"WORKSTATION-0142","ConfigBuild":"1007.4.0018307.1","ContextProcessId":"1234567890123456789","event_platform":"Win","TargetProcessId":"9876543210987654321","ParentProcessId":"1111111111111111111","CommandLine":"C:\\Windows\\System32\\cmd.exe /c whoami","SHA256HashData":"b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\cmd.exe","RawProcessId":"7284","ProcessStartTime":"1742222510.000","ProcessEndTime":"","ScriptContentBytes":"4341544320433A5C57696E646F77735C53797374656D33325C636D642E657865202F6320776F616D69","CommandHistory":"cmd.exe /c whoami;cmd.exe /c ipconfig;cmd.exe /c net user","ConfigStateHash":"abcdef1234567890","TreeId":"9999888877776666","EffectiveTransmissionClass":"3","Tags":""}{"timestamp":"1742222520812","event_simpleName":"ProcessRollup2","aid":"a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4","ComputerName":"WORKSTATION-0142","ConfigBuild":"1007.4.0018307.1","ContextProcessId":"1234567890123456789","event_platform":"Win","TargetProcessId":"9876543210987654321","ParentProcessId":"1111111111111111111","CommandLine":"C:\\Windows\\System32\\cmd.exe /c whoami","SHA256HashData":"b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9","ImageFileName":"\\Device\\HarddiskVolume3\\Windows\\System32\\cmd.exe","RawProcessId":"7284","ProcessStartTime":"1742222510.000","ProcessEndTime":"","ScriptContentBytes":"4341544320433A5C57696E646F77735C53797374656D33325C636D642E657865202F6320776F616D69","CommandHistory":"cmd.exe /c whoami;cmd.exe /c ipconfig;cmd.exe /c net user","ConfigStateHash":"abcdef1234567890","TreeId":"9999888877776666","EffectiveTransmissionClass":"3","Tags":""}Attributes
| Name | Before | After |
|---|---|---|
| CommandLine | C:\Windows\System32\cmd.exe /c whoami | |
| ComputerName | WORKSTATION-0142 | |
| ContextProcessId | 1234567890123456789 | |
| ImageFileName | \Device\HarddiskVolume3\Windows\System32\cmd.exe | |
| ParentProcessId | 1111111111111111111 | |
| ProcessStartTime | 1742222510.000 | |
| RawProcessId | 7284 | |
| SHA256HashData | b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9 | |
| TargetProcessId | 9876543210987654321 | |
| aid | a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4 | |
| chronicle_log_type | CS_EDR | |
| event_platform | Win | |
| event_simpleName | ProcessRollup2 | |
| timestamp | 1742222520812 |