> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/integrations/integration-fundamentals/siem-integrations/crowdstrike-ng-siem.md). # CrowdStrike NG-SIEM Material sends events like **Issue Change** and **Audit Log Updated** to CrowdStrike NG-SIEM through a Custom SIEM integration, where CrowdStrike ingests them through a data connection and parser for search, detections, and alert routing. {% hint style="info" %} This guide covers **Falcon NG-SIEM**, CrowdStrike's current SIEM product. If you're using standalone **Falcon LogScale**, see [Falcon LogScale (Ingest API)](#falcon-logscale-ingest-api) below. {% endhint %} ## Before You Begin * A Super Admin or Tenant [Admin role](/learn-more/administration/admin-roles.md) is required to create custom SIEM integrations. * In CrowdStrike, you need [a parser and a data connection](#step-one-set-up-crowdstrike-to-receive-data). Always consult [CrowdStrike's Falcon LogScale documentation](https://library.humio.com/) directly for up-to-date instructions. *** ## Part One: Set Up CrowdStrike to Receive Data ### Create and configure a parser 1. In CrowdStrike, navigate to **Next-Gen SIEM > Log Management > Data onboarding**. 2. Select **Parsers** then click **Add new parser**. 3. Name your parser (e.g. "Material\_Parser"), select **Blank template**, then click **Create**. 4. Select all content in the **Parser Script** section, remove it, and paste the following: {% code overflow="wrap" %} ```json // PREPARSE parseJson(prefix="Vendor.", excludeEmpty="true", handleNull="discard") | parseTimestamp(field="Vendor.timestamp") // METADATA | Vendor := "material" | event.module := "material" | event.dataset := "material.issues" | observer.type := "material" | event.kind := "event" | Parser.version := "1.0.0" | ecs.version := "9.0.0" | Cps.version := "1.1.0" // NORMALIZATION | array:append("event.category[]", values=["configuration"]) | array:append("event.type[]", values=["change"]) | Vendor.severity match { "01_INFO" => event.severity := 10; "02_LOW" => event.severity := 30; "03_MEDIUM" => event.severity := 50; "04_HIGH" => event.severity := 70; "05_CRITICAL" => event.severity := 90; * => event.severity := 50; } ``` {% endcode %} 5. Click **Save** then exit. {% hint style="warning" %} #### Timestamp Field Mapping Material sends timestamps in ISO 8601 format (e.g. `2026-05-08T19:51:51.625Z`) in a field named `timestamp`. CrowdStrike requires the field be named `@timestamp` and parsed using the `parseTimestamp()` function. This is handled by the [parser script above](#create-and-configure-a-parser) via `parseTimestamp(field="Vendor.timestamp")`. If you're using a custom parser and see events failing with: ``` Error finding timestamp. Unknown field: "@timestamp" ``` ensure your parser includes `parseTimestamp(field="Vendor.timestamp")`. See [Parsing Timestamps](https://library.humio.com/data-analysis/parsers-parsing-timestamps.html) in the LogScale documentation for more detail. {% endhint %} Refer to the [CrowdStrike parser template](https://developer.crowdstrike.com/docs/ng-siem/parser-template/) and [CPS Standard](https://developer.crowdstrike.com/docs/ng-siem/cps-standard/) for more detail on writing and customizing parsers. ### Create a data connection 1. Navigate to **NG-SIEM > Log Management > Data onboarding**. 2. Select **Data connections** then click **Add connection**. 3. Search for **HEC** then click **Configure**. 4. Fill in the required fields: * **Data source**: Material Security * **Data type**: JSON * **Connector name**: Material Security * **Parser**: select the [parser you created above](#create-and-configure-a-parser). 5. Click **Save**, then **Generate API key**. 6. Copy the **API key** and **API URL** — you'll need both in Part Two. *** ## Part Two: Configure Material Custom SIEM Integration 1. In Material, click **Integrations** (the puzzle icon in the top toolbar). 2. Click **Create New Integration**. 3. Scroll to **SIEM**, then click **Custom SIEM**. 4. Complete the required fields: | Field | Value | | ----------- | ---------------------------------------------------------------------------------- | | **Method** | POST | | **URI** | Your CrowdStrike API URL from Step One, with `/raw` appended | | **Headers** | `{ "Authorization": "Bearer ", "Content-Type": "application/json" }` | 5. Click **Add Event** to configure your triggering events (see [Events](#events) below). 6. Integrations are toggled **On** by default. If you want to test before going live, toggle **Off**, then **Save**. 7. Click **Save**. *** ### Events [Two useful events](/integrations/integration-fundamentals/siem-integrations.md#event-delivery-behavior) to start with are **Issue Change** and **Audit Log Updated**. By default, the webhook triggers on any issue change or audit log update if you enable these pre-populated rows. Click an event row to edit and filter further.
Use the form to build the trigger based on multiple event filters. The most common event is `Issue Change` — it covers most needs.
Recommended starting filters * **New malicious message detected**: Issue Change > Types: CREATE
* **User-reported message**: Issue Change > detection: message flagged by user
* **High / Critical severity issues**: Issue Change > Types: CREATE > Severities: Critical and High
Filters to refine further * **Skip informational-only issues**: set **Severities** to `02-LOW`, `03-MEDIUM`, `04-HIGH`, `05-CRITICAL` (excludes `01-INFO`) * **Skip routine updates, fire on new issues only**: set **Types** to `Create` * **Skip resolved / ignored changes**: set **Statuses** to `Open`, `In Progress`, `Snoozed` — leave unset if you want full lifecycle tracking for metrics like mean time to resolve Other available filters: Severities, Detection types, Statuses, Accounts, Groups, Tenants, etc.
{% hint style="success" %} **Alert fatigue tip** Prioritize high-signal events that require analyst intervention. For example, events involving freemail domains should drive immediate triage, whereas internal forwarding may only require standard logging. {% endhint %} {% hint style="info" %} **Important Notes** * You can include multiple events in one integration, but only one of each event type. If you need `OR` logic, create multiple integrations with different event parameters. * Toggle events off/on at any time from the integration view. * Check **Include events for messages being added / removed / interacted with in a phishing case** only for higher-volume, more sensitive payloads. {% endhint %} [Learn more about events here](/integrations/integration-fundamentals/siem-integrations.md#event). *** ### Test Your Integration 1. Open a saved event, then click **Send Test Event**. (You need to save the integration first to see this option). 2. In CrowdStrike, navigate to **NG-SIEM > Advanced event search** and run the following queries to confirm events are arriving correctly: | Query | Expected result | | -------------------------------------------------------- | --------------------------------------------------------------------------- | | `vendor="Material Security"` | One or more events appear with Material as the source and recent timestamps | | `product="Material Security"` | Results overlap with the vendor query, confirming normalization is present | | `vendor="Material Security" event.category="email"` | All returned events are email-related | | `vendor="Material Security" event.action="issue_change"` | Issue-level events appear (rather than raw lower-level detections) | *** ### Payload * All webhooks send payloads with the same fields in JSON format. Event Descriptions are in app; click the **API** icon in the toolbar then click **Events**. * Material verifies SSL certificates when delivering payloads. * Once you have saved the integration, you can click **Copy Test Event** to view an example payload.
Example Payload {% code overflow="wrap" %} ```json { "eventId": "abc123", "timestamp": "YYYY-MM-DDTHR:MIN:SEC", "orgId": "demo", "uDomainId": "google://C029fz6xs/", "requestor": { "system": true }, "tenant": null, "account": null, "group": null, "file": null, "message": { "uDomainId": "google://abc123", "messageId": "", "msgDate": "YYYY-MM-DDTHR:MIN:SEC", "msgSender": "demo@acme.com" }, "app": null, "type": "CREATE", "issue": { "entityType": "MESSAGE", "uDomainId": "google://abc123", "messageId": "", "msgDate": "YYYY-MM-DDTHR:MIN:SEC", "id": "abc123", "entityId": "MESSAGE:{\"messageId\":\"\",\"msgDate\":\"YYYY-MM-DDTHR:MIN:SEC\",\"uDomainId\":\"google://abc123/\"}", "detectionId": "phishing-attack-user-report", "detectionType": "PHISHING_EVENT_BASED", "categories": [ "EMAIL_SECURITY" ], "tactics": [], "severity": "03-MEDIUM", "status": "OPEN", "lastStateChangeTimestamp": "YYYY-MM-DDTHR:MIN:SEC", "lastOpenedTimestamp": "2YYYY-MM-DDTHR:MIN:SEC", "lastResolvedTimestamp": null, "snoozedUntilTimestamp": null, "ignoreReason": null, "resolveReason": null, "classification": "MALICIOUS", "analysis": [], "scopes": [ { "type": "count", "countType": "num_accounts", "countValue": 1 }, { "type": "count", "countType": "num_messages", "countValue": 1 }, { "type": "count", "countType": "num_links", "countValue": 0 }, { "type": "count", "countType": "num_attachments", "countValue": 0 } ], "associatedEntityIds": [ "ACCOUNT:{\"uAcctId\":\"google://abc123/\",\"uDomainId\":\"google://abc123/\"}", "MESSAGE:{\"messageId\":\"\",\"msgDate\":\"YYYY-MM-DDTHR:MIN:SEC\",\"uDomainId\":\"google://abc123/\"}" ], "numAccounts": 1, "numMessages": 1, "numAttachments": 0, "numLinks": 0, "fixes": [ { "type": "tag", "label": "Speedbump" }, { "type": "tag", "label": "Warning Banner" }, { "type": "tag", "label": "Spam" } ], "extra": { "caseId": "20260309_KrTmx0YJ" }, "caseId": "20260309_KrTmx0YJ", "comments": [], "ownerUAcctId": null, "createdAt": "YYYY-MM-DDTHR:MIN:SEC", "updatedAt": "YYYY-MM-DDTHR:MIN:SEC", "lastCheckedAt": "YYYY-MM-DDTHR:MIN:SEC", "entityDisplayLabel": null, "detectionName": "Message flagged by user", "nameSearchValue": "", "nameSearchValueUpdatedAt": null, "dedupKey": "20260309_KrTmx0YJ", "dedupTimestamp": "YYYY-MM-DDTHR:MIN:SEC", "isMock": false, "issueName": "Message flagged by user", "issueLink": "https://acme.com" }, "after": null, "before": null, "getMaterialBaseUrl": { "url": "https://acme.com" } } ``` {% endcode %}
### Field Mapping Material sends the standard JSON payload as-is. [Field mapping and normalization are handled on the CrowdStrike side in your parser.](#create-and-configure-a-parser) *** ## Troubleshooting #### Timestamp Field Mapping Material sends timestamps in ISO 8601 format (e.g. `2026-05-08T19:51:51.625Z`) in a field named `timestamp`. CrowdStrike requires the field to be named `@timestamp` and parsed using the `parseTimestamp()` function. This is handled by the [parser script above](#create-and-configure-a-parser) via `parseTimestamp(field="Vendor.timestamp")`. If you're using a custom parser and see events failing with: ``` Error finding timestamp. Unknown field: "@timestamp" ``` ensure your parser includes `parseTimestamp(field="Vendor.timestamp")`. See [Parsing Timestamps](https://library.humio.com/data-analysis/parsers-parsing-timestamps.html) in the LogScale documentation for more detail. ### Common Errors | Error Code | Description | Solution | | ---------- | ------------ | ------------------------------------------------------------------------------------------ | | 400 | Bad Request | Confirm your payload fields are formatted correctly for CrowdStrike's requirements | | 401 | Unauthorized | Verify your API key | | 403 | Forbidden | Check your headers for correct permissions and bearer token | | 404 | Not Found | Verify your endpoint URL | | 408 | Timeout | Double check your endpoint and tool requirements | | 502 | Bad Gateway | Verify your endpoint URL, any intermediate infrastructure, and your webhook implementation | | 504 | Timeout | Double check your endpoint and tool requirements | ### Troubleshooting Workflow 1. **Check Event Subscription Status:** Look for error messages in Material indicating why events might be failing or if subscriptions have been auto-disabled. 2. **Verify connectivity:** Confirm CrowdStrike can receive test events using **Send Test Event**. 3. **Validate permissions:** Ensure your Material account has a Super Admin or Tenant Admin role. 4. **Check integration logs:** Look for specific error messages in both Material and CrowdStrike. *** ## Falcon LogScale (Ingest API) If you're using standalone **Falcon LogScale** rather than Falcon NG-SIEM, the setup uses the LogScale Ingest API directly instead of Connectors. The high-level approach is the same — Material sends a POST request with a JSON payload — but the CrowdStrike-side setup differs: * Create a **Repository** and an **Ingest Token** in LogScale under **Settings → Repositories** and **Settings → Ingest Tokens** * Your ingest endpoint will follow the pattern: `https://cloud..humio.com/api/v1/ingest/json` * Use the same Bearer token pattern in the Material headers * [Create a custom **Parser**](#create-a-parser) in LogScale to normalize Material's fields, including the `timestamp` → `@timestamp` mapping [described above](#configure-your-parser) * Create a custom Parser in LogScale to normalize Material's fields, including `parseTimestamp(field="Vendor.timestamp")` as [described above](#create-and-configure-a-parser) Refer to [CrowdStrike's Ingest API documentation](https://library.humio.com/logscale-api/api-ingest.html) for full setup instructions. *** ## Resources * [SIEM Integrations](/integrations/integration-fundamentals/siem-integrations.md) * [CrowdStrike Falcon LogScale documentation](https://library.humio.com/) * [CrowdStrike NG-SIEM CPS Standard](https://developer.crowdstrike.com/docs/ng-siem/cps-standard/) * [CrowdStrike Parser Template](https://developer.crowdstrike.com/docs/ng-siem/parser-template/) * [LogScale Parsing Timestamps](https://library.humio.com/data-analysis/parsers-parsing-timestamps.html) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.material.security/integrations/integration-fundamentals/siem-integrations/crowdstrike-ng-siem.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.