> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rad.security/llms.txt
> Use this file to discover all available pages before exploring further.

# CrowdStrike Falcon NextGen SIEM

> Configure CrowdStrike Falcon NextGen SIEM integration with RAD Security for unified threat intelligence.

# CrowdStrike Falcon NextGen SIEM Integration Setup

This guide walks you through integrating CrowdStrike Falcon NextGen SIEM with RAD Security for unified security event management and threat intelligence, enabling bi-directional data flow between the platforms.

CrowdStrike Falcon NextGen SIEM provides advanced threat detection, investigation, and response capabilities with native threat intelligence integration.

## Prerequisites

Before you begin, ensure you have:

<Check>
  * Admin access to CrowdStrike Falcon Console
  * CrowdStrike NextGen SIEM subscription
  * Access to RAD Security workspace with integration permissions
</Check>

<Warning>
  **Administrative Privileges Required:** You must have administrative privileges in CrowdStrike Console to create API clients and configure data connections.
</Warning>

***

## Understanding Integration Components

CrowdStrike NextGen SIEM integration supports two data flow directions:

<AccordionGroup>
  <Accordion title="Query CrowdStrike Data (OAuth Client)" icon="magnifying-glass">
    **Purpose:** Query security data from CrowdStrike into RAD Security

    **Use Case:** Pull CrowdStrike threat intelligence, detections, and events into RAD Security for correlation.

    **Authentication:** OAuth2 Client ID and Secret with NGSIEM scopes

    **Scopes Required:**

    * **Read** - Required to read query results
    * **Write** - Required to create search queries
  </Accordion>

  <Accordion title="Ingest Data into CrowdStrike (HEC)" icon="cloud-arrow-up">
    **Purpose:** Send RAD Security events to CrowdStrike for analysis

    **Use Case:** Forward RAD Security runtime security events to CrowdStrike for unified threat detection.

    **Authentication:** HTTP Event Collector (HEC) API URL and Key

    **Configuration:** Data connector with JSON parser
  </Accordion>
</AccordionGroup>

<Info>
  **Both Scopes Needed:** The NGSIEM client requires both Read and Write scopes. Write is needed to create search queries, and Read is needed to retrieve the query results.
</Info>

***

## Step 1: Create OAuth Client

<Steps>
  <Step title="Log in to CrowdStrike Console">
    Log in to your CrowdStrike Falcon Console with administrative privileges
  </Step>

  <Step title="Navigate to API Clients">
    Open the main menu and go to:

    **Support and resources > Resources and tools > API clients and keys**
  </Step>

  <Step title="Create New Client">
    Click the **Create API client** button
  </Step>

  <Step title="Configure Client Settings">
    In the modal dialog:

    1. **Client name:** Enter a descriptive name (e.g., "RAD Security SIEM Integration")
    2. **Description:** (Optional) Add details about this integration
  </Step>

  <Step title="Select API Scopes">
    Under **NGSIEM** section, select both:

    * ☑️ **Read**
    * ☑️ **Write**

    <Warning>
      **Both scopes are required!** Write scope is needed to create search queries, and Read scope is needed to read the query results. The integration will not function properly without both.
    </Warning>
  </Step>

  <Step title="Create Client">
    Click the **Create** button
  </Step>

  <Step title="Copy Credentials">
    The modal will display your new credentials. **Copy these immediately:**

    * **Client ID**
    * **Client Secret**
    * **Base URL**

    <Warning>
      **Save these values now!** You will not be able to view the Client Secret again. Store them securely in a password manager or secrets vault.
    </Warning>
  </Step>
</Steps>

<Note>
  **Adjusting Scopes Later:** If you need to modify scopes, click the three dots (⋮) to the right of the client listing on the API clients and keys page.
</Note>

***

## Step 2: Generate HEC Credentials (Optional)

This step is only necessary if you plan to ingest RAD Security events into CrowdStrike NextGen SIEM.

<Info>
  Skip this step if you only need to query CrowdStrike data. Configure this if you want to send RAD Security events to CrowdStrike.
</Info>

<Steps>
  <Step title="Navigate to Data Connectors">
    Open the main menu and go to:

    **Data connectors > Data connections**
  </Step>

  <Step title="Add New Connection">
    In the **Connections** section, click the **+ Add connection** button
  </Step>

  <Step title="Filter for HTTP Connector">
    1. Click the **Filter by connector name** dropdown
    2. Type "HTTP"
    3. Click **Apply**
  </Step>

  <Step title="Select HEC Connector">
    1. Find **HEC / HTTP Event Connector** in the filtered list
    2. Click on it to select
    3. Click the **Configure** button
  </Step>

  <Step title="Configure Connector">
    Fill in the form with the following values:

    | Field              | Value                                                  |
    | ------------------ | ------------------------------------------------------ |
    | **Data source**    | Your desired data source name (e.g., "RAD Security")   |
    | **Data Type**      | JSON                                                   |
    | **Connector Name** | Your desired connector name (e.g., "RAD Security HEC") |
    | **Parsers**        | json (Generic Source)                                  |

    <Note>
      The JSON parser is required to properly parse RAD Security events in CrowdStrike.
    </Note>
  </Step>

  <Step title="Accept Terms">
    Check the box to affirm your adherence to the **CrowdStrike Terms and Conditions**
  </Step>

  <Step title="Save Configuration">
    Click **Save**
  </Step>

  <Step title="Wait for Setup">
    1. A modal will appear indicating the connector is being set up
    2. Close the modal
    3. Wait for the connector setup to finish
    4. You'll see a notification bar at the top when ready

    <Info>
      Connector setup typically takes 1-2 minutes. Wait for the "ready to receive data" notification before proceeding.
    </Info>
  </Step>

  <Step title="Generate API Key">
    Once the connector is ready, click the **Generate API Key** button on the right side of the notification bar
  </Step>

  <Step title="Copy HEC Credentials">
    A modal will appear with your credentials. **Copy these immediately:**

    * **API URL** (HEC endpoint)
    * **API Key** (HEC credential)

    <Warning>
      Store these values securely. You'll need them for the integration configuration.
    </Warning>
  </Step>
</Steps>

***

## Step 3: Configure in RAD Security

Navigate to your RAD Security workspace and configure the CrowdStrike Falcon NextGen SIEM integration with the appropriate parameters:

### Configuration Scenarios

<Tabs>
  <Tab title="Query Only">
    **Use Case:** Pull CrowdStrike threat intelligence and events into RAD Security

    | Parameter        | Description               | Example                       |
    | ---------------- | ------------------------- | ----------------------------- |
    | **URL**          | Base URL from Step 1      | `https://api.crowdstrike.com` |
    | **ClientId**     | Client ID from Step 1     | `abc123def456...`             |
    | **ClientSecret** | Client Secret from Step 1 | `xyz789abc123...`             |

    <Note>
      This configuration allows querying CrowdStrike data but does not send RAD Security events to CrowdStrike.
    </Note>
  </Tab>

  <Tab title="Ingest Only">
    **Use Case:** Send RAD Security events to CrowdStrike for analysis

    | Parameter                 | Description         | Example                                   |
    | ------------------------- | ------------------- | ----------------------------------------- |
    | **HEC URL**               | API URL from Step 2 | `https://ingest.us-1.crowdstrike.com/...` |
    | **HEC Credential Secret** | API Key from Step 2 | `your-hec-api-key-here`                   |

    <Note>
      This configuration allows sending events to CrowdStrike but does not enable querying CrowdStrike data.
    </Note>
  </Tab>

  <Tab title="Bi-directional (Recommended)">
    **Use Case:** Both query CrowdStrike data and send RAD Security events

    | Parameter                 | Description               | Example                                   |
    | ------------------------- | ------------------------- | ----------------------------------------- |
    | **URL**                   | Base URL from Step 1      | `https://api.crowdstrike.com`             |
    | **ClientId**              | Client ID from Step 1     | `abc123def456...`                         |
    | **ClientSecret**          | Client Secret from Step 1 | `xyz789abc123...`                         |
    | **HEC URL**               | API URL from Step 2       | `https://ingest.us-1.crowdstrike.com/...` |
    | **HEC Credential Secret** | API Key from Step 2       | `your-hec-api-key-here`                   |

    <Info>
      This is the recommended configuration for full integration capabilities and unified threat visibility.
    </Info>
  </Tab>
</Tabs>

### Regional Base URLs

Your Base URL will vary by region. Common CrowdStrike regions:

| Region   | Base URL                                 |
| -------- | ---------------------------------------- |
| US-1     | `https://api.crowdstrike.com`            |
| US-2     | `https://api.us-2.crowdstrike.com`       |
| EU-1     | `https://api.eu-1.crowdstrike.com`       |
| US-GOV-1 | `https://api.laggar.gcw.crowdstrike.com` |

***

## Verify Integration

After completing the setup, verify your integration is working:

### Verify Query Capability

1. Run a test query from RAD Security
2. Verify CrowdStrike threat data appears correctly
3. Check that results are properly formatted

### Verify Data Ingestion

1. Trigger a test event in RAD Security
2. Search for the event in CrowdStrike NextGen SIEM
3. Verify the event appears with correct JSON formatting

<Check>
  Your CrowdStrike Falcon NextGen SIEM integration is now configured! RAD Security can query CrowdStrike threat intelligence and/or send events based on your configuration.
</Check>

## What Data is Synced

<AccordionGroup>
  <Accordion title="Data Queried from CrowdStrike" icon="magnifying-glass">
    RAD Security can query the following from CrowdStrike:

    * Threat detections and alerts
    * Endpoint activity and behavior
    * Threat intelligence indicators
    * Investigation data
    * Historical security events
    * Custom search results
  </Accordion>

  <Accordion title="Data Sent to CrowdStrike (HEC)" icon="cloud-arrow-up">
    RAD Security forwards the following to CrowdStrike:

    * Runtime security events
    * Container and cloud activity
    * Policy violations
    * Threat detections
    * Incident data
    * Custom security events
  </Accordion>
</AccordionGroup>

## Use Cases

<CardGroup cols={2}>
  <Card title="Unified Threat Intelligence" icon="brain">
    Correlate CrowdStrike's threat intelligence with RAD Security's runtime insights for comprehensive threat detection.
  </Card>

  <Card title="Cross-Platform Detection" icon="diagram-venn">
    Detect threats that span endpoints and containerized infrastructure using unified data sources.
  </Card>

  <Card title="Enhanced Investigation" icon="magnifying-glass-chart">
    Leverage CrowdStrike's investigation tools with RAD Security's container runtime context.
  </Card>

  <Card title="Centralized SIEM" icon="building">
    Use CrowdStrike as a central SIEM for all security events including container and cloud workloads.
  </Card>
</CardGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Authentication Failed" icon="triangle-exclamation">
    **Possible causes:**

    * Client ID or Secret incorrect
    * OAuth client was deleted or disabled
    * Missing NGSIEM scopes
    * Wrong regional Base URL

    **Solution:**

    * Verify Client ID and Secret are copied correctly
    * Check the OAuth client still exists in CrowdStrike
    * Ensure both Read and Write scopes are selected
    * Verify you're using the correct regional Base URL
    * Try creating a new OAuth client if needed
  </Accordion>

  <Accordion title="Missing Read or Write Scope" icon="shield-exclamation">
    **Possible causes:**

    * Only one scope selected instead of both
    * Scopes were modified after creation

    **Solution:**

    * Verify both NGSIEM Read and Write scopes are checked
    * Click the three dots next to the client listing
    * Edit the client to add the missing scope
    * Remember: Write is for creating queries, Read is for retrieving results
  </Accordion>

  <Accordion title="HEC Connection Failed" icon="plug">
    **Possible causes:**

    * HEC URL incorrect
    * API Key invalid or expired
    * Connector not fully set up
    * Data type mismatch

    **Solution:**

    * Verify HEC URL is copied exactly as shown
    * Check API Key has no extra spaces
    * Ensure connector shows "ready to receive data" status
    * Confirm Data Type is set to JSON
    * Verify json (Generic Source) parser is selected
  </Accordion>

  <Accordion title="Events Not Appearing in CrowdStrike" icon="database-slash">
    **Possible causes:**

    * Wrong parser configuration
    * JSON format issues
    * HEC connector not active
    * Data not being sent from RAD Security

    **Solution:**

    * Verify json (Generic Source) parser is configured
    * Check that Data Type is JSON
    * Ensure HEC connector status is active
    * Test with a simple JSON payload using curl
    * Review CrowdStrike data connector logs
    * Check RAD Security integration logs
  </Accordion>

  <Accordion title="Query Errors" icon="magnifying-glass-minus">
    **Possible causes:**

    * Invalid search query syntax
    * Missing Write scope
    * Missing Read scope
    * Query timeout

    **Solution:**

    * Verify query syntax is correct for CrowdStrike
    * Ensure both Read and Write scopes are enabled
    * Try simplifying the query
    * Check CrowdStrike API rate limits
    * Review query logs in CrowdStrike
  </Accordion>

  <Accordion title="Regional Endpoint Issues" icon="globe">
    **Possible causes:**

    * Using wrong regional Base URL
    * Account not in expected region
    * HEC URL region mismatch

    **Solution:**

    * Verify your CrowdStrike account region
    * Use correct Base URL for your region (US-1, US-2, EU-1, etc.)
    * Check that HEC URL matches your data region
    * Contact CrowdStrike support to confirm your region
  </Accordion>
</AccordionGroup>

## Security Best Practices

<CardGroup cols={2}>
  <Card title="Rotate Credentials Regularly" icon="rotate">
    Periodically rotate OAuth client secrets and HEC API keys as part of security hygiene.
  </Card>

  <Card title="Least Privilege Scopes" icon="shield-halved">
    Only grant the NGSIEM scopes. Avoid adding unnecessary additional scopes to the client.
  </Card>

  <Card title="Secure Credential Storage" icon="lock">
    Store Client Secrets and API Keys in a secure password manager or secrets vault.
  </Card>

  <Card title="Monitor API Usage" icon="chart-line">
    Regularly review API client activity in CrowdStrike to detect anomalous behavior.
  </Card>

  <Card title="Dedicated Connectors" icon="plug">
    Create separate HEC connectors for different data sources to simplify management and troubleshooting.
  </Card>

  <Card title="Audit Client Access" icon="clipboard-list">
    Periodically review OAuth clients and ensure unused clients are removed.
  </Card>
</CardGroup>

## Additional Resources

<CardGroup cols={2}>
  <Card title="CrowdStrike API Documentation" icon="book" href="https://falcon.crowdstrike.com/documentation">
    Official CrowdStrike Falcon API documentation
  </Card>

  <Card title="CrowdStrike Falcon Spotlight" icon="crow" href="/rad-security/integrations/vulnerabilities/crowdstrike-falcon-spotlight-setup">
    Configure CrowdStrike for vulnerability management
  </Card>

  <Card title="CrowdStrike Falcon Insight (EDR)" icon="shield" href="/rad-security/integrations/edr/overview">
    Integrate CrowdStrike EDR capabilities
  </Card>
</CardGroup>

## Next Steps

<CardGroup cols={2}>
  <Card title="SIEM Integrations Overview" icon="chart-line" href="/rad-security/integrations/siem/overview">
    Explore other SIEM integration options
  </Card>

  <Card title="Runtime Security" icon="shield" href="/rad-security/integrations/runtime-security">
    Learn what runtime events are sent to CrowdStrike
  </Card>

  <Card title="Threat Models" icon="crosshairs" href="/rad-security/security-and-compliance/overview">
    Understand how threats are detected and classified
  </Card>

  <Card title="Alerts & Incidents" icon="bell" href="/rad-security/platform/workspace">
    Configure alert rules to forward to CrowdStrike
  </Card>
</CardGroup>