Send data to Falcon Next-Gen SIEM
Onum to Falcon Next-Gen SIEM
Overview
Onum supports integration with Falcon Next-Gen SIEM.
With our Falcon NG-SIEM Data sink, you can send event data to Falcon Next-Gen SIEM via HTTP or HTTPS. It is an efficient and flexible way to ingest data into Falcon Next-Gen SIEM without the need for intermediary files or complex configurations. Events can be sent in either raw or JSON format.
Falcon Next-Gen SIEM Setup
Follow these steps to define a data connector in Falcon NG-SIEM and get the required API URL and API key we will use in Onum:
In Falcon NG-SIEM, click Data connectors > Data connections from the left menu.
Click the Add connection button in the bottom right corner.
Now, choose the required data connector. In this example, we will use the Falcon LogScale Collector. Select it from the list and click Configure.
Enter the Data source and Connector name. Then, we need to choose the required Parser to our data. In this example, we will choose zscaler-internetaccess.
You may need to create a parser if the one you require is not available. Check this article for more information about Parsers in Falcon NG-SIEM.
Accept the required conditions and click Create connection. Click Close in the window that appears.
Click the Generate API key button in the box that appears at the top of the page. Copy the API key and API URL values that appear. These are the values we need to set the required connection in Onum.
Refresh the page if you don't see the box.
Remember to save the API key and API URL values when you generate them. Otherwise, you will need to regenerate them again.
Onum Setup
Access Onum, go to the Data sinks area and click New data sink. Select the Falcon NG-SIEM Data sink from the list.
Enter a Name for the Data Sink. Then, enter the API URL that you got from the connector in the Instance URL field and enter 443 as the Port number. Port 443 is required for the Falcon NG-SIEM connection.
Click on the Token field and select New secret. In the window that appears, give your secret a Name and choose if you want to give a Expiration date to your token or not. Then, click Add new value and paste the API key that you for from the connector. Click Save when you're done.
Learn more about Secrets in this article.
Now, select the token you have just created in the Token field.
In the Event format section, choose Raw.
Click Finish.
Pipeline configuration
When it comes to using this Data sink in a Pipeline, you must configure the following output parameters. To do it, simply click the Data sink on the canvas and select Configuration.
Output configuration
Message*
Select the field to include in the output message. The data type must be string.
Add fields
Optionally, you may include as many Key-Value pairs as required.
Field name*
Enter a name for the new field.
Value*
Select the field that contains the value data.
Last updated
Was this helpful?