pushing logs from crowdstrike endpoint(falcon) to my wazuh SIEM

[Vishak Jaisimha]

Hello,
For the past few days i have been trying to integrate wazuh with crowdstrike EDR.
I was able to setup the SIEM connector and get it to run.But now i have no clue as to how to use the SIEM connector to fetch the falcon logs and push to my Wazuh SIEM. I would be thankful if someone can help me out thanks again. 

[Antonio David Gutiérrez]

Hi,

I am not familiar with Falcon SIEM connector.

Wazuh supports different mechanisms to collect logs: log files, commands, Windows event channels, syslog. See more information in https://documentation.wazuh.com/4.8/user-manual/capabilities/log-data-collection/index.html. So if you want to use the Falcon SIEM connector to send logs to Wazuh, this should generate as output some of the supported log input mechanism of Wazuh.

I found some related topics where the data of Falcon SIEM connector could be emitted in JSON format to files, and then configure Wazuh to collect these logs files. You could need to create custom rules or decoders to trigger Wazuh alerts depending on your use case.

Related topics:
- https://github.com/wazuh/wazuh/issues/14116
- https://groups.google.com/g/wazuh/c/QL-TjXhEM8I
- https://www.reddit.com/r/Wazuh/comments/15gfnas/crowdstrike_intergration/