# Crowdstrike Fleet Integration Ingest Pipeline Modifies Agent Fields

**URL:** <https://discuss.elastic.co/t/crowdstrike-fleet-integration-ingest-pipeline-modifies-agent-fields/313368>\
**Category:** Elastic Agent\
**Tags:** fleet\
**Created:** [August 31, 2022, 2:37pm UTC](https://discuss.elastic.co/t/crowdstrike-fleet-integration-ingest-pipeline-modifies-agent-fields/313368 "2022-08-31T14:37:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![BrianD](https://avatars.discourse-cdn.com/v4/letter/b/e9c0ed/32.png) [@BrianD](https://discuss.elastic.co/u/BrianD)\
**Post date:** [August 31, 2022, 2:37pm UTC](https://discuss.elastic.co/t/crowdstrike-fleet-integration-ingest-pipeline-modifies-agent-fields/313368/1 "2022-08-31T14:37:15Z")

</div>

From my understanding, the 'agent' field holds information about the filebeat agent used to pull in data from the Fleet integration. However, the Crowdstrike integration makes several changes to the 'agent.type' and 'agent.id' fields in the Ingest Pipeline ' logs-crowdstrike.falcon-1.5.0-detection\_summary'. It does the following....

```auto
{
    "set": {
      "field": "agent.type",
      "value": "falcon"
    }
  },
{
    "convert": {
      "field": "crowdstrike.event.SensorId",
      "target_field": "agent.id",
      "type": "string",
      "ignore_failure": true,
      "ignore_missing": true
    }
  }

```

Should these be removed from the default pipeline so that updates to this pipeline don't revert my changes? Who needs to know so this can be fixed?

Edit: I also noticed similar processors in 'logs-crowdstrike.falcon-1.5.0-incident\_summary'

Thanks,  
Brian Dutill

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 28, 2022, 2:37pm UTC](https://discuss.elastic.co/t/crowdstrike-fleet-integration-ingest-pipeline-modifies-agent-fields/313368/2 "2022-09-28T14:37:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.