CrowdStrike NG-SIEM

LAST UPDATED: OCTOBER. 6, 2025

Overview

The CrowdStrike Next-Gen SIEM is a modern, cloud-native SIEM platform built on Falcon LogScale (formerly Humio). The platform collects, ingests, and searches security and operational logs; enables threat hunting and detection engineering; correlates data across endpoints, identities, cloud, and network environments; and provides unified visibility across the organization's environment.

D3 SOAR is providing REST operations to function with CrowdStrike NG-SIEM. CrowdStrike NG-SIEM is available for use in:

Connection

Gather the following information to connect D3 SOAR to CrowdStrike NG-SIEM.

Permission Requirements

Each endpoint in the CrowdStrike NG-SIEM API requires a certain permission scope. The following are required scopes for the commands in this integration:

Configuring CrowdStrike NG-SIEM to Work with D3 SOAR

1. Log in to https://falcon.crowdstrike.com.

   

2. Search for and click on the API clients and keys console page.

   

3. Click on the Create API client button.

   

4. Enter a client name, input the required scopes, then click on the Create button.

   

5. Securely store both the client ID and secret, then click on the Done button.

   

Configuring D3 SOAR to Work with CrowdStrike NG-SIEM

1. Log in to D3 SOAR.

2. Find the CrowdStrike NG-SIEM integration.

   

   1. Navigate to Configuration on the top header menu.

   2. Click on the Integration icon on the left sidebar.

   3. Type CrowdStrike NG-SIEM in the search box to find the integration, then click it to select it.

   4. Click on the + Connection button on the right side of the Connections section. A new connection window will appear.

3. Configure the following fields to create a connection to CrowdStrike NG-SIEM.

   

   1. Connection Name: The desired name for the connection.

   2. Site: The site on which to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.

   3. Recipient site for events from connections Shared to Internal Sites: This field is displayed when Share to Internal Sites is selected for the Site field, allowing selection of the internal site for deploying the integration connection.

   4. Agent Name (Optional): The proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.

   5. Description (Optional): The description for the connection.

   6. Tenant (Optional): When configuring the connection from a master tenant site, users can choose the specific tenant sites with which to share the connection. Once this setting is enabled, users can filter and select the desired tenant sites from the dropdowns to share the connection.

   7. Configure User Permissions: Defines which users have access to the connection.

   8. Active: The checkbox that enables the connection to be used when selected.

   9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.

      

      
      1. Input the Server URL. The default value is https://api.crowdstrike.com.
      2. Input the Client ID.
      3. Input the Client Secret.

   10. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Refer to the password vault connection guide if needed.

   11. Connection Health Check: Periodically checks the connection status by scheduling the Test Connection command at the specified interval (in minutes). Available only for active connections, this feature also allows configuring email notifications for failed attempts.

4. Test the connection.

   

   1. Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.

   2. Click OK to close the alert window.

   3. Click + Add to create and add the configured connection.

Commands

CrowdStrike NG-SIEM includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command function, users can execute these commands independently for playbook troubleshooting.

READER NOTE

Certain permissions are required for each command. Refer to the Permission Requirements and Configuring CrowdStrike NG-SIEM to Work with D3 SOAR sections for details.

Note for Time-related parameters

The input format of time-related parameters may vary based on user account settings, which may cause the sample data in commands to differ from what is displayed. To adjust the time format, follow these steps:

1. Navigate to Configuration Application Settings. Select Date/Time Format.

   

2. Choose the desired date and time format, then click on the Save button.

   

   The selected time format will now be visible when configuring Date/Time command input parameters.

Fetch Event

Returns NG-SIEM incidents from the NG-SIEM platform based on specified criteria. For details about the search syntax, see https://falconpy.io/Usage/Falcon-Query-Language.html.

Input

Output

To view the sample output data for all commands, refer to this article.

Fetch Event Field Mapping

See Field Mappings.

The CrowdStrike NG-SIEM system integration includes pre-configured field mappings for the default event source.

The Default Event Source is the default system-provided set of field mappings applied when the fetch event command is executed. It includes a Main Event JSON Path, which is the JSONPath expression that points to the base array of event objects. The source field path continues from this array to locate the required data.

The Main Event JSON Path can be viewed by clicking on the Edit Event Source button.

• Main Event JSON Path: $.resources
  The resources array contains the event objects. Within each object, the key .entities.agent_ids, for instance, denotes the Agent IDs field. As such, the full JSONPath expression to extract the Unique Event Key is $.entities.agent_ids.Agent IDs.

The pre-configured field mappings are detailed below:

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

NG-SIEM Search

Searches and retrieves log data stored in repositories using queries written in the CrowdStrike Query Language (CQL). A maximum of 200 events will be returned. If more than 200 events match the filters, narrow the results by adjusting the Start Time, End Time, or Query String parameters.

Input

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Test Connection

Allows users to perform a health check on an integration connection. Users can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.