CrowdStrike Falcon Next-Gen SIEM

Commvault's integration with CrowdStrike Falcon Next-Gen SIEM delivers a powerful combination that enhances threat detection, accelerates response, and strengthens recovery resilience.

The Commvault data connector provides deep visibility into ransomware indicators, sensitive data exposure, vulnerable ESXi configurations, and virtual machine anomalies. By correlating this data with CrowdStrike’s AI-driven threat detection and response capabilities, the data connector enables faster, more accurate alerts and helps prioritize threats to business-critical data and infrastructure.

Before You Begin

• Configure appropriate permissions and access levels for your Commvault and CrowdStrike accounts.

Step 1: Create a Parser in the CrowdStrike Falcon Console

1. Go to the CrowdStrike Falcon Console (for example, https://falcon.us-2.crowdstrike.com/login/) and then log in.

2. Go to Data connectors > Parsers.

3. Click Add new parser.

   The Create new parser dialog box appears.

4. Enter the Parser name.

5. Select a template for the parser.

6. Click Create.

7. Ensure that the Status of the new parser is Active, as shown in the following image:

   

Step 2: Create a Connector in the CrowdStrike Falcon Console

1. Go to the CrowdStrike Falcon Console (for example, https://falcon.us-2.crowdstrike.com/login/) and then log in.

2. Go to Next-Gen SIEM > Data onboarding.

3. Click Add connection.

4. Select HEC/HTTP Event Connector.

5. Click Configure.

6. Enter required connector details such as Data source and Connector name.

7. Select the parser that you created in "Create a Parser in the CrowdStrike Falcon Console", above.

8. Accept the terms and conditions.

9. Click Create connection.

   The Connector setup in progress dialog box appears.

10. Click Close.

11. After the connector setup is complete, click Generate API key.

    The Connection setup dialog box appears, showing the API key and the API URL.

12. Copy the API key and the API URL.

    For example:

    • Sample API key:

    • Sample API URL: https:///services/collector/raw

13. Click Close.

14. Ensure that the Status of the new connector is Active, as shown in the following image:

    

Step 3: Create a Webhook to CrowdStrike in Commvault

1. Go to https://activatetrialcs.eastus.cloudapp.azure.com/commandcenter/.

The login screen appears.

1. Enter your Commvault credentials and then click Login.

2. Go to Manage > System.

3. Click the Webhooks tile.

   The Webhooks page appears.

4. Click Add.

The Add webhook page appears.

1. Enter the Name of the new webhook.

2. For URL, enter the API URL that you copied in Step 12 of "Create a Connector in the CrowdStrike Falcon Console", above. Ensure that you append /raw at the end of the URL.

   For example:

   • https:///services/collector/raw

3. For Headers, enter the API key that you copied in Step 12 of "Create a Connector in the CrowdStrike Falcon Console", above. Ensure that you append the Bearer prefix at the front of the API key.

   For example:

   • Authorization: Bearer

4. Click Add.

5. Ensure that the Status of the new webhook is Online, as shown in the following image:

   

Step 4: Create a SIEM Connector in Commvault

1. Go to https://activatetrialcs.eastus.cloudapp.azure.com/commandcenter/.

   The login screen appears.

2. Enter your Commvault credentials and then click Login.

3. Go to Manage > System.

4. Click the SIEM Connector tile.

   The SIEM Connector page appears.

5. Click Add connector.

   The Add a SIEM Connector wizard appears.

General

1. For Connector name, enter a name for the new SIEM connector.

2. For Connector type, select Webhook.

3. For Streaming data, select Alerts.

4. For Alert type, click Select All and then click OK.

5. Click Next.

Connector Definition

1. For Webhook, select the webhook that you created in "Create a Webhook to CrowdStrike in Commvault", above.

2. Click Submit.

3. Ensure that the connector is Enabled, as shown in the following image:

   

Step 5: Enable Threat Scan and Start Risk Analysis Data Collection in Commvault

Enable Threat Scan (TS) to Run a Scan on a Full Backup on a Server

1. Go to https://activatetrialcs.eastus.cloudapp.azure.com/commandcenter/.

   The login screen appears.

2. Enter your Commvault credentials and then click Login.

3. Go to Monitoring > Threat Indicators.

   The Threat detection page appears, showing a list of servers.

4. For the server you want to enable alerts, click the Action button and then click Threat scan.

The Threat scan dialog box appears.

1. Enter a Start date and End date for a time period in which there was a valid backup performed on the server.

2. Select the Index server.

3. Select the Anomaly types you want the system to scan for.

4. Click Analyze.

Start Risk Analysis Data Collection

1. Go to https://activatetrialcs.eastus.cloudapp.azure.com/commandcenter/.

   The login screen appears.

2. Enter your Commvault credentials and then click Login.

3. Go to Data Insights > Sensitive data governance.

   The Projects page appears.

4. Click a project.

5. On the Data sources tab, for the server you want to start data collection, click the Action button and then click Start data collection.

   The Data collection dialog box appears.

6. For Job type, select Full.

7. Click Start Data Collection.

Step 6: Verify Alerts in CrowdStrike

1. Go to the CrowdStrike Falcon Console (for example, https://falcon.us-2.crowdstrike.com/login/) and then log in.

2. Go to Next-Gen SIEM > Log management > Advanced event search.

3. Select Third Party.

4. Enter a Time interval.

5. Click Run.

   One or more of the following alerts are displayed:

   Feature	Type	Event Codes
   Threat Scan	Malware Detection	69:59, 17:193
   Threat Scan	Encryption detection	69:60
   Threat Scan	Anomaly Detection	14:337, 14:338, 7:349
   Risk Analysis	Sensitive data detection	35:5636

For more information, see Commvault to CrowdStrike Field Mapping.