Falcon Cloud sensor/adapter

Hello! I am new to Lima Charlie; I am attempting to ship CrowdStrike’s Falcon Sensor logs to LC. I followed this doc to add the Falcon Cloud sensor to LC (provided the Client ID and Client Secret from the API key I created in CrowdStrike’s portal). Notably, I was not prompted to specify the CrowdStrike region. A few seconds after clicking on the Cloud Adapter Install button, the new sensor is detected, but it is unable to load. Looking at the Platform Logs, I see the following error message: adapter: unknown sensor type: falconcloud. I cannot find any information about this error. I should note, the API key I created in CrowdStrike has scope of “Event Stream” with Read Only permissions. I have tried two other scopes, to no avail (App Logs and Falcon Data Replicator).

Another note: if I attempt to edit the sensor I created, regardless of what type of change (even adding a tag), I present with the following error message: lc_error_code: INVALID - cloudsensor/<name of adapter>: sensor_type not configured.

Any thoughts on how to fix this error message? Thank you for your time.

Hi there–this one is new as of last week and one piece of it didn’t get deployed to all regions. We’re working through it and can post an update here soon.

1 Like

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.