CrowdStrike Integration

You can use CrowdStrike as a source or a destination. Continue below to integrate as a source for CrowdStrike Falcon Data Replicator (FDR), or click here to send logs to CrowdStrike Next-Gen SIEM.

CrowdStrike FDR as a Source

Create CrowdStrike FDR Feed

1. Log in to CrowdStrike Falcon Console
2. Go to Support and resources > Falcon data replicator

3. Click Create Feed

4. Fill out the feed details:

   Feed name: Realm.Security

5. Turn the feed on
6. Leave Default settings selected

7. Click Next
8. Click Create feed

9. Copy the ClientID and save it in a safe place
10. Copy the Secret and save it in a safe place — you will not be able to see it again

11. Copy the Notifications URL

Configure CrowdStrike FDR in Realm

1. In Realm, go to Sources
2. Click Add Source and select CrowdStrike FDR
3. Fill in the connection details:

   Name: CrowdStrike FDR
   Queue URL: The Notifications URL copied in step 11
   Client ID: The Client ID copied in step 9
   Client Secret: The Secret copied in step 10

4. Click Save

Realm will begin polling the CrowdStrike FDR queue and ingesting Falcon telemetry events into your data pipeline.

CrowdStrike NGSIEM as a Destination

One Connector and Output Feed per Source

NGSIEM applies a single parser to every event received by a connector. To have each log type parsed correctly, set up a separate NGSIEM connector and a separate Realm output feed for every source you send to CrowdStrike NGSIEM. Do not route multiple sources through one connector.

For each source:

1. Create a dedicated Event connector in NGSIEM, selecting the parser that matches that source (see Fill Out the Add New Connector Form)
2. Generate an API key and copy the API URL for that connector
3. In Realm, create an output feed for that source using that connector's API URL and API key

Example: If you send Okta, Palo Alto Networks, and Zscaler logs to NGSIEM, create three connectors (one per parser) and three output feeds in Realm, each pointing at its own connector.

Send Logs from Realm to CrowdStrike NGSIEM

Repeat the steps below for each source you send to NGSIEM.

Find the Event Connector

1. Log in to the CrowdStrike Falcon Platform console
2. Go to Next-Gen SIEM > Data onboarding

3. Search by Product:

   Falcon Logscale

4. Select Logscale Event connector
5. Click Configure

Fill Out the Add New Connector Form

1. Fill out the connector details:

   Connection Name: Realm.Security - <Source Name> (e.g. Realm.Security - Okta) (this value gets stored in a field along with the data)
   Description: Receive <Source Name> logs from Realm.Security
   Parser: The NGSIEM parser for the source's log type

   Note: If NGSIEM does not provide a parser for a source you need to send, create a custom parser in NGSIEM and select it here. In the Realm output feed for that source, select JSON as the output format so NGSIEM receives Realm-parsed JSON.

2. Select the T&C checkbox

3. Click Create Connection

NOTE: when forwarding logs from Realm, you have a choice of sending logs either in RAW format (as generated by the source product) or JSON format (as parsed by Realm.) Typically when a parser for a log type is available in NGSIEM, it is recommended to forward RAW logs. When a parser for a log type is not available in NGSIEM or it is available but not working as expected, forward JSON logs from Realm. The setting whether to forward RAW or JSON can be configured on the output feed form in Realm console.

Get the API Key and API URL

1. A connector setup in progress confirmation dialog will appear — click Close
2. While the connector is being set up, copy the API URL from the connector details page

3. Setting up the connector may take a while. Refresh the connector details page. Once the connector is set up, click Generate API key
4. Copy the API Key and save it in a safe place — you will need to enter it in the Realm console

5. Copy the API URL — you will need to enter it in the Realm console

---

Export Detections for Detection Integrity

Detection Integrity checks your log optimization rules against your Splunk detections, so optimizations never drop data a detection depends on. Export your detections as described below, then upload them to Realm.

Export all relevant Next-Gen SIEM rules using following option:

Export rules from Falcon console

See CrowdStrike Documentation Portal > Next-Gen SIEM > Rules > Manage rule versions

1. In Falcon console: Go to Next-Gen SIEM > Monitor and investigate > Rules .
2. Filter the list of rules by selecting Type: Correlation Rule, Type: Behavioral Rule, Status: Active.

3. Click on the ellipses to open rule setting, select Export rule.
4. Rule export in progress message shown as a YAML file is downloaded locally.

Upload the Export to Realm

Upload the exported file as described in Upload Detections to Realm, selecting your NGSIEM destination.

Support

For additional details, refer to the official CrowdStrike documentations:

CrowdStrike Documentation Portal

If you encounter any issues or require assistance, contact Realm Security support.