Export alerts and Agentic Triage reports to CrowdStrike Next-Gen SIEM

Integrate Corelight Investigator with CrowdStrike Falcon Next-Gen SIEM (Next-Gen SIEM) to stream network alerts and Agentic Triage reports directly into the SIEM. The integration automatically populates pre-built Corelight dashboards within Next-Gen SIEM, making network data available for analysis alongside your endpoint data.

The process begins in the Next-Gen SIEM UI by generating an API key and URL from the Corelight Investigator Data Connector. You then use these credentials in the Investigator UI to configure the CrowdStrike exporter, which establishes the connection and forwards the data.

  • Alerts: A continuous stream of individual security alerts from your enabled detection rules.

  • Agentic Triage reports: Pre-analyzed, evidence-backed threat assessments produced by Corelight’s Lux AI for your highest-risk entities. Each report includes a confidence verdict, supporting evidence, and recommended next steps.

For details on both export types, see Alert & Agentic Triage Exports.

Prerequisites

Before you begin, ensure you have the following:

  • CrowdStrike: A subscription to CrowdStrike Falcon Next-Gen SIEM. All license tiers, including plans with specific daily data limits (for example, third party data ingest/all ingest levels 10GB), are supported.

  • Corelight: An operational Corelight Investigator instance.

  • Permissions:

    • In CrowdStrike: A user role with rights to create and manage data connectors and view/edit dashboards.

    • In Investigator: Administrator privileges to configure data exporters. Analyst-level users can only view existing configurations.

  • Firewall configuration:

    If your firewall restricts inbound traffic, create a rule to allow HTTPS (port 443) traffic from the Corelight Investigator source IP addresses for your region. These addresses are for alert export only. For sensor log ingest firewall requirements, see Firewall configuration.

    Region

    Source IP (CIDR)

    North America (us-west-2)

    198.29.17.0/29

    Europe (eu-central-1)

    198.29.22.0/29

    Middle East (me-central-1)

    198.29.23.0/29

Important

  • Alert Duplication: Be aware that if you have already configured log export on one or more sensors, exporting alerts from Investigator will duplicate some notice and Suricata alerts.

  • This integration is a cloud-to-cloud configuration. Self-hosted deployments of CrowdStrike Falcon Next-Gen SIEM are not supported at this time.

  • The CrowdStrike Falcon Next-Gen SIEM user interface and configuration steps are subject to change by CrowdStrike. This guide is based on the interface at the time of publication.

Step 1: Configure the data connector in Next-Gen SIEM

Configure the Corelight Investigator Data Connector within the Next-Gen SIEM console to generate the credentials Investigator needs to send data.

  1. In the Falcon menu, go to Data connectors | Data connections to access Next-Gen SIEM.

  2. On the Data connections tab, click Add connection.

  3. On the Data connectors page, click Vendor and search for Corelight. Click Apply.

  4. Click the Corelight Investigator Data Connector in the Connector name list.

  5. Under New connection, click Configure.

  6. On the Add new connector page, in the Connector details section, enter a descriptive name for the connector and an optional description.

  7. Under Parser details, the default parser corelight-investigator is automatically selected.

    1. Do not select the Enable parser selection box. Leave this unchecked. Selecting a parser other than the default may cause ingestion errors.

  8. Check the box to acknowledge Terms and Conditions.

  9. Click Create connection. The Connector setup in progress dialog displays, indicating an API key is being generated. Click Close.

  10. On the next screen, a note displays at the top of the page indicating the connector is ready to receive data. Click the Generate API key button.

  11. The Connection setup dialog displays your credentials. Copy both the API key (Token) and the API URL. Store them securely, as the API key only displays once.

  12. Once you have securely saved the credentials, click Close. The data connector is now ready to receive data.

Step 2: Configure the exporter in Investigator

Use the credentials from Next-Gen SIEM to set up the exporter in Investigator.

  1. In the Investigator UI, go to System Settings | Integrations.

  2. On the Integrations page, select the Exports tab.

  3. Click the CrowdStrike Falcon LogScale tile to open the CrowdStrike Exporter configuration panel.

  4. Toggle the Enabled switch to the On position.

  5. Under Export Type, select one or both of the following:

    • Alerts. Exports all alerts from your enabled detection rules. This is the default.

    • Agentic Triage. Exports Agentic Triage reports. Requires the GPT (Private data) integration to be enabled.

    You can configure each exporter to send alerts only, Agentic Triage reports only, or both. When you select both, alerts and Agentic Triage reports are sent to the same destination. The Export Type column on the exports list shows which types are active for each exporter.

    Note

    The Export Type selector only appears when the GPT (Private data) integration is enabled for your tenant. If GPT (Private data) is not enabled, the exporter sends alerts only, which is the existing default behavior.

  6. Provide a unique Name for the exporter (for example, Next-Gen-SIEM-Prod).

  7. For the URL field, paste the URL you copied from Next-Gen SIEM. The /services/collector path is automatically added to the URL.

  8. For the Token field, paste the API key you copied from Next-Gen SIEM.

  9. For the Index field, enter a simple name (for example, corelight). This is a required field used for exporter metadata; the token you provided controls the actual data destination in CrowdStrike.

  10. Ensure Verify SSL is enabled (recommended).

  11. If you selected Agentic Triage, configure the Agentic Triage Report Configurations section. Under Select Lux verdicts to send, select one or more verdicts to include in the export:

    • Needs human review. High-risk entities that require immediate investigation.

    • Suspicious. Entities with activity that warrants investigation.

    • Likely benign. Entities where the AI found evidence supporting a non-malicious explanation.

    Note

    An exported Agentic Triage report may appear more than once in your SIEM. To deduplicate, use the report_id field as a unique identifier when ingesting reports.

  12. Click Save.

Step 3: Verify the connection

After configuring the exporter, verify that data is flowing correctly from Investigator to Next-Gen SIEM.

  1. In the Next-Gen SIEM console, navigate back to the Data connectors page.

  2. Locate the Corelight Investigator Data Connector on the Data connections list.

  3. Check that the Last Ingested timestamp has updated to reflect the most recent alert.

If the alert timestamp matches your recent activity, the integration is working correctly.

Note

It may take 5–10 minutes for data to initially appear in the console after the first alert is triggered.

Step 4: Access Corelight dashboards in Next-Gen SIEM

Once data is flowing from Investigator into Next-Gen SIEM, you can access the Corelight pre-built dashboards for visualization and analysis.

Note

It may take 5-10 minutes for new alert data to appear in the dashboards after the initial setup.

  1. From the Next-Gen SIEM menu, navigate to Next-Gen SIEM | Log Management | Dashboards.

  2. In the Dashboard search bar, type Corelight to filter for all related dashboards.

  3. Select any Corelight dashboard to begin your analysis.

For more information, see Explore data through Dashboards or refer to the CrowdStrike documentation on exploring data.