> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/miscellaneous-integrations/siem-connectors/crowdstrike-siem.md).

# CrowdStrike Falcon Next-Gen SIEM

{% hint style="info" %}
This SIEM connector is currently available by request. [Reach out to support](https://www.aikido.dev/contact) to have it enabled for your workspace.
{% endhint %}

Send your Aikido issues to CrowdStrike Falcon Next-Gen SIEM, so your security findings are searchable alongside the rest of your logs.

This is useful if your team already uses CrowdStrike as a SIEM and wants a single place to correlate Aikido findings with infrastructure, application, and audit signals.

### Requirements

Before connecting, you need:

* An active CrowdStrike Falcon subscription with Next-Gen SIEM access.
* A **Next-Gen SIEM endpoint** URL and **auth token**, generated from a Monad connector set up inside CrowdStrike (see below).

### Connecting CrowdStrike

{% stepper %}
{% step %}

#### Set up the Monad connector in CrowdStrike

1. Log in to your CrowdStrike console, open the main menu, and go to **Next-Gen SIEM > Data onboarding**.
2. Find the **Monad** connector on the Data Sources page and click **Configure**.
3. Fill in the connector details:
   * **Data Source** - select your specific data source type.
   * **Data Type** - select **JSON** (recommended for best compatibility).
   * **Connector name** - a descriptive name (for example, "Aikido").
   * **Description** - optional.
4. Under **Parser details**, select an existing parser or create a new one that matches the data format Aikido sends.
5. Accept the terms and click **Save**.
6. Once the connector finishes initializing, look for the **Generate API key** option in the banner and click it.
7. Copy and securely store both the generated **API key** and the **API URL**, you'll paste these into Aikido next.
   {% endstep %}

{% step %}

#### Connect a SIEM

Go to **Settings > Integrations** in the Aikido app and add a new SIEM integration. In the **Connect a SIEM** dialog, select **CrowdStrike Falcon Next-Gen SIEM** and fill in:

**Settings**

* **Next-Gen SIEM endpoint** - the CrowdStrike Monad connector ingestion URL, in the format `https://<connection-id>.ingest.<your-region>.crowdstrike.com/services/collector`.

**Authentication**

* **Next-Gen SIEM auth token** - the CrowdStrike Monad connector API token you generated.

Click **Test connection** to confirm Aikido can reach CrowdStrike, then **Save changes**.
{% endstep %}

{% step %}

#### Configure which issues sync

On the CrowdStrike integration page, under **Issue input settings**, configure which Aikido issues are synced:

* **Issue status** - for example, sync open issues only, or include resolved and ignored issues too.
* **Minimum severity** - the lowest severity level to sync.
* **Issue type** - limit to specific issue types, or sync all of them.
* **Language** - limit to specific languages, or sync all of them.
* **Sync frequency** - how often Aikido pushes matching issues to CrowdStrike (for example, every hour).

Click **Save Settings**.
{% endstep %}
{% endstepper %}

### Verifying events are arriving

In CrowdStrike's Next-Gen SIEM, search for events from your configured data source. Wait for your configured sync frequency to pass, or trigger a test issue in Aikido, and confirm it shows up.

### Limitations

* Maximum 100 events, or 16 MB, per batch.
* Events older than 7 days may be rejected by CrowdStrike.
* API rate limits apply based on your CrowdStrike subscription.

### Troubleshooting

* **Authentication failures** - confirm the auth token hasn't expired and has the right permissions, and double check the endpoint URL.
* **Connection timeouts** - check network connectivity and any firewall rules between Aikido and CrowdStrike, and validate proxy settings if you use one.
* **Data rejected** - confirm your CrowdStrike parser matches the data format Aikido sends, and that events aren't exceeding the batch or size limits above.

### Managing the integration

From **Settings > Integrations > CrowdStrike Falcon Next-Gen SIEM** in Aikido, you can:

* **Manage Integration** - update the endpoint or auth token.
* **Remove Integration** - disconnect CrowdStrike. This stops all future syncs; it doesn't delete data already sent to CrowdStrike.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.aikido.dev/miscellaneous-integrations/siem-connectors/crowdstrike-siem.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.