CrowdStrike Next-Gen SIEM

[YilmazDincer]

Hi all,

How can i fetch the alert generated by CrowdStrike Next-Gen SIEM to SOAR? Here, are the alerts generated by queries created or like Email, Cloud category.

#XSOAR #CrowdStrike #Next-GenSIEM

[cmcneil]

Well, that depends.
Which CS product specifically are you using? For Falcon, you would start with the CrowdStrike Falcon content pack (here https://cortex.marketplace.pan.dev/marketplace/details/CrowdStrikeFalcon/) and then need to configure the CrowdStrike Falcon integration (documentation here https://xsoar.pan.dev/docs/reference/integrations/crowdstrike-falcon)

For CrowdStrike Falcon Streaming, it's the same but with a different content pack (here https://cortex.marketplace.pan.dev/marketplace/details/CrowdStrikeFalconStreamingV2/) and a different integration (documentation here https://xsoar.pan.dev/docs/reference/integrations/crowd-strike-falcon-streaming-v2)

Since it sounds like you haven't set up an integration before, I would highly recommend checking out the XSOAR Engineer Training videos playlist on YouTube (available here https://www.youtube.com/watch?v=BhpkZA9t1HA&list=PLD6FJ8WNiIqUVEA2e5LZhmqNnwFcFhDTZ&index=1) as that will walk you through the many steps you will need to understand to get the integration set up and working.

Best of luck!