Skip to content
downpipes docs

Forward the downpipes audit trail to CrowdStrike Falcon Next-Gen SIEM

CrowdStrike Falcon Next-Gen SIEM receives the downpipes audit trail through a HEC data connection. Falcon Next-Gen SIEM runs on LogScale, whose HTTP Event Collector is backward-compatible with Splunk’s, so the engine sends the same HEC event envelope it sends Splunk, dialling out to your Falcon ingest URL on the scheduler tick. The one thing that differs from Splunk is the credential: Falcon authenticates with a bearer token in the Authorization header, not Splunk’s Splunk <token> scheme.

Because the engine makes the outbound call, a Cloudflare Access perimeter on your console hostname never blocks this: there is no inbound request for Access to turn away.

What you need

  • Falcon Next-Gen SIEM enabled, with permission to create a HEC data connection.
  • The ingest URL and bearer token from that connection, and owner access to the downpipes console.

Set it up

  1. In Falcon Next-Gen SIEM, create a HEC data connection (under the Next-Gen SIEM data onboarding area; the exact menu label moves, so follow Falcon’s own HEC connector guide). Give it a name.
  2. Copy the connection’s ingest URL and its token value.
  3. In the downpipes console, open Integrations, choose this vendor’s tile, and set up the SIEM audit push there (owner-only, asks for a fresh step-up sign-in).
  4. Set the sink to HTTPS endpoint, the format to Splunk HEC, and paste the Falcon ingest URL.
  5. Leave the auth header name as Authorization, and paste the token as Bearer <token>: the word Bearer, one space, then the token. This is the difference from Splunk, whose HEC wants the Splunk prefix instead.
  6. Choose Test send. The engine posts one synthetic audit-shaped event and reports Falcon’s honest response. A test send never advances the delivery cursor.
  7. With the test accepted, Enable the destination. From the next scheduler tick, the engine forwards every audit event above the cursor.

What lands in CrowdStrike

Each event arrives as one HEC event object, newline-concatenated in the request body, the same envelope Splunk’s HEC receives:

{"time":1751681648,"source":"downpipes","sourcetype":"downpipe:audit","event":{"seq":4097,"action":"restore-approve","outcome":"success","actorEmail":"ops@acme.example","...":"..."}}

LogScale ingests the event object’s fields, so you can search on action, outcome, actorEmail and the rest. The sourcetype is downpipe:audit.

Good to know

  • The credential is the only thing that differs from Splunk. Send the Splunk HEC format, but authenticate with Bearer <token> in the Authorization header. The bare token, or Splunk’s Splunk <token> prefix, will not authenticate against Falcon’s HEC.
  • Delivery is at-least-once, not exactly-once. Every event carries a stable seq and hash to dedup on. The feed carries operator identity (member emails, source IPs, roles and approver emails); no backup data and no secret values. For the shared push mechanics and the pull alternative, see forwarding the audit log to your SIEM.

Last updated .