Skip to content
downpipes docs

Forward the downpipes audit trail to CrowdStrike Falcon Next-Gen SIEM

CrowdStrike Falcon Next-Gen SIEM receives the downpipes audit trail through a HEC data connection. Falcon Next-Gen SIEM runs on LogScale, whose HTTP Event Collector is backward-compatible with Splunk’s, so the engine sends the same HEC event envelope it sends Splunk, dialling out to your Falcon ingest URL on the scheduler tick. The one thing that differs from Splunk is the credential: Falcon authenticates with a bearer token in the Authorization header, not Splunk’s Splunk <token> scheme.

Because the engine makes the outbound call, a Cloudflare Access perimeter on your console hostname never blocks this: there is no inbound request for Access to turn away.

What you need

  • Falcon Next-Gen SIEM enabled, with permission to create a HEC data connection.
  • The ingest URL and bearer token from that connection, and owner access to the downpipes console.

Set it up

  1. In Falcon Next-Gen SIEM, create a HEC data connection (under the Next-Gen SIEM data onboarding area; the exact menu label moves, so follow Falcon’s own HEC connector guide). Give it a name.
  2. Copy the connection’s ingest URL and its token value.
  3. In the downpipes console, open Integrations, choose this vendor’s tile, and set up the SIEM audit push there (owner-only, and it may ask for a fresh step-up sign-in).
  4. This tile fixes Delivery to HTTP endpoint and Format to Splunk HEC, with no picker to set either. Paste the Falcon ingest URL into Endpoint URL.
  5. Leave Auth header name as Authorization, and paste the token as the Auth secret in the form Bearer <token>: the word Bearer, one space, then the token. This is the difference from Splunk, whose HEC wants the Splunk prefix instead.
  6. Leave Enabled ticked to start draining as soon as you save, or clear it to test before any real event leaves. Choose Configure to save. If a second owner must approve this, nothing changes until they do.
  7. Choose Test send. The engine posts one synthetic audit-shaped event and reports Falcon’s response. A test send works whether the destination is enabled or not, and never advances the delivery cursor.
  8. If you cleared Enabled at step 6, choose Enable now. A second owner may need to approve this change too. From the next scheduler tick after the change applies, the engine forwards every audit event above the cursor.

What lands in CrowdStrike

Each event arrives as one HEC event object, newline-concatenated in the request body, the same envelope Splunk’s HEC receives:

{"time":1751681648,"source":"downpipes","sourcetype":"downpipe:audit","event":{"seq":4097,"action":"restore-approve","outcome":"success","actorEmail":"ops@acme.example","...":"..."}}

LogScale ingests the event object’s fields, so you can search on action, outcome, actorEmail and the rest. The sourcetype is downpipe:audit.

Good to know

  • The credential is the only thing that differs from Splunk. Send the Splunk HEC format, but authenticate with Bearer <token> in the Authorization header. The bare token, or Splunk’s Splunk <token> prefix, will not authenticate against Falcon’s HEC.
  • Delivery is at-least-once, not exactly-once. Every event carries a stable seq and hash to dedup on. The feed carries operator identity (member emails, source IPs, roles and approver emails); no backup data and no secret values. For the shared push mechanics and the pull alternative, see forwarding the audit log to your SIEM.
  • The account’s outbound egress allowlist applies to the Falcon host. With an Owner-set list, the engine refuses a save, a test send or a delivery to a host the list does not match. An entry *.suffix matches at any depth on a dotted boundary, never the bare suffix. A refused test send or delivery records the reason egress-not-allowlisted. An unset or empty list allows every host (pushTargetAllowed, engine/src/notify/push-egress.ts). If the engine cannot read the list, a save returns 503 and a delivery stops (fetchPushConfig, engine/src/cron/siem-push-pass.ts).
  • Only the Owner sees the full endpoint in the push view. Every other role that can read the view sees the scheme, host and any port only. The view sets endpointRedacted when it cut anything (redactPushViewQuery, engine/src/admin/router-push.ts).

Last updated .