CCSE: CrowdStrike Certified SIEM EngineerDemo

A CrowdStrike CID can have up to 750 active correlation rules, with scheduled searches included in that active-rule limit.

JSON and key-value records require different parsing rules. A multi-source configuration supports assigning an appropriate parser to each source or format, so both types of incoming logs can be interpreted correctly.

Falcon Log Collector requires a 1 GB baseline in addition to the memory queues configured for its sinks. Four 2 GB memory queues consume 8 GB, so the minimum required memory is 9 GB.

A custom parser should apply the appropriate timezone parameter when parsing the log timestamp, so the event time is interpreted correctly. Cloning the parser allows that timezone-specific change while retaining the original parser. Google Security Operations supports a timezone parameter in its date parsing function.

#event.dataset is a CPS-compliant parser tag. It identifies the specific dataset within an event.module; LogScale prefixes tagged fields with # after ingestion.

A query-based parameter dynamically populates its available values by running a KQL query against the data, making it suitable for presenting source IP addresses found in inbound network connections. Free-text parameters do not provide a populated data-derived list, and fixed-value parameters require manually specified static values.

Falcon Foundry is CrowdStrike’s application-development platform for building custom Falcon apps with automated workflows, queries, and integrations. Those capabilities can monitor defined user activity and trigger alerts when suspicious-event conditions are met.

In Falcon LogScale, the built-in #type field identifies the parser that processed the log. A cloned parser has a distinct parser identity even when its parsing logic differs only in parseTimestamp(), so searches constrained by #type must be updated to match the cloned parser. #Cps.version denotes the CPS standard targeted by the parser and does not change merely because timestamp parsing is customized. LogScale Data Ingestion Overview, CPS-Compliant Parsers

CPS-compliant Event parsers must include event.category, event.dataset, event.kind, and event.outcome. The required set uses event.dataset, not event.module.

CrowdStrike Falcon Next-Gen SIEM represents ingest as average GB per day for third-party data sources, measured from the incoming raw payload before parser-driven field extraction and normalization. Native Falcon telemetry is platform data rather than third-party SIEM ingestion. CrowdStrike documents its included allowance as 10 GB/day of third-party data ingestion, and its parsing documentation describes parsing as a subsequent ingestion-stage operation.

For high-throughput ingestion, sink throughput depends in part on the number of concurrent requests (workers) it can send. Increasing sink workers improves performance when parallel requests are the bottleneck and the LogScale endpoint has capacity. A larger memory queue merely buffers data and does not increase sink throughput.

Labels provide metadata for identifying and categorizing collectors, allowing group configurations to be targeted and managed across matching collector instances.

Fusion SOAR workflows automate ticket creation and lifecycle actions in third-party ticketing systems based on Falcon detections, reducing manual incident-tracking work.

NG SIEM Security Lead grants the Next-Gen SIEM content-management permissions needed to create and manage parsers without assigning the broader administrative privileges of NG SIEM Administrator. Analyst roles do not provide the required parser-management access.

A JSON log event must be parsed with parseJson(). The ts value uses the format yyyy/MM/dd HH:mm:ss, and parseTimestamp must target the ts field while specifying the missing Europe/Paris timezone.

NGSIEM Write permission is required to create a Search Query Job, and NGSIEM Read permission is required to fetch the query job and its results. Both permissions are therefore necessary.

ECS core fields represent the most commonly applicable event data across use cases. Populating and normalizing them enables searches, dashboards, alerts, and other analysis content to work consistently with relevant events from any data source.

In Fleet Overview, open the ellipsis menu for the selected Falcon Log Collector instance and choose Manage Internal Logging, where internal logging can be enabled and configured without restarting the collector.

Native CrowdStrike telemetry from the Falcon platform is already available to Falcon Next-Gen SIEM, providing immediate access without separate data onboarding, a log collector installation, or a third-party integration.

The monitor command opens a live terminal view of the Falcon LogScale Collector, allowing its running sources, queues, and sinks to be inspected in real time.

The := assignment operator creates a new ECS field from the Vendor field’s value while leaving the original Vendor field intact. LogScale documents := as shorthand for field assignment through eval and for assigning a function result to a named output field, so both field names remain available.

A potentially exposed API key should be replaced by regenerating a new key directly in the platform, preventing continued use of the compromised credential.

Built-in dashboards provide ready-to-use visualizations and summaries that deliver rapid security insights without requiring manual dashboard configuration.