The CrowdStrike HTTP Event Collector(HEC) allows you to easily stream logs from Kolide directly into your CrowdStrike instance in a format suitable for ingestion.

CrowdStrike Prerequisites

Before you get started, you will need to enable HEC and generate an HEC token.

1. Login to CrowdStrike and navigate to Data Sources

1. In the list of data sources, click “1Password Device Trust for CrowdStrike Falcon Next-Gen SIEM”. You may need to search for it in the top right corner.

1. On the “Add new connector” screen:

1. Provide a Connector name.

2. Optionally, provide a Description.

3. Accept the terms and conditions.

4. Click Save.

To view existing connectors you can navigate to My Connectors.

The steps to enable HEC may vary based on your CrowdStrike instance. To enable HEC, read CrowdStrike’s documentation.

How to Configure Kolide

From the Log Destinations list view:

1. Click Add New Destination
2. Click CrowdStrike HEC

1. In the configuration modal that appears:

1. Provide a Display Name for your HEC. This will help you differentiate it from your other configured log destinations.

2. Provide the URL endpoint for your CrowdStrike HEC.

3. Provide the secret token for your CrowdStrike HEC.

4. Select the log types this Log Destination should receive.

5. Click Save

Once you click Save, Kolide will send a test event to your CrowdStrike instance. The event should look like this:

{
  "key":"crowdstrike_kolide_testing",
  "ts":1723751668,
  "type":"log_destination_test"
}

If your CrowdStrike instance does not respond successfully, you will see an error message informing you of the failure.