CrowdStrike Next-Gen SIEM Log Forwarding

You can configure AIDR events to be forwarded to CrowdStrike Next-Gen SIEM using the HTTP Event Collector (HEC) protocol. This allows you to centralize Pangea logs alongside other CrowdStrike telemetry for unified threat detection, monitoring, and response.

Configure a connector

In your CrowdStrike Falcon console, follow the instructions in Step 1: Configure and activate the Pangea AI Guard data connector in the HEC/HTTP Event Connector guide.

For example:

1. Navigate to the Data connections page under Next-Gen SIEM >> Data onboarding in your CrowdStrike Falcon console.

2. Click Add connection in the list of connections.

3. In the Product filter, select HEC.

4. Click HEC / HTTP Event Connector in the list.

5. Click Configure.

6. On the Add new connector page, enter Data source, Connector name, and Description.

7. Under Parser details, select a parser.

   Pangea offers a CrowdStrike Next-Gen SIEM parser designed to process events from the AI Guard Activity Log , which is enabled by default when the AI Guard service is activated.

   Select PangeaAIGuardParser if you're forwarding AI Guard activity logs to CrowdStrike.

8. Accept the terms and conditions, then click Save.

9. On the connector details page, click Generate API key.

10. Copy the API key and API URL. You will use these values to configure log forwarding in the Secure Audit Log service.

Set up log forwarding

1. In your AIDR admin console, click Settings in the sidebar; then, select Organization Settings.

2. Click Data Export in the sidebar menu on the organization settings page.

3. Under Audit Log Forwarding, toggle the control in the top-right to Enabled.

4. Set Logging Service to CrowdStrike Next-Gen SIEM.

5. For Event URL, enter the API URL from your CrowdStrike connector.

6. Click the Store HEC Token button.

7. In the New Secret dialog, enter the API key from your CrowdStrike connector in the Secret field.

8. Click Done.

9. Click Save to apply the configuration.

10. Click Test forwarding configuration to validate the setup.

    

    A failed test displays an error message, for example:

    

To generate real events, return to the Dashboard, and use the Playground feature or deploy a sensor .

After a few minutes, you should see the forwarded events in your CrowdStrike Falcon console under Next-Gen SIEM >> Advanced event search.

note

The following optional fields are not applicable when using the CrowdStrike Next-Gen SIEM connector:

• Index
• Indexer Acknowledgment
• Provider certificate to use self-signed TLS

Next steps

To visualize log data forwarded from Pangea to CrowdStrike Next-Gen SIEM, use the prebuilt Pangea dashboards available on GitHub . You can import these dashboards into your CrowdStrike Falcon console by following the instructions in the repository README.

Was this article helpful?

Contact us