CrowdStrike (Falcon LogScale / NG-SIEM)

Forward audit logs to CrowdStrike Falcon LogScale (Humio) or NG-SIEM via the Splunk-HEC-compatible ingest endpoint.

Prerequisites

1. A LogScale repository or NG-SIEM tenant with HEC ingest enabled.
2. An ingest token (HEC token) with permission to write to the target repository.
3. Network egress allowed from your deployment to the ingest URL on port 443.

Configuration fields

Field	Required	Description
Ingest URL	Yes	The Falcon LogScale / NG-SIEM base URL (e.g., https://cloud.community.humio.com). The /services/collector path is appended automatically — do not include it.
Ingest Token	Yes	Your LogScale/NG-SIEM ingest (HEC) token. Sent as a Bearer token.
Anonymous Mode	No	Toggle to send only statistical data (see Anonymous Mode).

How it works

Each audit log is POSTed to <url>/services/collector as a Splunk-HEC-compatible JSON event with sourcetype set to audit_log and source set to audit-logs. The action and org_id are also sent as indexed fields. The API key is passed as a Bearer token in the Authorization header. The request timeout is 5 seconds.

The payload posted to POST <base>/services/collector looks like:

{
  "time": 1690000000.5,
  "sourcetype": "audit_log",
  "source": "audit-logs",
  "fields": { "action": "tool_call", "org_id": "org_123" },
  "event": { "...": "the AuditLog object" }
}

The event object is the audit log record. In non-anonymous mode it includes a user: { id, name, email } object; in anonymous mode the data payload is stripped down to error metadata only.

Normalize with the Willow parser (recommended)

Without a parser, HEC data is still searchable as raw JSON (fields under event.*). To map it into the CrowdStrike Parsing Standard (CPS / ECS 8.11) so it works in NG-SIEM dashboards and correlation rules, install the Willow audit parser.

Download the parser: willow-audit-parser.yaml

Set up the parser in Falcon

1. In the Falcon console, create an HTTP Event Collector (HEC) data connection (Next-Gen SIEM > Data onboarding > HEC). This gives you the ingest URL and API token to paste into Willow (Admin > Settings > Log Settings > Add Provider > CrowdStrike).
2. Create a parser from willow-audit-parser.yaml (Next-Gen SIEM > Parsers > New parser > paste the YAML), then assign it to the HEC connection / ingest token created in step 1.
3. Send a test event from Willow (the Test button on the log provider) and confirm the event lands normalized. The parser ships with tests: cases you can run in-console via the parser editor's test panel.

Field mapping

The parser normalizes Willow audit logs to ECS 8.11 and keeps Willow-specific fields under the willow.* namespace, as required by CPS. Original audit-log fields also remain under the event.* prefix for ad-hoc search.

Willow audit log field	CPS / ECS target	Notes
time (HEC envelope, epoch s)	@timestamp	Falls back to event.created_at
event.id	event.id
event.action	event.action	Drives event.category / event.type
event.org_id	organization.id
event.user.id/name/email	user.id / user.name / user.email	Absent in anonymous mode
event.data.success / event.data.passed	event.outcome	success / failure / unknown
event.mcp_client	willow.mcp_client
event.toolkit_slug	willow.toolkit_slug
event.transport	willow.transport	stdio / http
event.data.mcp	willow.tool.mcp	tool_call
event.data.tool	willow.tool.name	tool_call
event.tool_call_success	willow.tool.success
event.performance_total_time	willow.performance.total_ms
event.token_count_request/response	willow.token_count.*
event.arguments_length / event.response_length	willow.arguments_length / willow.response_length
event.data.integration_slug/auth_type/step/error_code	willow.connector.*	connector_auth
event.guard_check_scope, event.data.entity_*, event.data.passed	willow.guard_check.*	guard_check
event.add_skill_name / event.add_skill_agent_type	willow.skill.*	add_skill

The event.action field drives the ECS event.category and event.type:

action	event.category	event.type
tool_call	api	info
init	session	start
connect	authentication	start
connector_auth	authentication	access
add_skill	configuration	installation
add_command	configuration	creation
webhook	web	info
guard_check	intrusion_detection	info

Tips

• LogScale's HEC endpoint is Splunk-compatible, so the token must be a LogScale ingest token (not a search/API token).
• Use a dedicated repository to isolate audit logs and apply retention policies.
• Verify connectivity with a curl to <url>/services/collector before configuring.

Troubleshooting

• Verify the ingest token is a LogScale/NG-SIEM ingest token, not a search or API token.
• Confirm the Ingest URL omits the /services/collector path, which Willow appends for you.
• If events arrive but are not normalized, confirm the parser is assigned to the HEC connection / ingest token.

If no logs appear at all, confirm the provider credentials and URL are correct and that outbound egress is allowed. See Log Settings for shared guidance.

Related

• Log Settings: retention, content options, and Anonymous Mode
• Logs: view and search the logs themselves