topic Re: Fetching CrowdStrike Next-Gen SIEM Alerts into SOAR in Cortex XSOAR Discussions

Fetching CrowdStrike Next-Gen SIEM Alerts into SOAR

O.Isik — Sun, 23 Feb 2025 12:09:53 GMT

Hi everyone,

How can I fetch Next-Gen SIEM alerts from CrowdStrike into XSOAR? I have already set up my Falcon integration, and I can fetch categories like endpoint detection.

As seen in the image, there is a query section available to fetch different detections. Additionally, in the fetch types section, there are detection options such as endpoint detection, incident, IDP, OFP, and Mobile etc.

However, I want to fetch all detections coming directly to Next-Gen SIEM. Is this possible? For example, Next-Gen SIEM includes various detections created through email, cloud, and custom rules etc. How can I fetch all of them?

Thanks!

Re: Fetching CrowdStrike Next-Gen SIEM Alerts into SOAR

clopianohastey — Thu, 06 Mar 2025 18:41:19 GMT

Looking at a solution for this as well, in addition to being able to configure a query (not just search endpoints) in their advanced event search as we're migrating from their Humio/LogScale to Crowdstrike NG SIEM

Re: Fetching CrowdStrike Next-Gen SIEM Alerts into SOAR

MustardMan — Thu, 27 Mar 2025 13:28:25 GMT

Has there been any resolution to your problem? I would also like to know if there's anyway to fetch the incidents/detections that are created from correlation rules. As you mentioned there are options for the different fetch types, but these do not fetch any alerts made by correlation rules from my experience.

Re: Fetching CrowdStrike Next-Gen SIEM Alerts into SOAR

oromeromoya — Wed, 30 Apr 2025 21:11:14 GMT

Hi, there is no existing content pack for CrowdStrike NG SIEM at this moment. However, it is expected to be available soon (most likely by the end of Q2).

Re: Fetching CrowdStrike Next-Gen SIEM Alerts into SOAR

D.Richards989932 — Tue, 20 Jan 2026 16:05:09 GMT

Anyone find a method to run adhoc queries against NGSIEM with the current integrations?

Re: Fetching CrowdStrike Next-Gen SIEM Alerts into SOAR

Marcello_Lopes — Mon, 09 Mar 2026 12:49:02 GMT

Has anyone here managed to receive alerts directly from CrowdStrike Next-Gen SIEM in XSOAR or XSIAM?

Re: Fetching CrowdStrike Next-Gen SIEM Alerts into SOAR

Bowden — Thu, 23 Apr 2026 15:33:32 GMT

Any updates one when we can query CrowdStrike Next-Gen SIEM data?

Re: Fetching CrowdStrike Next-Gen SIEM Alerts into SOAR

D.Richards989932 — Thu, 23 Apr 2026 15:57:00 GMT

It has been added to the CS falcon integration, although the functionality is very limited.
!cs-falcon-search-ngsiem-events

It does not return any aggregated function results, so beware.