Falcon Next-Gen SIEM

CrowdStrike Falcon Next-Gen SIEM unifies security data from across your entire environment into a single, searchable platform.

Write custom parsers to ingest and normalize any log source, map fields to the CrowdStrike Parsing Standard, and make third-party data searchable alongside native Falcon telemetry.

Parser Development

Whether you’re integrating a new vendor, building internal tooling, or extending CrowdStrike’s detection capabilities, these resources give you everything you need to build parsers that are consistent, performant, and production-ready.

CrowdStrike Parsing Standard

Data Format Specification

Based on Elastic Common Schema (ECS) with documented deviations and extensions.

Parser Template

Starter Templates

Complete section structure, metadata fields, and downloadable examples.

Module Guidelines

#event.module Reference

Standardized module values by vendor and product for parser development.

Vendor Guidelines

#Vendor Reference

Naming rules and complete vendor-to-legal-name reference.