Migrate off CrowdStrike FDR legacy schemas by April 13, 2026

Last updated: March 23, 2026

CrowdStrike has announced that starting January 12, 2026, all event fields sent by Falcon Data Replicator (FDR) will be Strings (except complex types, which will continue being sent as-is). To comply with this change and avoid log ingestion interruption, please work with Panther to migrate off the legacy FDR schemas to the FDREvent schema before April 13, 2026.

The migration process is as follows:

Migrate all detections and Saved Searches referencing the legacy schemas to the new schema.
- See the How can I adapt my custom Panther CrowdStrike detections and queries using legacy schemas to work with the Crowdstrike.FDREvent schema? article for assistance during this process.
Inform Panther support when you have finished migrating all detections and Saved Searches.

If you have any questions, please reach out to support.