CrowdStrike Integration

Data flow to Falcon NG-SIEM

Overview

In this article, you will learn how to set up a connection from the Falcon LogScale Collector over to Falcon NG-SIEM through Onum.

First of all, we will start setting up a destination or connector with the corresponding parser in Falcon NG-SIEM to define where to receive our data.
Then, we need to define the required Listener (data coming into Onum) and Data sink (data going to Falcon NG-SIEM) in Onum.
Next, we will define which data we want to send and where we want to send it over in the Falcon LogScale Collector.
And finally, we will define a Pipeline in Onum to draft and configure the whole data flow.

1. Create a Connector in Falcon NG-SIEM

Follow these steps to define the required data connector in Falcon NG-SIEM:

In Falcon NG-SIEM, click Data connectors > Data connections from the left menu.

Click the Add connection button in the bottom right corner.

Now, choose the required data connector. In this example, we will use the Falcon LogScale Collector. Select it from the list and click Configure.

Enter the Data source and Connector name. Then, we need to choose the required Parser to our data. In this example, we will choose zscaler-internetaccess.

Accept the required conditions and click Create connection. Click Close in the window that appears.

Click the Generate API key button in the box that appears at the top of the page. Copy the API key and API URL values that appear. These are the values we need to set the required connection in Onum.

Refresh the page if you don't see the box.

2. Set up the required Data sink and Listener in Onum

Now we need to configure the required Data sink and Listener in Onum, which will be used to get the input data and then forward it to the required destination.

Create a Falcon NG-SIEM Data sink

Access Onum, go to the Data sinks area and click New data sink. Select the Falcon NG-SIEM Data sink from the list.

Enter a Name for the Data sink. Then, enter the API URL that you got from the connector in the Instance URL field and choose the required Port number (443 in this case).

Click on the Token field and select New secret. In the window that appears, give your secret a Name and turn off the Expiration date option. Then, click Add new value and paste the API key that you for from the connector. Click Save when you're done.

Learn more about Secrets in this article.

Now, select the token you have just created in the Token field.

In the Event format section, choose JSON.

Click Finish.

Create an HTTP Listener

In Onum, go to the Listeners area and click New listener. Select the HTTP Listener from the list.

Enter a Name for the Listener. Then, enter the Port we're going to listen to (in this example, 3000).

Set up the required TLS configuration.

In the Authentication type option, choose API Key in Header.

In the API Key in Header Name field, enter Authorization.
Then, click the API Key in Header Value field and select New secret. In the window that appears, give your secret a Name and turn off the Expiration date option. Then, click Add new value and paste the required value from Falcon LogScale Collector. Click Save when you're done.

Now, select the token you have just created in the Token field.

Choose POST as the HTTP Method.

In the Request Path field, enter /services/collector.

In the Message extraction section, select Multiple events at body as stacked JSON in the Strategy field.

Enter any additional values you may need and click Create labels. Create any required labels if you need to break down your data and then click Create listener.

3. Define the data to send over in the Falcon LogScale Collector

Next you have to configure the data you want to send in Falcon LogScale Collector:

In Falcon NG-SIEM, click Data connectors > Data connections from the left menu, then select the Fleet management tab.

Choose the required VM in this area and access its configuration.

Add the following information:

The required token value.
The Onum URL, with the following format: tenantID:port
In the TLS section at the end, add the path to the required CA certificate file. Add the file in a directory that the Falcon LogScale Collector can read.

If you're using Windows, you need to escape backslashes (\) with an extra backslash in your CA file path.

4. Create the Pipeline in Onum

Now we've got all the required pieces, so it's time to put them all together in a Pipeline:

Access your Onum tenant and click Pipelines > New pipeline.

At the left menu, select the HTTP Listener we've just created in the Listener tab and drag it into the canvas. Then, go to the Data sinks tab and do the same with your Falcon NG-SIEM Data sink.

Then, in the Actions tab, choose the Parser Action and add it to the canvas. Connect the Listener to the Parser, and then the Parser to the Data sink.

Learn more about the Parser Action in this article.

Now we have to configure the Parser. Double-click it and set up the following:

Choose the msg field as the field to parse.
Leave the real data option in the Input box.
Choose the manual option in the Parser block. Click the </> icon at the left of the box to access the code mode and modify the parser as required. In this case, we'll apply this parser to extract 3 different fields (host, event and fields):

{flc:json(fields=["fields":string,"host":string,"event":string"])}

Check this article to learn more about the language used in the Parser Action, known as PCL (Parser Configuration Language).

Click Save when you're done.

Double-click the Data sink

Last updated 3 hours ago

Was this helpful?