CrowdStrike Falcon Next-Gen SIEM Events and Alerts

Configure Radiant Security to sync CrowdStrike Next-Gen SIEM events and alerts.

In this guide, you'll create two API clients in CrowdStrike Falcon Next-Gen SIEM—one with read-only access for events and another for alerts—and use their credentials to configure the Radiant data connectors.

At the end of this configuration, you will provide Radiant Security with the following values:

• Client ID

• Secret

• Base URL

Create the credentials for alerts in CrowdStrike Falcon

1. Access CrowdStrike Falcon as Admin.

2. Expand the side menu and click Support and resources.

3. Under Resources and tools, click API clients and keys.

4. Click Create API.

5. Enter a Client Name to help identify the credential.

6. Under Scope, select Alerts: Read and Alerts: Write.

7. Click Create.

8. Copy and store the Client ID, Secret, and Base URL values.

Create the data connector in Radiant Security

1. Log into Radiant Security.

2. From the navigation menu, select Settings > Data Connectors and click + Add Connector.

3. Search for and select the CrowdStrike OAuth2 option from the list and then click Data Feeds.

4. Under Select your data feeds, select Next-Gen SIEM Detections & Incidents and click Credentials.

5. In case you had already created credentials, select them from the drop-down and continue. If you haven’t created credentials yet, create one by giving the credential an identifiable name (e.g. Crowdstrike Falcon Next Gen SIEM Credentials). Then, paste the values (Base URL, Client ID, and Client Secret Key) that you copied from the Create the credentials in CrowdStrike Falcon section. Leave the Prefix field empty.

6. Click Add Connector to save the changes.

Create the credentials for events in CrowdStrike Falcon

1. Access CrowdStrike Falcon as Admin.

2. Expand the side menu and click Support and resources.

3. Under Resources and tools, click API clients and keys.

4. Click Create API.

5. Enter a Client Name to help identify the credential.

6. Under Scope, select NGSIEM: Read, NGSIEM: Write and Alerts: Read.

7. Click Create.

8. Copy and store the Client ID, Secret, and Base URL values.

Add the data connector in Radiant Security

1. Log in to Radiant Security.

2. From the navigation menu, click Settings > Data Connectors and click + Add Connector.

3. Search for and select the CrowdStrike OAuth2 option from the list and then click Data Feeds.

4. Under Select your data feeds, select Next-Gen SIEM Events and click Credentials.

5. In case you had already created credentials, select them from the drop-down and continue. If you haven’t created credentials yet, create one by giving the credential an identifiable name (e.g. Crowdstrike Falcon Next Gen SIEM Credentials). Then, paste the values (Base URL, Client ID, and Client Secret Key) that you copied from the Create the credentials in CrowdStrike Falcon section. Leave the Prefix field empty.

6. Click Add Connector to save the changes.