---
title: "CrowdStrike Falcon Next-Gen SIEM Egress User Guide"
slug: "crowdstrike-falcon-next-gen-siem-user-guide"
description: "User Guide for Crowdstrike Next-Gen SIEM integration for Dataminr Agentic TIP."
updated: 2026-09-25T17:03:55Z
published: 2026-09-25T17:03:55Z
canonical: "knowledge.threatconnect.com/crowdstrike-falcon-next-gen-siem-user-guide"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CrowdStrike Falcon Next-Gen SIEM Egress User Guide

## Overview

This guide provides instructions for installing, deploying, and configuring the **CrowdStrike Falcon Next-Gen SIEM Egress** integration.

Unlike standard intelligence feeds, this [feed API service](https://knowledge.threatconnect.com/docs/feed-api-services) operates strictly as an **egress pipeline**. Rather than ingesting CrowdStrike data into ThreatConnect, it reads existing ThreatConnect Indicators and exports them to Falcon Next-Gen SIEM for use in detection rules and search queries.

### Target Audience

- **ThreatConnect System Administrators:** Responsible for initial installation and deployment.
- **Security Analysts & Operators:** Responsible for defining, managing, and maintaining export configurations.

### Key Capabilities

The application enables users to:

- **Query Indicators:** Filter ThreatConnect Indicators using saved searches based on **Owner**, **Indicator Type**, and **ThreatConnect Query Language (TQL)** filters.
- **Generate Lookup Files:** Compile query results into a single CSV lookup file (one row per indicator value).
  - **Supported Types:** Address, ASN, CIDR, Email Address, Email Subject, File, Host, Registry Key, and URL.
  - **Multi-Hash Handling:** File Indicators containing multiple hashes produce a separate row for each hash type (MD5, SHA-1, and SHA-256).
- **Synchronize with Falcon NG-SIEM:** Automatically upload new lookup files or overwrite existing files in the Falcon Next-Gen SIEM repository according to configured Time-to-Live (TTL) settings—ensuring data is immediately queryable via `match()` and other lookup functions.

No ThreatConnect Groups or Indicators are created by this app — it only reads from ThreatConnect and writes to Falcon Next-Gen SIEM.

## Dependencies

The following dependencies are required to deploy and run the **CrowdStrike Falcon Next-Gen SIEM Egress** app.

### ThreatConnect Dependencies

- Active ThreatConnect API access id and secret key
- ThreatConnect instance with 7.11.2 or newer installed

Note

All ThreatConnect dependencies will be provided by default to subscribing ThreatConnect Cloud customers. Customers on Dedicated Cloud and On-Premises instances can enable these settings on the **Account Settings** screen within their ThreatConnect instance.

### CrowdStrike Dependencies

- **A CrowdStrike Falcon API client (OAuth2 client ID and secret)**
  - Generated in the Falcon console under **Support and resources → API clients and keys**.
  - Must be scoped with permission to read and write Next-Gen SIEM lookup files.
  - Created in the same CrowdStrike cloud (US-1, US-Gov-1, EU-1, or US-2) you select when deploying this app — a client created in the wrong cloud will fail to authenticate.
- **A Falcon Next-Gen SIEM (LogScale) entitlement**
  - Your CrowdStrike subscription must include Next-Gen SIEM, since that is where the exported lookup file is written.
- **A Next-Gen SIEM repository (search domain) to write to**
  - You need the exact, case-sensitive name of the repository the lookup file should be written into. CrowdStrike has no API to list repositories — find the name in the Falcon Next-Gen SIEM UI, or read the `#repo` field from a live query result.

Validation

During setup, we will validate read and write access to both your repository and lookup file.

## Application Setup and Configuration

### Install the CrowdStrike Falcon Next-Gen SIEM Egress App

Follow these steps to install the **CrowdStrike Falcon Next-Gen SIEM Egress** app on your ThreatConnect instance:

1. Log into ThreatConnect with a System Administrator account.
2. From the **Settings** menu on the top navigation bar, select **TC Exchange Settings**.
3. Select the **Catalog** tab on the **TC Exchange Settings** screen.
4. Locate the **CrowdStrike Falcon Next-Gen SIEM Egress** app on the **Catalog** tab.
5. Click **Install** in the **Options** column for the app.
6. Click **INSTALL** in the app's **Release Notes** window.

### Deploy the CrowdStrike Falcon Next-Gen SIEM Egress App to an Organization {#deploy-the-crowdstrike-falcon-next-gen-siem-egress-app-to-an-organization}

Follow these steps to deploy the **CrowdStrike Falcon Next-Gen SIEM Egress** app to an Organization:

1. Log into ThreatConnect with a System Administrator account.
2. From the **Automation & Feeds** menu on the top navigation bar, select **Services**.
3. Click the **Create New Service** button.
4. Fill out the fields in the **Add Service** window as described below.

#### Add Service Configuration

| Name | Description | Required? |
| --- | --- | --- |
| **Select Tab** |  |  |
| Name | Enter the name for this deployment of the app. | Required |
| Type | Select Service API | Required |
| Service | CrowdStrike Falcon Next-Gen SIEM Egress v1.0.0 | Required |
| **Configure Tab** |  |  |
| Launch Server | Select **tc-job** as the launch server for the feed API service. | Required |
| Permissions | Select a specific organization or check **Allow All** | Required |
| API Path | Use the default value unless deploying multiple services. | Required |
| Enable Notifications | Add email addresses and check **Enable Notifications** to enable notifications | Optional |
| Max restart attempts on failure | The maximum number of times the service should be restarted on failure. Recommended value: **10** | Optional |
| **Parameters Tab** |  |  |
| ThreatConnect API Access ID | Access ID for ThreatConnect API Account | Required |
| ThreatConnect API Secret Key | Secret Key for ThreatConnect API Account | Required |
| CrowdStrike API Endpoint | The CrowdStrike API host used by your CrowdStrike account. | Required |
| CrowdStrike API Client ID | Your CrowdStrike account credentials. | Required |
| CrowdStrike API Client Secret | Your CrowdStrike account credentials. | Required |

1. Click **Save** on the **Parameters** tab to create the service.
2. Toggle the created service on.

## Inputs

After the **CrowdStrike Falcon Next-Gen SIEM Egress** service is created, most of its configuration is completed and later adjusted from inside the service's own UI.

### First-Time Setup

The first time you open the service's UI after deployment, a setup stepper walks you through **Connection**, **Schedule**, **Destination**, **Indicator TTL's**, and **Notifications**, one group at a time.

:::(Warning) (Connection Stepper) This is a one-time flow used to validate connection details before moving on to the next configuration screens. There is no way to skip it or access the rest of the UI until it is complete. Every step must pass

before you can continue to the next. Until then, no ingestion job is queued.

If you need to reconfigure, see [Troubleshooting & FAQ](/v1/docs/crowdstrike-falcon-next-gen-siem-user-guide#troubleshooting-faq).

### Connection Details

CrowdStrike's connection fields (API Endpoint, Client ID, Client Secret) and the ThreatConnect credentials are set once when creating the service (see [Deploy the CrowdStrike Falcon Next-Gen SIEM Egress App to an Organization](/docs/crowdstrike-falcon-next-gen-siem-user-guide#deploy-the-crowdstrike-falcon-next-gen-siem-egress-app-to-an-organization) above). To confirm or change any of them, edit the service from the Services page.

### Schedule

Controls the schedule for indicator exports to Next-Gen SIEM.

| Field | Summary | Detail | Default |
| --- | --- | --- | --- |
| Export Frequency | — | How often to export indicators, in hours. | 1 |

### Destination

Controls where indicators are written in Next-Gen SIEM.

| Field | Summary | Detail | Default |
| --- | --- | --- | --- |
| Next-Gen SIEM Lookup Table Filename | — | The name of the lookup file created in Next-Gen SIEM. | tc_ioc_lookup |
| Next-Gen SIEM Repository | — | The repository in Next-Gen SIEM where the lookup file is stored. | search-all |

### TTLs

Controls Time-To-Live configurations for each supported Indicator type.

| Field | Summary | Detail | Default |
| --- | --- | --- | --- |
| TTL for Address Indicators | — | Time-To-Live (TTL) for address indicators in hours. | 24 |
| TTL for ASN Indicators | — | Time-To-Live (TTL) for ASN indicators in hours. | 24 |
| TTL for CIDR Indicators | — | Time-To-Live (TTL) for CIDR indicators in hours. | 24 |
| TTL for Email Address Indicators | — | Time-To-Live (TTL) for email address indicators in hours. | 24 |
| TTL for Email Subject Indicators | — | Time-To-Live (TTL) for email subject indicators in hours. | 24 |
| TTL for File Indicators | — | Time-To-Live (TTL) for file indicators in hours. | 24 |
| TTL for Host Indicators | — | Time-To-Live (TTL) for host indicators in hours. | 24 |
| TTL for Registry Key Indicators | — | Time-To-Live (TTL) for registry key indicators in hours. | 24 |
| TTL for URL Indicators | — | Time-To-Live (TTL) for URL indicators in hours. | 24 |

## Data Mappings

This app does not map vendor data into ThreatConnect — it maps ThreatConnect Indicator data **out** to the Next-Gen SIEM lookup file. The table below shows how each Indicator field becomes a column in that file.

### Indicators

**Source:** Address, ASN, CIDR, Email Address, Email Subject, File, Host, Registry Key, and URL Indicators, drawn from ThreatConnect's Indicators data by the Owners, types, and TQL filter defined for each export configuration on the **Configure** page (see [Workflow/Use Cases](/docs/crowdstrike-falcon-next-gen-siem-user-guide#workflowuse-cases)).

**Destination:** a single CSV lookup file, replaced in full on the target Next-Gen SIEM repository on every scheduled run. This enables customers to apply their own TQL filter and only send malicious, active indicators to Next-Gen SIEM.

| ThreatConnect Field | Next-Gen SIEM Lookup Table Column |
| --- | --- |
| Indicator value (for File Indicators, one row per MD5/SHA1/SHA256 hash present) | `value` |
| Indicator type (Address, ASN, CIDR, EmailAddress, EmailSubject, File, Host, Registry Key, URL) | `type` |
| Rating | `rating` |
| Confidence | `confidence` |
| Threat Assess Score | `ThreatAssessScore` |
| — (computed from the TTL configured for the Indicator's type) | `expires_at` — an ISO 8601 timestamp; the row is dropped from the lookup file once this time passes without the Indicator reappearing in a later export |

## Workflow/Use Cases

#### Scheduled Export Workflow

After onboarding is complete, the scheduler creates export jobs according to the application’s runtime poll frequency. The current Settings page displays Export Frequency, but that field is not currently connected to the scheduler. Unless changed through a supported API or administrative process, exports run every hour.

If no export configurations have been saved, the download stage skips the run and no new lookup file is uploaded.

The first eligible run seeds the export by querying all Indicators matching the saved configurations. Later runs query only Indicators whose lastModified value falls within the job’s time window.

The integration then:

- Merges the matching Indicators into its persisted master CSV.
- Refreshes the expiration time for Indicators returned by the current query.
- Removes rows whose expiration time has passed.
- Writes the resulting CSV.
- Replaces the configured CrowdStrike Next-Gen SIEM lookup file.

Each export configuration contributes to the same lookup file. Configurations are processed in their configured order, and their results are merged by Indicator type and value.

#### No Matching Indicators

If a configuration matches no Indicators, the conversion stage produces no upload file. The existing lookup file in CrowdStrike is not deleted or replaced; it remains unchanged until a later run produces a non-empty export.

#### Lookup File Replacement

The application first attempts to update the configured lookup file. If CrowdStrike reports that the file does not exist, the application creates it instead. Rate-limit responses are retried automatically up to five times.

#### Export Size Limit

CrowdStrike lookup uploads are limited to 200 MB. If the generated CSV exceeds that limit, the application keeps the header and retains rows from the beginning of the CSV until the size limit is reached. The remaining rows are omitted from that upload, and a warning is written to the application log.

The application does not currently select rows based on their age or expiration time when enforcing this limit.

## Troubleshooting & FAQ

Known failure scenarios and their resolutions are listed first, followed by general questions.

#### Redoing First-Time Setup

**Symptom:** You need to run the setup stepper again, for example to correct a value entered during initial setup.

**Cause:** First-time setup is a one-time configuration flow. The UI does not provide a Restart Setup button.

#### Service Fails to Start

**Symptom:** The service does not reach a Running state after deployment.

**Cause:** Preflight checks run before the service starts. Common causes include an unreachable CrowdStrike API, invalid credentials, an incorrect API endpoint, or an invalid repository name.

**Resolution:** Check the application log for the specific preflight failure. Correct the underlying value and redeploy if the problem involves a deploy-time connection field.

#### Nothing Appears in the Next-Gen SIEM Lookup Table

**Symptom:** Jobs complete successfully, but the lookup file is empty or unchanged.

**Cause:** One of the following may apply:

- The saved configurations match no Indicators.
- The current query window contains no added or modified Indicators.
- All existing rows have passed their configured TTL.

**Resolution:** Confirm that at least one export configuration exists and returns a non-zero match count. Verify the selected Owners, Indicator Types, and optional TQL. Then check the Jobs and Errors pages for conversion or upload errors.

Note

n empty export does not delete or clear the existing CrowdStrike lookup file. The previous remote file remains unchanged until a later run produces a non-empty CSV.

#### Lookup Upload Errors

**Symptom:** A job fails or the lookup table is not updated.

**Cause:** CrowdStrike rejected the upload. Possible causes include an invalid repository name, insufficient API permissions, an invalid file, or a transient CrowdStrike service problem.

**Resolution:** Check the **Errors** page for the error returned by CrowdStrike. After the underlying problem is corrected, a later scheduled run can retry the export.

#### What Happens When the CSV Exceeds 200 MB?

The application uploads the complete generated CSV unless it exceeds 200 MB. When the limit is exceeded, it keeps the header and retains rows from the beginning of the CSV until the upload fits within the limit. Remaining rows are omitted from that upload, and a warning is written to the application log.

The application uses the sort order of the TQL Configurations, and the order of the TQL Configurations, to determine which indicators come first in the lookup file.

#### How Does Indicator Expiration Work?

Each exported row receives an `expires_at` timestamp based on the TTL configured for the Indicator type.

When an Indicator is returned by a later export, its expiration timestamp is refreshed. Rows whose expiration timestamp has passed are removed during conversion.

If an Indicator stops matching the saved configuration, it is no longer refreshed and will eventually expire from the lookup file.

#### Are TTL Changes Retroactive?

No. Changing a TTL does not immediately recalculate expiration timestamps for every existing row.

The new TTL is applied when an Indicator is returned by a later export. Until then, the row retains its previously calculated expiration time.

#### How Often Is the Lookup File Refreshed?

The scheduler runs every hour by default.

The first eligible run performs a seed query for all Indicators matching the saved configurations. Later runs query only Indicators whose `lastModified` value falls within the scheduled job's time window.

#### What Happens During the First Export?

After onboarding is complete, the first eligible export:

- Queries all Indicators matching the saved configurations.
- Calculates expiration timestamps.
- Produces the lookup CSV.
- Uploads the lookup file to CrowdStrike.

Later exports process only the relevant `lastModified` delta and merge those results into the lookup file.

#### What Indicator Types Are Supported?

The supported types are Address, ASN, CIDR, Email Address, Email Subject, File, Host, Registry Key, and URL.

#### Can I Run Multiple Instances to manage multiple lookup files?

Yes. Create multiple services, each one managing one lookup file. Use a separate lookup filename for each deployment.

#### What Happens If No Export Configuration Exists?

No jobs will be created until at least one Export Configuration exists.

#### What Licensing and Permissions Are Required?

The CrowdStrike side requires:

- A Falcon Next-Gen SIEM or LogScale entitlement.
- An OAuth2 API client ID and secret.
- Permission to read and write Next-Gen SIEM lookup files.
- The exact name of the target Next-Gen SIEM repository.

The API client must be created in the same CrowdStrike cloud selected during deployment.

### Technical Reference

**CrowdStrike API base URL (selected at deployment, by region):**

| Region | Base URL |
| --- | --- |
| US-1 | `https://api.crowdstrike.com` |
| US-Gov-1 | `https://api.laggar.gcw.crowdstrike.com` |
| EU-1 | `https://api.eu-1.crowdstrike.com` |
| US-2 | `https://api.us-2.crowdstrike.com` |

| Endpoint | Used for |
| --- | --- |
| Next-Gen SIEM — List Lookup Files | Used during first-time setup and connection checks to confirm the API credentials and repository name are valid. |
| Next-Gen SIEM — Update Lookup File (falls back to Create Lookup File if it does not exist yet) | Used on every scheduled export to replace the Next-Gen SIEM lookup table with the current export. |