CrowdStrike Falcon Next-Gen SIEM

SIEM Platform

Synopsis

Creates a target that sends events to CrowdStrike Falcon Next-Gen SIEM over its HTTP Event Collector (HEC) ingestion endpoint. Supports batching, compression, and automatic load balancing across multiple endpoints.

Schema

- name: <string>
  description: <string>
  type: crowdstrike
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    endpoints:
      - endpoint: <string>
        auth_type: <string>
        token: <string>
        secret: <string>
    index: <string>
    source_type: <string>
    source: <string>
    batch_size: <numeric>
    timeout: <numeric>
    tcp_routing: <boolean>
    use_compression: <boolean>
    insecure_skip_verify: <boolean>
    ca_name: <string>
    server_name: <string>
    cert_name: <string>
    key_name: <string>
    passphrase: <string>
    min_tls_version: <string>
    max_tls_version: <string>
    field_format: <string>
    debug:
      status: <boolean>
      dont_send_logs: <boolean>

Configuration

The following are the fields used to define the target:

Field	Required	Default	Description
name	Y		Target name
description	N	-	Optional description
type	Y		Must be crowdstrike
pipelines	N	-	Optional post-processor pipelines
status	N	true	Enable/disable the target

Endpoint

Field	Required	Default	Description
endpoint	Y	-	CrowdStrike HEC ingestion endpoint URL
auth_type	N	token	Authentication type: token or secret
token	Y*	-	HEC token when using token auth
secret	Y*	-	Bearer token when using secret auth
max_bytes	N	4194304 (4 MB)	Maximum size of a single request body or batch, in bytes

note

max_bytes caps the size of a single request body or batch. It behaves differently from max_size on the file-writing targets, and the difference is easy to get wrong:

• An explicit max_bytes: 0 IS honoured and removes the ceiling on targets that have no ceiling of their own. The value is read with Int64, which returns what you wrote — unlike max_size, which is read with MustInt64 and silently substitutes its default for a zero. Where a target has a fixed ceiling of its own, its page says so and a zero is clamped to that ceiling instead.
• A negative value is rejected at configuration time with max_bytes must not be negative.

The ceiling is validated when the target is built and enforced again on every batch, so a value the receiving service will refuse fails early rather than per request.

* = token is required when auth_type is token; secret is required when auth_type is secret.

Event

Field	Required	Default	Description
index	N	-	Default index
source_type	N	-	Default sourcetype for events
source	N	-	Default source for events
batch_size	N	10000	Number of events to batch before sending
timeout	N	30	Connection timeout in seconds

Connection

Field	Required	Default	Description
tcp_routing	N	false	Enable TCP routing header
use_compression	N	true	Enable gzip compression
field_format	N	-	Data normalization format. See applicable Normalization section

TLS

TLS is engaged by the endpoint URL scheme: an https:// endpoint enables it, an http:// endpoint does not. The CrowdStrike form writes a nested tls: block, so these keys are nested rather than top-level.

Field	Required	Default	Description
tls.insecure_skip_verify	N	false	Skip server certificate verification. Use only for testing
tls.ca_name	N	-	CA bundle used to verify the server certificate. When unset, the host trust store is used; when set, it replaces the host trust store rather than adding to it
tls.server_name	N	-	SNI hostname override for the TLS handshake
tls.cert_name	N*	-	Client certificate for mutual TLS
tls.key_name	N*	-	Client private key for mutual TLS
tls.passphrase	N	-	Passphrase for an encrypted private key
tls.min_tls_version	N	tls1.2	Minimum accepted TLS version (tls1.0, tls1.1, tls1.2, tls1.3)
tls.max_tls_version	N	tls1.3	Maximum accepted TLS version (tls1.0, tls1.1, tls1.2, tls1.3)

* = Mutual TLS requires both tls.cert_name and tls.key_name. Setting only one is a configuration error.

note

There is no tls.status. TLS is off when the tls: block is absent altogether; a status key inside the block is not read.

Targets saved before the nested block was introduced still carry the same keys at the root of properties, and the sender reads that older shape for as long as it is there. It migrates on the next save. The two shapes are never mixed: once a non-empty tls: block exists it is the complete statement, and any leftover flat key is ignored — with the single exception of insecure_skip_verify, which falls back to the root when the block does not set it.

note

TLS material fields (cert_name, key_name, ca_name, client_ca_name) accept any of the following:

• File name — resolved relative to the service root directory. Nested paths such as certs/prod/server.pem are supported.
• Absolute path — honored only if it resolves inside the service root. Any path that escapes the root is refused.
• Inline PEM content — used verbatim when the value contains -----BEGIN.
• Environment variable — ${ENV_VAR}.
• Vault reference — $secret{id=...} or $secret{store=...,ref=...}.

Scheduling

See Scheduling and Pool Behavior for interval and cron fields shared by all targets.

Debug Options

Field	Required	Default	Description
debug.status	N	false	Enable debug logging
debug.dont_send_logs	N	false	Process logs but don't send to target (testing)

Details

HEC Modes: JSON and RAW

The target supports both JSON and RAW HEC ingestion modes. The mode is determined by the endpoint URL path, not by a separate configuration field.

An endpoint URL ending in /services/collector/event (or the default /services/collector) uses JSON mode, where each event is sent as a structured JSON object with metadata fields (index, sourcetype, source) embedded in the payload.

An endpoint URL ending in /services/collector/raw uses RAW mode, where events are sent as plain text with metadata passed as query parameters. RAW mode is useful for forwarding pre-formatted log lines that should not be wrapped in JSON structure. When the incoming pipeline data contains a _raw field, the target extracts its value and sends it as the raw event body.

Named Streams

Endpoint URLs can include a query parameter to define a named stream. For example, https://hec.example.com:8088/services/collector/raw?paloalto creates a stream named paloalto using RAW mode, while https://hec.example.com:8088/services/collector/event?winevent creates a stream named winevent using JSON mode.

Named streams allow routing different event types through separate HEC paths within a single target configuration. A pipeline selects the stream for an event by setting index or table.

Events carrying neither are delivered to the endpoint configured without a query parameter, which acts as the catch-all stream. An event naming a stream that no endpoint defines also falls back to the catch-all; if no catch-all exists, the event cannot be delivered and is retried until one is configured.

All endpoints sharing a stream name must use the same mode. Mixing a /raw endpoint and an /event endpoint under one stream is a configuration error and the target fails to initialize.

Content Hub Pipeline Pack

The siem_crowdstrike Content Hub pack ("CrowdStrike Falcon Next-Gen SIEM Automation Pack") processes Windows Event Logs, Linux Event Logs, and Syslog, normalizes them, and converts everything to CEF. It finishes by keeping only the _raw field, reducing each record to a single CEF-formatted string.

Endpoints receiving output from this pack should use RAW mode. RAW mode extracts _raw and sends it directly as the request body, whereas JSON mode would wrap the CEF string in a JSON envelope.

Stream Names

The pack assigns a stream name per log category, which the target resolves to a named HEC stream:

Stream	Log category
Syslog	Syslog messages (CEF, LEEF, or native, with vendor autodiscovery)
WinEvent	Windows Event Logs
WinSecurity	Windows Security Event Logs
WinDNS	Windows DNS logs
WinFirewall	Windows Firewall logs
LinuxEvent	Linux Event Logs

Configure one RAW endpoint per stream to keep, using the stream name as the query parameter.

Each name is configurable in the pack through its matching *_stream field: syslog_stream, windows_event_stream, windows_security_stream, windows_dns_stream, windows_firewall_stream, and linux_event_stream. Each category can also be switched off through its keep_* toggle — keep_syslog, keep_windows_event, keep_windows_security, keep_windows_dns, keep_windows_firewall, and keep_linux_event — all of which default to true.

Delivery

When multiple endpoints are configured for a stream, the target shuffles them and tries each in turn until one accepts the batch. If every endpoint fails, the batch is not held in the target: the events are delivered again from the queue.

Examples

Basic

Send events to a single RAW endpoint using token auth...

targets: - name: basic_crowdstrike type: crowdstrike properties: endpoints: - endpoint: "https://ingest.example.com/services/collector/raw" auth_type: token token: "YOUR-HEC-TOKEN"

Content Hub Pack Streams

Configure one RAW endpoint per stream produced by the siem_crowdstrike pack, plus a catch-all endpoint for events without a named stream...

targets: - name: crowdstrike_streams type: crowdstrike properties: endpoints: - endpoint: "https://ingest.example.com/services/collector/raw?Syslog" auth_type: token token: "YOUR-HEC-TOKEN" - endpoint: "https://ingest.example.com/services/collector/raw?WinEvent" auth_type: token token: "YOUR-HEC-TOKEN" - endpoint: "https://ingest.example.com/services/collector/raw?WinSecurity" auth_type: token token: "YOUR-HEC-TOKEN" - endpoint: "https://ingest.example.com/services/collector/raw?WinDNS" auth_type: token token: "YOUR-HEC-TOKEN" - endpoint: "https://ingest.example.com/services/collector/raw?WinFirewall" auth_type: token token: "YOUR-HEC-TOKEN" - endpoint: "https://ingest.example.com/services/collector/raw?LinuxEvent" auth_type: token token: "YOUR-HEC-TOKEN" - endpoint: "https://ingest.example.com/services/collector/raw" auth_type: token token: "YOUR-HEC-TOKEN"

Mutual TLS

Authenticate to the endpoint with a client certificate and key, verified against a custom CA...

targets: - name: crowdstrike_mtls type: crowdstrike properties: endpoints: - endpoint: "https://ingest.example.com/services/collector/raw" auth_type: token token: "YOUR-HEC-TOKEN" cert_name: "client.crt" key_name: "client.key" ca_name: "ca-bundle.crt"

Troubleshooting

The crowdstrike target delivers over the HTTP Event Collector in the same way as the splunk target, and it reports the same errors for the same causes: refused tokens, unreachable endpoints, certificate failures, size limits, and stream routing. Use the troubleshooting section of the Splunk target for the full list of errors, causes and fixes. See Target Delivery Errors for how Director logs and retries target failures.

Read that section with your own target name in mind. Log lines and the connection status carry the name you gave this target, so match on the cause text, which is the part after Reason: or after the last colon, rather than on the target names used in the examples there.

What differs for CrowdStrike Falcon Next-Gen SIEM

• The token is the key of the HEC data connector. Put the key issued with the connector in Falcon into token, and leave auth_type at token. A key that was rotated, revoked or taken from another connector is refused the same way a Splunk token is, typically with a 401 or a 403.
• The status codes come from the CrowdStrike receiver. The text quoted after received status code in a log line is the receiver's own reply, not one of the Splunk replies listed on that page. Match on the status code and read the reply as it stands. The grouping still holds: a 400, 413 or 422 from every endpoint is treated as a permanent rejection and loses data, and everything else is retried.
• The unreadable message entry does not apply here. That entry is about JSON endpoints on a Director release from before they sent the message as text. The endpoints on this page end in /services/collector/raw, and RAW mode sends the _raw value as it stands, so the CEF output of the siem_crowdstrike pack arrives as written. Keep every endpoint on the RAW path, and keep the endpoints of one stream in the same HEC mode.

The failure you are most likely to meet is an event naming a stream that no endpoint defines, because the pack sets a name per log category.

"no endpoint serves stream ..."

[Error] [director] [target-<target id>] [crowdstrike_streams] Sender worker 2 execute() failed for crowdstrike_streams: record rejected by target: no endpoint serves stream "WinDNS", and the target has no default endpoint

Cause: the pack tagged the event with a stream name, in this case WinDNS, and nothing claims it. No endpoint URL ends in ?WinDNS, and no endpoint is configured without a query parameter to act as the catch-all. The quoted name is the value of the matching *_stream field in the pack, so a stream renamed there without the endpoint being renamed with it produces this line.

Fix: add an endpoint whose URL ends in ?WinDNS, or add one endpoint with no query parameter so that every unclaimed stream lands on it. Check each *_stream value in the pack against the query parameters of your endpoints, and switch off a category you do not send with its keep_* toggle. The mirror image of this message is the record names no stream, and the target has no default endpoint: the event named no stream at all, and every endpoint is a named one.

This is data loss, so fix it rather than leaving it to run. The event is tried four times, about 2 seconds apart. On the fourth attempt that event alone is dropped and counted on the target's dropped counter, logged as Target "<name>" rejected record <n> of <payload> on its last delivery attempt — dropping that record and delivering the rest of the payload: <reason>. The events before and after it in the same payload are delivered. Any other event the target refuses on that attempt is dropped the same way without a line of its own, and the payload's Completed processing line ends , rejected by the target and dropped: <count>. The target stays up, and other payloads keep flowing.

note

A startup message about the same endpoints is stream "WinDNS" configured with mixed HEC modes (raw and JSON): check endpoint URLs. It means two endpoints share a stream name but only one of them ends in /raw. The target does not start until every endpoint of that stream uses the same HEC mode.