---
url: https://docs.realmsec.info/integration/crowdstrike.md
---

# CrowdStrike Integration

You can use CrowdStrike as a source or a destination. Continue below to integrate as a source for CrowdStrike Falcon Data Replicator (FDR), or [click here](#crowdstrike-ngsiem-as-a-destination) to send logs to CrowdStrike Next-Gen SIEM.

## CrowdStrike FDR as a Source

### Create CrowdStrike FDR Feed

1. Log in to CrowdStrike Falcon Console
2. Go to **Support and resources > Falcon data replicator**

![CS FDR Support and Resources menu](../images/cs-fdr-1-support-resources.png)

3. Click **Create Feed**

![CS FDR Create feed](../images/cs-fdr-2-create-feed.png)

4. Fill out the feed details:
   > **Feed name:** `Realm.Security`
5. Turn the feed on
6. Leave **Default settings** selected

![CS FDR create feed default](../images/cs-fdr-3-create-feed-default.png)

7. Click **Next**
8. Click **Create feed**

![CS FDR create feed](../images/cs-fdr-4-create-feed.png)

9. Copy the **ClientID** and save it in a safe place
10. Copy the **Secret** and save it in a safe place — you will not be able to see it again

![CS FDR Copy secret](../images/cs-fdr-5-copy-secret.png)

11. Copy the **Notifications URL**

![CS FDR Copy notifications URL](../images/cs-fdr-6-copy-notifications-url.png)

### Configure CrowdStrike FDR in Realm

1. In Realm, go to **Sources**
2. Click **Add Source** and select **CrowdStrike FDR**
3. Fill in the connection details:
   > **Name:** `CrowdStrike FDR`\
   > **Queue URL:** The Notifications URL copied in step 11\
   > **Client ID:** The Client ID copied in step 9\
   > **Client Secret:** The Secret copied in step 10
4. Click **Save**

Realm will begin polling the CrowdStrike FDR queue and ingesting Falcon telemetry events into your data pipeline.

## CrowdStrike NGSIEM as a Destination

### One Connector and Output Feed per Source

NGSIEM applies a single parser to every event received by a connector. To have each log type parsed correctly, set up a separate NGSIEM connector and a separate Realm output feed for **every source** you send to CrowdStrike NGSIEM. Do not route multiple sources through one connector.

For each source:

1. Create a dedicated Event connector in NGSIEM, selecting the parser that matches that source (see [Fill Out the Add New Connector Form](#fill-out-the-add-new-connector-form))
2. Generate an API key and copy the API URL for that connector
3. In Realm, create an output feed for that source using that connector's API URL and API key

> **Example:** If you send Okta, Palo Alto Networks, and Zscaler logs to NGSIEM, create three connectors (one per parser) and three output feeds in Realm, each pointing at its own connector.

### Send Logs from Realm to CrowdStrike NGSIEM

Repeat the steps below for each source you send to NGSIEM.

#### Find the Event Connector

1. Log in to the CrowdStrike Falcon Platform console
2. Go to **Next-Gen SIEM > Data onboarding**

![CrowdStrike Next Gen SIEM menu](../images/cs-1-nextgensiem-data-onboarding.png)

3. Search by Product:
   > `Falcon Logscale`

![Falcon Logscale collector](../images/falcon-logscale-collector.jpg)

4. Select **Logscale Event connector**
5. Click `Configure`

#### Fill Out the Add New Connector Form

1. Fill out the connector details:

   > **Connection Name:** `Realm.Security - <Source Name>` (e.g. `Realm.Security - Okta`) *(this value gets stored in a field along with the data)*\
   > **Description:** `Receive <Source Name> logs from Realm.Security`\
   > **Parser:** The NGSIEM parser for the source's log type

   > **Note:** If NGSIEM does not provide a parser for a source you need to send, create a custom parser in NGSIEM and select it here. In the Realm output feed for that source, select **JSON** as the output format so NGSIEM receives Realm-parsed JSON.
2. Select the **T\&C** checkbox
3. Click **Create Connection**

> NOTE: when forwarding logs from Realm, you have a choice of sending logs either in RAW format (as generated by the source product) or JSON format (as parsed by Realm.) Typically when a parser for a log type is available in NGSIEM, it is recommended to forward RAW logs. When a parser for a log type is not available in NGSIEM or it is available but not working as expected, forward JSON logs from Realm. The setting whether to forward RAW or JSON can be configured on the output feed form in Realm console.

![alt text](../images/cs-create-connector.png)

#### Get the API Key and API URL

1. A connector setup in progress confirmation dialog will appear — click **Close**
2. While the connector is being set up, copy the **API URL** from the connector details page

![Copy API Key](../images/cs-4-copy-api-key.png)

3. Setting up the connector may take a while. Refresh the connector details page. Once the connector is set up, click **Generate API key**
4. Copy the **API Key** and save it in a safe place — you will need to enter it in the Realm console

![API Key](../images/cs-5-generate-api-key.png)

5. Copy the **API URL** — you will need to enter it in the Realm console

![API URL](../images/cs-6-api-url.png)

***

## Export Detections for Detection Integrity

[Detection Integrity](/product/detection_integrity) checks your log optimization rules against your Splunk detections, so optimizations never drop data a detection depends on. Export your detections as described below, then upload them to Realm.

Export all relevant Next-Gen SIEM rules using following option:

### Export rules from Falcon console

See [CrowdStrike Documentation Portal > Next-Gen SIEM > Rules > Manage rule versions](https://docs.crowdstrike.com/home)

1. In Falcon console: Go to Next-Gen SIEM > Monitor and investigate > Rules .
2. Filter the list of rules by selecting `Type: Correlation Rule`, `Type: Behavioral Rule`, `Status: Active`.

![alt text](../images/CSNGSIEM_type.png)

![alt text](../images/CSNGSIEM_status.png)

3. Click on the ellipses to open rule setting, select `Export rule`.
4. `Rule export in progress` message shown as a YAML file is downloaded locally.

### Upload the Export to Realm

Upload the exported file as described in [Upload Detections to Realm](/product/detection_integrity#upload-detections), selecting your NGSIEM destination.

## Support

For additional details, refer to the official CrowdStrike documentations:

[CrowdStrike Documentation Portal](https://docs.crowdstrike.com/home)

If you encounter any issues or require assistance, contact Realm Security support.