CrowdStrike

Scanner supports two ways to ingest CrowdStrike logs:

• Falcon Event Streams: Collect event and audit records directly from the CrowdStrike API, store the raw logs in S3, and index them for search and detection.
• Falcon Data Replicator: Index CrowdStrike telemetry exported to S3 through FDR.

Falcon Event Streams

The crowdstrike:event_streams source collects the Falcon event and audit records available through your account's Event Streams API. Falcon Data Replicator is not required for this source.

Prerequisites

Before you begin, make sure you have:

• A CrowdStrike Falcon account with Streaming API access enabled.
• A Falcon API client with Event streams: Read permission, or access to create one.
• Permission in Scanner to create integrations, Collect Rules, and Index Rules.
• An S3 bucket linked to Scanner, with permission for Scanner to write the collected logs.

CrowdStrike documents the required scope in its Event Streams API reference.

Create a Collect Rule

1

Create a New Source

In the Scanner UI, go to the Collect tab.

• From the Overview page, click the + icon in the upper-right corner.
• Select Collect Rule.
• On Create a New Collect Rule, choose CrowdStrike.
• On Select a Log Type, select crowdstrike:event_streams.

2

Configure the Collect Rule Source

Give the rule a descriptive name, such as my-org-crowdstrike-events.

3

Connect a CrowdStrike Account

If you have already created a CrowdStrike connection, select it from the list. Otherwise, select New CrowdStrike Connection and enter:

• Connection Name: A recognizable name for this connection.
• Cloud: The CrowdStrike cloud where your Falcon account resides: US-1, US-2, US-3, EU-1, US-GOV-1, or US-GOV-2.
• Client ID: The ID of your Falcon API client.
• Client Secret: The secret for that API client. Scanner masks this value and does not display it after the connection is created.

To create the credentials in Falcon:

1. Sign in to the Falcon console with permission to manage API clients.
2. Open API clients and keys and add a new API client.
3. Give the client a name and enable Read for the Event streams API scope.
4. Create the client, then copy its client ID and secret into Scanner. Record the secret when Falcon displays it; it is shown only once.

See CrowdStrike's Event Streams setup guide for its API client creation steps.

Click Connect. Scanner authenticates and checks stream discovery before saving the connection. For an existing connection, use Check Connection to verify access. You can manage connections under Settings > Integrations.

Scanner discovers the feed URLs and tracks collection progress automatically; you do not need to supply feed URLs or configure individual partitions.

4

Logs Destination

• Choose the S3 Bucket where the raw CrowdStrike logs should be stored.
• Optionally, enter a Bucket Prefix to organize the data path in your bucket.

5

Review and Create

Review the Collect Rule settings on the Final Review screen. Resolve any connection or permission errors before creating the rule.

Collection Behavior

Scanner schedules collection every 5 minutes and resumes each stream from its saved position. The available history depends on CrowdStrike; this source does not expose a configurable historical start time.

Collection uses at-least-once delivery. If a batch is retried, some records can appear more than once.

Create an Index Rule

Create an Index Rule from the Collect Rule to make the collected logs available for search and detections.

Create an Index Rule

Scanner pre-populates these defaults for crowdstrike:event_streams:

• Transformations: Add Metadata, Parse JSON Fields.
• Timestamp Field: .metadata.eventCreationTime.

Troubleshooting

• Authentication fails: Check that the selected cloud matches the Falcon account, and verify the client ID and secret.
• Stream discovery fails: Confirm that the API client has Event streams: Read permission and that Streaming API access is enabled for the account.
• The connection succeeds, but no logs appear: A successful connection check confirms authentication and discovery. Confirm that the Collect Rule is enabled, the S3 destination is writable, and an Index Rule covers the destination. Allow a collection cycle and check for activity that produces Event Streams records in Falcon; a quiet stream may have no new events to deliver.

Falcon Data Replicator

Scanner supports CrowdStrike log events that are exported by Falcon Data Replicator to S3. These logs contain information about endpoint, cloud workload, and identity data from the CrowdStrike product ecosystem. In order for Scanner to see these logs, you can configure CrowdStrike Falcon Data Replicator to publish them to an S3 bucket that Scanner is linked to.

Step 1: Publish to S3

Within CrowdStrike Falcon, navigate to Support and resources and select Falcon Data Replicator. If this option is not available, you may need to talk with your CrowdStrike support team to enable Falcon Data Replicator.

First, you can configure Falcon Data Replicator to push logs to a new S3 bucket hosted in CrowdStrike's AWS account. Second, you can configure data to be replicated from CrowdStrike's S3 bucket to your own S3 bucket.

You can follow CrowdStrike's documentation about Falcon Data Replicator to accomplish this. You may also want to use CrowdStrike's FDR project on GitHub to replicate the logs to your own S3 bucket.

Step 2: Create an Index Rule in Scanner

Once CrowdStrike logs are landing in your S3 bucket, Create an Index Rule to ingest the logs via Scanner Collect for fast search and detections.