CrowdStrike NG-SIEM

Material sends events like Issue Change and Audit Log Updated to CrowdStrike NG-SIEM through a Custom SIEM integration, where CrowdStrike ingests them through a data connection and parser for search, detections, and alert routing.

This guide covers Falcon NG-SIEM, CrowdStrike's current SIEM product. If you're using standalone Falcon LogScale, see Falcon LogScale (Ingest API) below.

Before You Begin

• A Super Admin or Tenant Admin role is required to create custom SIEM integrations.
• In CrowdStrike, you need a parser and a data connection.

Always consult CrowdStrike's Falcon LogScale documentation directly for up-to-date instructions.

---

Part One: Set Up CrowdStrike to Receive Data

Create and configure a parser

1. In CrowdStrike, navigate to Next-Gen SIEM > Log Management > Data onboarding.
2. Select Parsers then click Add new parser.
3. Name your parser (e.g. "Material_Parser"), select Blank template, then click Create.
4. Select all content in the Parser Script section, remove it, and paste the following:

// PREPARSE
parseJson(prefix="Vendor.", excludeEmpty="true", handleNull="discard")
| parseTimestamp(field="Vendor.timestamp")

// METADATA
| Vendor := "material"
| event.module := "material"
| event.dataset := "material.issues"
| observer.type := "material"
| event.kind := "event"
| Parser.version := "1.0.0"
| ecs.version := "9.0.0"
| Cps.version := "1.1.0"

// NORMALIZATION
| array:append("event.category[]", values=["configuration"])
| array:append("event.type[]", values=["change"])
| Vendor.severity match {
    "01_INFO"     => event.severity := 10;
    "02_LOW"      => event.severity := 30;
    "03_MEDIUM"   => event.severity := 50;
    "04_HIGH"     => event.severity := 70;
    "05_CRITICAL" => event.severity := 90;
    *             => event.severity := 50;
}

1. Click Save then exit.

Timestamp Field Mapping

Material sends timestamps in ISO 8601 format (e.g. 2026-05-08T19:51:51.625Z) in a field named timestamp. CrowdStrike requires the field be named @timestamp and parsed using the parseTimestamp() function. This is handled by the parser script above via parseTimestamp(field="Vendor.timestamp").

If you're using a custom parser and see events failing with:

Error finding timestamp. Unknown field: "@timestamp"

ensure your parser includes parseTimestamp(field="Vendor.timestamp"). See Parsing Timestamps in the LogScale documentation for more detail.

Refer to the CrowdStrike parser template and CPS Standard for more detail on writing and customizing parsers.

Create a data connection

1. Navigate to NG-SIEM > Log Management > Data onboarding.
2. Select Data connections then click Add connection.
3. Search for HEC then click Configure.
4. Fill in the required fields:

• Data source: Material Security
• Data type: JSON
• Connector name: Material Security
• Parser: select the parser you created above.

1. Click Save, then Generate API key.
2. Copy the API key and API URL — you'll need both in Part Two.

---

Part Two: Configure Material Custom SIEM Integration

1. In Material, click Integrations (the puzzle icon in the top toolbar).
2. Click Create New Integration.
3. Scroll to SIEM, then click Custom SIEM.
4. Complete the required fields:

Field	Value
Method	POST
URI	Your CrowdStrike API URL from Step One, with /raw appended
Headers	{ "Authorization": "Bearer <your-api-key>", "Content-Type": "application/json" }

1. Click Add Event to configure your triggering events (see Events below).
2. Integrations are toggled On by default. If you want to test before going live, toggle Off, then Save.
3. Click Save.

---

Events

Two useful events to start with are Issue Change and Audit Log Updated. By default, the webhook triggers on any issue change or audit log update if you enable these pre-populated rows. Click an event row to edit and filter further.

Use the form to build the trigger based on multiple event filters. The most common event is Issue Change — it covers most needs.

Recommended starting filters

• New malicious message detected: Issue Change > Types: CREATE

  
• User-reported message: Issue Change > detection: message flagged by user

  
• High / Critical severity issues: Issue Change > Types: CREATE > Severities: Critical and High

  

Filters to refine further

• Skip informational-only issues: set Severities to 02-LOW, 03-MEDIUM, 04-HIGH, 05-CRITICAL (excludes 01-INFO)
• Skip routine updates, fire on new issues only: set Types to Create
• Skip resolved / ignored changes: set Statuses to Open, In Progress, Snoozed — leave unset if you want full lifecycle tracking for metrics like mean time to resolve

Other available filters: Severities, Detection types, Statuses, Accounts, Groups, Tenants, etc.

Alert fatigue tip

Prioritize high-signal events that require analyst intervention. For example, events involving freemail domains should drive immediate triage, whereas internal forwarding may only require standard logging.

Important Notes

• You can include multiple events in one integration, but only one of each event type. If you need OR logic, create multiple integrations with different event parameters.
• Toggle events off/on at any time from the integration view.
• Check Include events for messages being added / removed / interacted with in a phishing case only for higher-volume, more sensitive payloads.

Learn more about events here.

---

Test Your Integration

1. Open a saved event, then click Send Test Event. (You need to save the integration first to see this option).
2. In CrowdStrike, navigate to NG-SIEM > Advanced event search and run the following queries to confirm events are arriving correctly:

Query	Expected result
vendor="Material Security"	One or more events appear with Material as the source and recent timestamps
product="Material Security"	Results overlap with the vendor query, confirming normalization is present
vendor="Material Security" event.category="email"	All returned events are email-related
vendor="Material Security" event.action="issue_change"	Issue-level events appear (rather than raw lower-level detections)

---

Payload

• All webhooks send payloads with the same fields in JSON format. Event Descriptions are in app; click the API icon in the toolbar then click Events.
• Material verifies SSL certificates when delivering payloads.
• Once you have saved the integration, you can click Copy Test Event to view an example payload.

Example Payload

{
  "eventId": "abc123",
  "timestamp": "YYYY-MM-DDTHR:MIN:SEC",
  "orgId": "demo",
  "uDomainId": "google://C029fz6xs/",
  "requestor": {
    "system": true
  },
  "tenant": null,
  "account": null,
  "group": null,
  "file": null,
  "message": {
    "uDomainId": "google://abc123",
    "messageId": "<[e-mail]>",
    "msgDate": "YYYY-MM-DDTHR:MIN:SEC",
    "msgSender": "[e-mail]"
  },
  "app": null,
  "type": "CREATE",
  "issue": {
    "entityType": "MESSAGE",
    "uDomainId": "google://abc123",
    "messageId": "<[e-mail]>",
    "msgDate": "YYYY-MM-DDTHR:MIN:SEC",
    "id": "abc123",
    "entityId": "MESSAGE:{\"messageId\":\"<[e-mail]>\",\"msgDate\":\"YYYY-MM-DDTHR:MIN:SEC\",\"uDomainId\":\"google://abc123/\"}",
    "detectionId": "phishing-attack-user-report",
    "detectionType": "PHISHING_EVENT_BASED",
    "categories": [
      "EMAIL_SECURITY"
    ],
    "tactics": [],
    "severity": "03-MEDIUM",
    "status": "OPEN",
    "lastStateChangeTimestamp": "YYYY-MM-DDTHR:MIN:SEC",
    "lastOpenedTimestamp": "2YYYY-MM-DDTHR:MIN:SEC",
    "lastResolvedTimestamp": null,
    "snoozedUntilTimestamp": null,
    "ignoreReason": null,
    "resolveReason": null,
    "classification": "MALICIOUS",
    "analysis": [],
    "scopes": [
      {
        "type": "count",
        "countType": "num_accounts",
        "countValue": 1
      },
      {
        "type": "count",
        "countType": "num_messages",
        "countValue": 1
      },
      {
        "type": "count",
        "countType": "num_links",
        "countValue": 0
      },
      {
        "type": "count",
        "countType": "num_attachments",
        "countValue": 0
      }
    ],
    "associatedEntityIds": [
      "ACCOUNT:{\"uAcctId\":\"google://abc123/\",\"uDomainId\":\"google://abc123/\"}",
      "MESSAGE:{\"messageId\":\"<[e-mail]>\",\"msgDate\":\"YYYY-MM-DDTHR:MIN:SEC\",\"uDomainId\":\"google://abc123/\"}"
    ],
    "numAccounts": 1,
    "numMessages": 1,
    "numAttachments": 0,
    "numLinks": 0,
    "fixes": [
      {
        "type": "tag",
        "label": "Speedbump"
      },
      {
        "type": "tag",
        "label": "Warning Banner"
      },
      {
        "type": "tag",
        "label": "Spam"
      }
    ],
    "extra": {
      "caseId": "20260309_KrTmx0YJ"
    },
    "caseId": "20260309_KrTmx0YJ",
    "comments": [],
    "ownerUAcctId": null,
    "createdAt": "YYYY-MM-DDTHR:MIN:SEC",
    "updatedAt": "YYYY-MM-DDTHR:MIN:SEC",
    "lastCheckedAt": "YYYY-MM-DDTHR:MIN:SEC",
    "entityDisplayLabel": null,
    "detectionName": "Message flagged by user",
    "nameSearchValue": "",
    "nameSearchValueUpdatedAt": null,
    "dedupKey": "20260309_KrTmx0YJ",
    "dedupTimestamp": "YYYY-MM-DDTHR:MIN:SEC",
    "isMock": false,
    "issueName": "Message flagged by user",
    "issueLink": "https://acme.com"
  },
  "after": null,
  "before": null,
  "getMaterialBaseUrl": {
    "url": "https://acme.com"
  }
}

Field Mapping

Material sends the standard JSON payload as-is. Field mapping and normalization are handled on the CrowdStrike side in your parser.

---

Troubleshooting

Timestamp Field Mapping

Material sends timestamps in ISO 8601 format (e.g. 2026-05-08T19:51:51.625Z) in a field named timestamp. CrowdStrike requires the field to be named @timestamp and parsed using the parseTimestamp() function. This is handled by the parser script above via parseTimestamp(field="Vendor.timestamp").

If you're using a custom parser and see events failing with:

Error finding timestamp. Unknown field: "@timestamp"

ensure your parser includes parseTimestamp(field="Vendor.timestamp"). See Parsing Timestamps in the LogScale documentation for more detail.

Common Errors

Error Code	Description	Solution
400	Bad Request	Confirm your payload fields are formatted correctly for CrowdStrike's requirements
401	Unauthorized	Verify your API key
403	Forbidden	Check your headers for correct permissions and bearer token
404	Not Found	Verify your endpoint URL
408	Timeout	Double check your endpoint and tool requirements
502	Bad Gateway	Verify your endpoint URL, any intermediate infrastructure, and your webhook implementation
504	Timeout	Double check your endpoint and tool requirements

Troubleshooting Workflow

1. Check Event Subscription Status: Look for error messages in Material indicating why events might be failing or if subscriptions have been auto-disabled.
2. Verify connectivity: Confirm CrowdStrike can receive test events using Send Test Event.
3. Validate permissions: Ensure your Material account has a Super Admin or Tenant Admin role.
4. Check integration logs: Look for specific error messages in both Material and CrowdStrike.

---

Falcon LogScale (Ingest API)

If you're using standalone Falcon LogScale rather than Falcon NG-SIEM, the setup uses the LogScale Ingest API directly instead of Connectors. The high-level approach is the same — Material sends a POST request with a JSON payload — but the CrowdStrike-side setup differs:

• Create a Repository and an Ingest Token in LogScale under Settings → Repositories and Settings → Ingest Tokens
• Your ingest endpoint will follow the pattern: https://cloud.<region>.humio.com/api/v1/ingest/json
• Use the same Bearer token pattern in the Material headers
• Create a custom Parser in LogScale to normalize Material's fields, including the timestamp → @timestamp mapping described above
• Create a custom Parser in LogScale to normalize Material's fields, including parseTimestamp(field="Vendor.timestamp") as described above

Refer to CrowdStrike's Ingest API documentation for full setup instructions.

---

Resources

• SIEM Integrations
• CrowdStrike Falcon LogScale documentation
• CrowdStrike NG-SIEM CPS Standard
• CrowdStrike Parser Template
• LogScale Parsing Timestamps