QUESTION

How do I redact sensitive data from the EnvironmentVariablesString field in the Panther-managed CrowdStrike FDR schema?

ANSWER

The EnvironmentVariablesString field is ingested as part of the CrowdStrike CrowdStrike FDR schema feed and is populated upstream by CrowdStrike.

To properly redact or prevent sensitive data from appearing in this field, please reach out to CrowdStrike directly and request enabling the appropriate feature flag to redact this field at the source.