CrowdStrike Falcon NextGen SIEM
Configure CrowdStrike Falcon NextGen SIEM integration with RAD Security for unified threat intelligence.
This guide walks you through integrating CrowdStrike Falcon NextGen SIEM with RAD Security for unified security event management and threat intelligence, enabling bi-directional data flow between the platforms.
CrowdStrike Falcon NextGen SIEM provides advanced threat detection, investigation, and response capabilities with native threat intelligence integration.
Prerequisites
Before you begin, ensure you have:
- Admin access to CrowdStrike Falcon Console
- CrowdStrike NextGen SIEM subscription
- Access to RAD Security workspace with integration permissions
Administrative Privileges Required: You must have administrative privileges in CrowdStrike Console to create API clients and configure data connections.
Understanding Integration Components
CrowdStrike NextGen SIEM integration supports two data flow directions:
Both Scopes Needed: The NGSIEM client requires both Read and Write scopes. Write is needed to create search queries, and Read is needed to retrieve the query results.
Step 1: Create OAuth Client
Log in to CrowdStrike Console
Log in to your CrowdStrike Falcon Console with administrative privileges
Navigate to API Clients
Open the main menu and go to:
Support and resources > Resources and tools > API clients and keys
Create New Client
Click the Create API client button
Configure Client Settings
In the modal dialog:
- Client name: Enter a descriptive name (e.g., "RAD Security SIEM Integration")
- Description: (Optional) Add details about this integration
Select API Scopes
Under NGSIEM section, select both:
- ☑️ Read
- ☑️ Write
Both scopes are required! Write scope is needed to create search queries, and Read scope is needed to read the query results. The integration will not function properly without both.
Create Client
Click the Create button
Copy Credentials
The modal will display your new credentials. Copy these immediately:
- Client ID
- Client Secret
- Base URL
Save these values now! You will not be able to view the Client Secret again. Store them securely in a password manager or secrets vault.
Adjusting Scopes Later: If you need to modify scopes, click the three dots (⋮) to the right of the client listing on the API clients and keys page.
Step 2: Generate HEC Credentials (Optional)
This step is only necessary if you plan to ingest RAD Security events into CrowdStrike NextGen SIEM.
Skip this step if you only need to query CrowdStrike data. Configure this if you want to send RAD Security events to CrowdStrike.
Navigate to Data Connectors
Open the main menu and go to:
Data connectors > Data connections
Add New Connection
In the Connections section, click the + Add connection button
Filter for HTTP Connector
- Click the Filter by connector name dropdown
- Type "HTTP"
- Click Apply
Select HEC Connector
- Find HEC / HTTP Event Connector in the filtered list
- Click on it to select
- Click the Configure button
Configure Connector
Fill in the form with the following values:
| Field | Value |
|---|---|
| Data source | Your desired data source name (e.g., "RAD Security") |
| Data Type | JSON |
| Connector Name | Your desired connector name (e.g., "RAD Security HEC") |
| Parsers | json (Generic Source) |
The JSON parser is required to properly parse RAD Security events in CrowdStrike.
Accept Terms
Check the box to affirm your adherence to the CrowdStrike Terms and Conditions
Save Configuration
Click Save
Wait for Setup
- A modal will appear indicating the connector is being set up
- Close the modal
- Wait for the connector setup to finish
- You'll see a notification bar at the top when ready
Connector setup typically takes 1-2 minutes. Wait for the "ready to receive data" notification before proceeding.
Generate API Key
Once the connector is ready, click the Generate API Key button on the right side of the notification bar
Copy HEC Credentials
A modal will appear with your credentials. Copy these immediately:
- API URL (HEC endpoint)
- API Key (HEC credential)
Store these values securely. You'll need them for the integration configuration.
Step 3: Configure in RAD Security
Navigate to your RAD Security workspace and configure the CrowdStrike Falcon NextGen SIEM integration with the appropriate parameters:
Configuration Scenarios
Use Case: Pull CrowdStrike threat intelligence and events into RAD Security
| Parameter | Description | Example |
|---|---|---|
| URL | Base URL from Step 1 | https://api.crowdstrike.com |
| ClientId | Client ID from Step 1 | abc123def456... |
| ClientSecret | Client Secret from Step 1 | xyz789abc123... |
This configuration allows querying CrowdStrike data but does not send RAD Security events to CrowdStrike.
Use Case: Send RAD Security events to CrowdStrike for analysis
| Parameter | Description | Example |
|---|---|---|
| HEC URL | API URL from Step 2 | https://ingest.us-1.crowdstrike.com/... |
| HEC Credential Secret | API Key from Step 2 | your-hec-api-key-here |
This configuration allows sending events to CrowdStrike but does not enable querying CrowdStrike data.
Use Case: Both query CrowdStrike data and send RAD Security events
| Parameter | Description | Example |
|---|---|---|
| URL | Base URL from Step 1 | https://api.crowdstrike.com |
| ClientId | Client ID from Step 1 | abc123def456... |
| ClientSecret | Client Secret from Step 1 | xyz789abc123... |
| HEC URL | API URL from Step 2 | https://ingest.us-1.crowdstrike.com/... |
| HEC Credential Secret | API Key from Step 2 | your-hec-api-key-here |
This is the recommended configuration for full integration capabilities and unified threat visibility.
Regional Base URLs
Your Base URL will vary by region. Common CrowdStrike regions:
| Region | Base URL |
|---|---|
| US-1 | https://api.crowdstrike.com |
| US-2 | https://api.us-2.crowdstrike.com |
| EU-1 | https://api.eu-1.crowdstrike.com |
| US-GOV-1 | https://api.laggar.gcw.crowdstrike.com |
Verify Integration
After completing the setup, verify your integration is working:
Verify Query Capability
- Run a test query from RAD Security
- Verify CrowdStrike threat data appears correctly
- Check that results are properly formatted
Verify Data Ingestion
- Trigger a test event in RAD Security
- Search for the event in CrowdStrike NextGen SIEM
- Verify the event appears with correct JSON formatting
Your CrowdStrike Falcon NextGen SIEM integration is now configured! RAD Security can query CrowdStrike threat intelligence and/or send events based on your configuration.
What Data is Synced
Use Cases
Unified Threat Intelligence Correlate CrowdStrike's threat intelligence with RAD Security's runtime insights for comprehensive threat detection.
Cross-Platform Detection Detect threats that span endpoints and containerized infrastructure using unified data sources.
Enhanced Investigation Leverage CrowdStrike's investigation tools with RAD Security's container runtime context.
Centralized SIEM Use CrowdStrike as a central SIEM for all security events including container and cloud workloads.
Troubleshooting
Security Best Practices
Rotate Credentials Regularly Periodically rotate OAuth client secrets and HEC API keys as part of security hygiene.
Least Privilege Scopes Only grant the NGSIEM scopes. Avoid adding unnecessary additional scopes to the client.
Secure Credential Storage Store Client Secrets and API Keys in a secure password manager or secrets vault.
Monitor API Usage Regularly review API client activity in CrowdStrike to detect anomalous behavior.
Dedicated Connectors Create separate HEC connectors for different data sources to simplify management and troubleshooting.
Audit Client Access Periodically review OAuth clients and ensure unused clients are removed.
Additional Resources
CrowdStrike API Documentation
Official CrowdStrike Falcon API documentation
CrowdStrike Falcon Spotlight
Configure CrowdStrike for vulnerability management
CrowdStrike Falcon Insight (EDR)
Integrate CrowdStrike EDR capabilities