Send data to Falcon Next-Gen SIEM
Onum to Falcon Next-Gen SIEM
Overview
Onum supports integration with Falcon Next-Gen SIEM.
With our Falcon NG-SIEM Data sink, you can send event data to Falcon Next-Gen SIEM via HTTP or HTTPS. It is an efficient and flexible way to ingest data into Falcon Next-Gen SIEM without the need for intermediary files or complex configurations. Events can be sent in either raw or JSON format.
Falcon Next-Gen SIEM Setup
Follow these steps to define a data connector in Falcon NG-SIEM and get the required API URL and API key we will use in Onum:
Access Falcon and click Next-Gen SIEM > Log management > Data onboarding from the left menu.
Click the Add connection button in the top right corner of the Connections table.
Now, choose the required data connector. In this example, we will use the Falcon LogScale Collector. Select it from the list and click Configure.
Enter a Connector name and choose a Vendor and Vendor Product from the lists (if your product isn’t in the list, you can pick Generic for both). Then, we need to choose the required Parser to our data. Pick it from the list or click Create new parser to define a new one. If you create a new parser, you'll need to pick it from the list after you've created it.
In this example, we will choose zscaler-internetaccess.
You may need to create a parser if the one you require is not available. Check this article for more information about Parsers in Falcon NG-SIEM.
Accept the required conditions and click Create connection. Click Close in the window that appears.
Click the Generate API key button in the box that appears at the top of the page. Copy the API key and API URL values that appear. These are the values we need to set the required connection in Onum.
Refresh the page if you don't see the box.
Remember to save the API key and API URL values when you generate them. Otherwise, you will need to regenerate them again.
Onum Setup
Access Onum, go to the Data sinks area and click New data sink. Select the Falcon NG-SIEM Data sink from the list.
Enter a Name for the Data Sink. Then, enter the API URL that you got from the connector in the Instance URL field.
Click on the Token field and select New secret. In the window that appears, give your secret a Name and turn off the Expiration date toggle if not needed. Then, click Add new value and paste the API key that you for from the connector. Click Save when you're done.
Now, select the token you have just created in the Token field.
In the Event format section, choose either JSON or Raw.
Leave the Advanced configuration settings as default and click Finish.
Pipeline configuration
When it comes to using this Data sink in a Pipeline, you must configure the following output parameters. To do it, simply click the Data sink on the canvas and select Configuration.
Output configuration
Message*
Select the field to include in the output message. The data type must be string.
Add fields
Optionally, you may include as many Key-Value pairs as required.
Field name*
Enter a name for the new field.
Value*
Select the field that contains the value data.
Last updated
Was this helpful?