# CrowdStrike Falcon SIEM connector

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Fsecurity%2Fcrowdstrike-falcon-siem-connector.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Fsecurity%2Fcrowdstrike-falcon-siem-connector.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

Coralogix provides seamless integration with [CrowdStrike Falcon](https://www.crowdstrike.com/falcon-platform/), allowing you to correlate security-related events with your application and infrastructure logs and detect and respond to security incidents more effectively.

While this integration allows you to choose your preferred log shipper, we **strongly recommend** using OpenTelemetry as a best practice. Other available shippers can be found [here](https://coralogix.com/docs/docs/integrations/.md).

Note

This integration has been replaced. Refer to our new [integration document](https://coralogix.com/docs/docs/integrations/security/crowdstrike-falcon/.md).

## **Configuration**[​](#configuration "Direct link to configuration")

The following is an example configuration.

**STEP 1**. [Install](https://www.crowdstrike.com/blog/tech-center/integrate-with-your-siem/) the Crowdstrike Falcon SIEM connector.

**STEP 2**. Configure it to stream CrowdStrike events into a local file. By default the SIEM connector stores its data in /var/log/crowdstrike/falconhoseclient/. Change the default data storage location if necessary.

**STEP 3**. Download OpenTelemetry on the SIEM connector host. Get started [here](https://opentelemetry.io/docs/collector/getting-started/).

## **Example**[​](#example "Direct link to example")

Use the example below as a basis for shipping your logs, which adopt a multiline logs pattern.

Replace the `private_key` with your Coralogix [Send-Your-Data API key](https://coralogix.com/docs/docs/user-guides/account-management/api-keys/send-your-data-api-key/.md) and `domain` with your [Coralogix domain](https://coralogix.com/docs/docs/user-guides/account-management/account-settings/coralogix-domain/.md).

```
receivers:

  filelog:

    start_at: beginning

    include:

      - /var/log/crowdstrike/falconhoseclient/output

    multiline:

      line_start_pattern: "^{"

    operators:

      - type: json_parser

        parse_to: body

exporters:

  coralogix:

    domain: "coralogix.com"

    private_key: "your Send-Your-Data API key"

    application_name: "open-test-app"

    subsystem_name: "CrowdStrike-Falcon"

    timeout: 30s

service:

  pipelines:

    logs:

      receivers: [ filelog ]

      exporters: [ coralogix ]
```