CrowdStrike Falcon Next-Gen SIEM Egress User Guide

Overview

This guide provides instructions for installing, deploying, and configuring the CrowdStrike Falcon Next-Gen SIEM Egress integration.

Unlike standard intelligence feeds, this feed API service operates strictly as an egress pipeline. Rather than ingesting CrowdStrike data into ThreatConnect, it reads existing ThreatConnect Indicators and exports them to Falcon Next-Gen SIEM for use in detection rules and search queries.

Target Audience

• ThreatConnect System Administrators: Responsible for initial installation and deployment.
• Security Analysts & Operators: Responsible for defining, managing, and maintaining export configurations.

Key Capabilities

The application enables users to:

• Query Indicators: Filter ThreatConnect Indicators using saved searches based on Owner, Indicator Type, and ThreatConnect Query Language (TQL) filters.
• Generate Lookup Files: Compile query results into a single CSV lookup file (one row per indicator value).
  • Supported Types: Address, ASN, CIDR, Email Address, Email Subject, File, Host, Registry Key, and URL.
  • Multi-Hash Handling: File Indicators containing multiple hashes produce a separate row for each hash type (MD5, SHA-1, and SHA-256).
• Synchronize with Falcon NG-SIEM: Automatically upload new lookup files or overwrite existing files in the Falcon Next-Gen SIEM repository according to configured Time-to-Live (TTL) settings—ensuring data is immediately queryable via match() and other lookup functions.

No ThreatConnect Groups or Indicators are created by this app — it only reads from ThreatConnect and writes to Falcon Next-Gen SIEM.

Dependencies

The following dependencies are required to deploy and run the CrowdStrike Falcon Next-Gen SIEM Egress app.

ThreatConnect Dependencies

• Active ThreatConnect API access id and secret key
• ThreatConnect instance with 7.11.2 or newer installed

CrowdStrike Dependencies

• A CrowdStrike Falcon API client (OAuth2 client ID and secret)
  • Generated in the Falcon console under Support and resources → API clients and keys.
  • Must be scoped with permission to read and write Next-Gen SIEM lookup files.
  • Created in the same CrowdStrike cloud (US-1, US-Gov-1, EU-1, or US-2) you select when deploying this app — a client created in the wrong cloud will fail to authenticate.
• A Falcon Next-Gen SIEM (LogScale) entitlement
  • Your CrowdStrike subscription must include Next-Gen SIEM, since that is where the exported lookup file is written.
• A Next-Gen SIEM repository (search domain) to write to
  • You need the exact, case-sensitive name of the repository the lookup file should be written into. CrowdStrike has no API to list repositories — find the name in the Falcon Next-Gen SIEM UI, or read the #repo field from a live query result.

Application Setup and Configuration

Install the CrowdStrike Falcon Next-Gen SIEM Egress App

Follow these steps to install the CrowdStrike Falcon Next-Gen SIEM Egress app on your ThreatConnect instance:

1. Log into ThreatConnect with a System Administrator account.
2. From the Settings menu on the top navigation bar, select TC Exchange Settings.
3. Select the Catalog tab on the TC Exchange Settings screen.
4. Locate the CrowdStrike Falcon Next-Gen SIEM Egress app on the Catalog tab.
5. Click Install in the Options column for the app.
6. Click INSTALL in the app's Release Notes window.

Deploy the CrowdStrike Falcon Next-Gen SIEM Egress App to an Organization {#deploy-the-crowdstrike-falcon-next-gen-siem-egress-app-to-an-organization}

Follow these steps to deploy the CrowdStrike Falcon Next-Gen SIEM Egress app to an Organization:

1. Log into ThreatConnect with a System Administrator account.
2. From the Automation & Feeds menu on the top navigation bar, select Services.
3. Click the Create New Service button.
4. Fill out the fields in the Add Service window as described below.

Add Service Configuration

5. Click Save on the Parameters tab to create the service.
6. Toggle the created service on.

Inputs

After the CrowdStrike Falcon Next-Gen SIEM Egress service is created, most of its configuration is completed and later adjusted from inside the service's own UI.

First-Time Setup

The first time you open the service's UI after deployment, a setup stepper walks you through Connection, Schedule, Destination, Indicator TTL's, and Notifications, one group at a time.

:::(Warning) (Connection Stepper) This is a one-time flow used to validate connection details before moving on to the next configuration screens. There is no way to skip it or access the rest of the UI until it is complete. Every step must pass

before you can continue to the next. Until then, no ingestion job is queued.

If you need to reconfigure, see Troubleshooting & FAQ.

Connection Details

CrowdStrike's connection fields (API Endpoint, Client ID, Client Secret) and the ThreatConnect credentials are set once when creating the service (see Deploy the CrowdStrike Falcon Next-Gen SIEM Egress App to an Organization above). To confirm or change any of them, edit the service from the Services page.

Schedule

Controls the schedule for indicator exports to Next-Gen SIEM.

Destination

Controls where indicators are written in Next-Gen SIEM.

TTLs

Controls Time-To-Live configurations for each supported Indicator type.

Data Mappings

This app does not map vendor data into ThreatConnect — it maps ThreatConnect Indicator data out to the Next-Gen SIEM lookup file. The table below shows how each Indicator field becomes a column in that file.

Indicators

Source: Address, ASN, CIDR, Email Address, Email Subject, File, Host, Registry Key, and URL Indicators, drawn from ThreatConnect's Indicators data by the Owners, types, and TQL filter defined for each export configuration on the Configure page (see Workflow/Use Cases).

Destination: a single CSV lookup file, replaced in full on the target Next-Gen SIEM repository on every scheduled run. This enables customers to apply their own TQL filter and only send malicious, active indicators to Next-Gen SIEM.

Workflow/Use Cases

Scheduled Export Workflow

After onboarding is complete, the scheduler creates export jobs according to the application’s runtime poll frequency. The current Settings page displays Export Frequency, but that field is not currently connected to the scheduler. Unless changed through a supported API or administrative process, exports run every hour.

If no export configurations have been saved, the download stage skips the run and no new lookup file is uploaded.

The first eligible run seeds the export by querying all Indicators matching the saved configurations. Later runs query only Indicators whose lastModified value falls within the job’s time window.

The integration then:

• Merges the matching Indicators into its persisted master CSV.
• Refreshes the expiration time for Indicators returned by the current query.
• Removes rows whose expiration time has passed.
• Writes the resulting CSV.
• Replaces the configured CrowdStrike Next-Gen SIEM lookup file.

Each export configuration contributes to the same lookup file. Configurations are processed in their configured order, and their results are merged by Indicator type and value.

No Matching Indicators

If a configuration matches no Indicators, the conversion stage produces no upload file. The existing lookup file in CrowdStrike is not deleted or replaced; it remains unchanged until a later run produces a non-empty export.

Lookup File Replacement

The application first attempts to update the configured lookup file. If CrowdStrike reports that the file does not exist, the application creates it instead. Rate-limit responses are retried automatically up to five times.

Export Size Limit

CrowdStrike lookup uploads are limited to 200 MB. If the generated CSV exceeds that limit, the application keeps the header and retains rows from the beginning of the CSV until the size limit is reached. The remaining rows are omitted from that upload, and a warning is written to the application log.

The application does not currently select rows based on their age or expiration time when enforcing this limit.

Troubleshooting & FAQ

Known failure scenarios and their resolutions are listed first, followed by general questions.

Redoing First-Time Setup

Symptom: You need to run the setup stepper again, for example to correct a value entered during initial setup.

Cause: First-time setup is a one-time configuration flow. The UI does not provide a Restart Setup button.

Service Fails to Start

Symptom: The service does not reach a Running state after deployment.

Cause: Preflight checks run before the service starts. Common causes include an unreachable CrowdStrike API, invalid credentials, an incorrect API endpoint, or an invalid repository name.

Resolution: Check the application log for the specific preflight failure. Correct the underlying value and redeploy if the problem involves a deploy-time connection field.

Nothing Appears in the Next-Gen SIEM Lookup Table

Symptom: Jobs complete successfully, but the lookup file is empty or unchanged.

Cause: One of the following may apply:

• The saved configurations match no Indicators.
• The current query window contains no added or modified Indicators.
• All existing rows have passed their configured TTL.

Resolution: Confirm that at least one export configuration exists and returns a non-zero match count. Verify the selected Owners, Indicator Types, and optional TQL. Then check the Jobs and Errors pages for conversion or upload errors.

Lookup Upload Errors

Symptom: A job fails or the lookup table is not updated.

Cause: CrowdStrike rejected the upload. Possible causes include an invalid repository name, insufficient API permissions, an invalid file, or a transient CrowdStrike service problem.

Resolution: Check the Errors page for the error returned by CrowdStrike. After the underlying problem is corrected, a later scheduled run can retry the export.

What Happens When the CSV Exceeds 200 MB?

The application uploads the complete generated CSV unless it exceeds 200 MB. When the limit is exceeded, it keeps the header and retains rows from the beginning of the CSV until the upload fits within the limit. Remaining rows are omitted from that upload, and a warning is written to the application log.

The application uses the sort order of the TQL Configurations, and the order of the TQL Configurations, to determine which indicators come first in the lookup file.

How Does Indicator Expiration Work?

Each exported row receives an expires_at timestamp based on the TTL configured for the Indicator type.

When an Indicator is returned by a later export, its expiration timestamp is refreshed. Rows whose expiration timestamp has passed are removed during conversion.

If an Indicator stops matching the saved configuration, it is no longer refreshed and will eventually expire from the lookup file.

Are TTL Changes Retroactive?

No. Changing a TTL does not immediately recalculate expiration timestamps for every existing row.

The new TTL is applied when an Indicator is returned by a later export. Until then, the row retains its previously calculated expiration time.

How Often Is the Lookup File Refreshed?

The scheduler runs every hour by default.

The first eligible run performs a seed query for all Indicators matching the saved configurations. Later runs query only Indicators whose lastModified value falls within the scheduled job's time window.

What Happens During the First Export?

After onboarding is complete, the first eligible export:

• Queries all Indicators matching the saved configurations.
• Calculates expiration timestamps.
• Produces the lookup CSV.
• Uploads the lookup file to CrowdStrike.

Later exports process only the relevant lastModified delta and merge those results into the lookup file.

What Indicator Types Are Supported?

The supported types are Address, ASN, CIDR, Email Address, Email Subject, File, Host, Registry Key, and URL.

Can I Run Multiple Instances to manage multiple lookup files?

Yes. Create multiple services, each one managing one lookup file. Use a separate lookup filename for each deployment.

What Happens If No Export Configuration Exists?

No jobs will be created until at least one Export Configuration exists.

What Licensing and Permissions Are Required?

The CrowdStrike side requires:

• A Falcon Next-Gen SIEM or LogScale entitlement.
• An OAuth2 API client ID and secret.
• Permission to read and write Next-Gen SIEM lookup files.
• The exact name of the target Next-Gen SIEM repository.

The API client must be created in the same CrowdStrike cloud selected during deployment.

Technical Reference

CrowdStrike API base URL (selected at deployment, by region):