Crowdstrike Integration to XSIAM

PA_nts — Wed, 20 May 2026 06:58:12 GMT

Hi All,

We are running XSIAM with the Crowdstrike Falcon content pack installed, the parsing and datamodeling works.. data is ingesting etc etc..

however we are not seeing any alerts being generated as yet..

the content pack does not include a realtime correlation rule to pull and map alerts into xsiam.

Has anyone done a custom correlation rule to map alerts from CS into XSIAM? ie duplicating the alerts from CS to XSIAM

please - no 'AI' copy and paste responses.

thanks in adv

topic Crowdstrike Integration to XSIAM in Cortex XSIAM Discussions