Fetching CrowdStrike Next-Gen SIEM Alerts into SOAR

[O.Isik]

Hi everyone,

How can I fetch Next-Gen SIEM alerts from CrowdStrike into XSOAR? I have already set up my Falcon integration, and I can fetch categories like endpoint detection.

As seen in the image, there is a query section available to fetch different detections. Additionally, in the fetch types section, there are detection options such as endpoint detection, incident, IDP, OFP, and Mobile etc.

However, I want to fetch all detections coming directly to Next-Gen SIEM. Is this possible? For example, Next-Gen SIEM includes various detections created through email, cloud, and custom rules etc. How can I fetch all of them?

Thanks!

[clopianohastey]

Looking at a solution for this as well, in addition to being able to configure a query (not just search endpoints) in their advanced event search as we're migrating from their Humio/LogScale to Crowdstrike NG SIEM

[MustardMan]

Has there been any resolution to your problem? I would also like to know if there's anyway to fetch the incidents/detections that are created from correlation rules. As you mentioned there are options for the different fetch types, but these do not fetch any alerts made by correlation rules from my experience.