CrowdStrike Setup Guide¶

Stream NodeZero findings into CrowdStrike Falcon Next-Gen SIEM as security events, so that your SOC (Security Operations Center) can search, dashboard, correlate, and alert on proven exploitability alongside everything else Falcon already sees.

This article covers the setup end-to-end. Here's a preview of where you'll be working on the NodeZero Portal side:

Settings > Integrations > Add Integration > CrowdStrike Falcon Next-Gen SIEM

Contents¶

• What This Integration Does
• Before You Start
• How the Two Sides Fit Together

The Walkthrough

• Part A – Create the Connection in CrowdStrike
• Part B – Generate the API Key
• Part C – Connect the Instance in NodeZero
• Part D – Create the Workflow
• Part E – Verify End-to-End

Reference

• Datasets: What Gets Sent
• Operating the Integration
• Troubleshooting
• Frequently Asked Questions
• Appendix A – Event Field Reference
• Appendix B – Getting Started in NG-SIEM Search

What This Integration Does¶

NodeZero pushes findings into Falcon Next-Gen SIEM over CrowdStrike's HTTP Event Collector (HEC) ingest endpoint. On the Falcon side they arrive as events on a data connection, parsed by a Horizon3-authored parser, and are then available to NG-SIEM search, dashboards, correlation rules, and Charlotte AI like any other event source.

Direction: one-way, NodeZero > CrowdStrike. Nothing is read back out of Falcon. Transport: HTTPS push to a per-connection ingest URL. Trigger: automatic. NodeZero dispatches as new data arrives.

Before You Start¶

Confirm Falcon and NodeZero access, matching regions, and the two values you will copy from CrowdStrike into NodeZero.

In CrowdStrike¶

• A Falcon subscription that includes Next-Gen SIEM.
• Permission to create data connections: a role that can reach Next-Gen SIEM > Data onboarding > Data connections and use Add connection.
• Room in your NG-SIEM ingest allowance. NodeZero events count against your daily ingest volume, and the Data connections page shows your average ingest per day against your limit. Check it before turning on a high-volume dataset.

In NodeZero¶

• Access to Settings > Integrations for the account you want to connect.
• The CrowdStrike connector enabled for your account. If the CrowdStrike card isn't in the Add Integration picker, contact your Horizon3 representative.

A Note on Regions¶

CrowdStrike generates the API URL, and it already carries the region of the Falcon tenant you created the connection in. There is no region to choose in NodeZero.

Connect like-for-like regions. An EU NodeZero Portal should send to an EU Falcon cloud, a US NodeZero Portal to a US cloud. Nothing stops you crossing regions, so if your organization has data-residency obligations, confirm that you created the Falcon connection in the matching tenant before pasting its URL into NodeZero.

Two Values You Will Carry Between the Systems¶

The setup produces two strings in CrowdStrike and consumes them in NodeZero:

How the Two Sides Fit Together¶

  CROWDSTRIKE                                    NODEZERO
  ───────────                                    ────────
  Data connection            ──  API URL  ──▶    Instance  ▸  Instance URL
  (NodeZero 1)               ──  API key  ──▶    (Develop - US)  ▸  HEC token
        ▲                                              │
        │                                              ▼
        └────────── events ──────────────────  Workflow (Pentest Data > Develop - US)

One CrowdStrike data connection pairs with one NodeZero instance. Two Falcon tenants, or a dev tenant alongside production, means two connections and two instances.

Start in CrowdStrike. The values NodeZero needs do not exist until the CrowdStrike connection has been created.

Part A – Create the Connection in CrowdStrike¶

Create the Falcon data connection, including the parser and host-enrichment settings NodeZero will push to.

Open the Data Connector Catalog¶

1. In the Falcon console, go to Next-Gen SIEM > Data onboarding > Data connections.
2. Select Add connection.

You land on Data connectors, a catalog of several hundred connectors.

Find the NodeZero Connector¶

In Filter by connector name, type nodezero.

Select Horizon3 NodeZero Pentests Data Connector. Confirm that the row shows:

The Data connectors catalog, before filtering to find the NodeZero connector

Fill in New Connection Details¶

The connector name, vendor, and connector author are fixed. You set the rest:

Parsing and Enrichment¶

Leave these parser and enrichment controls at the defaults unless instructed otherwise:

Select the affirmation that data shared with CrowdStrike is shared in accordance with the Terms and Conditions, then select Create connection.

New connection details

The Connection Is Created and Pending¶

Falcon opens the connection's detail page:

Pending is correct at this stage. The connection exists and is ready but has never received data. It stays Pending until the first event arrives.

A new connection, still pending

Part B – Generate the API Key¶

A banner sits at the top of the connection page:

This connector is ready to receive data. To begin sending data, select the Generate API key button and enter it into Horizon3 or an appropriate service.

1. Select Generate API key.
2. The Connection setup dialog appears with three values:
3. CID name – your Falcon CID (customer ID) tenant name.
4. API key – the secret.
5. API URL – the ingest endpoint.

Each of the latter two has a copy icon.

The API Key Is Shown Once¶

This API key will only be shown once.

Copy both the API key and the API URL now, into your password manager or straight into the NodeZero form in another tab. Closing this dialog without the key means generating a new one, which invalidates the old key and requires updating NodeZero.

1. Copy the API key and the API URL.
2. Select Close.

The API key, shown only once

Sanity-Check the API URL¶

Before you leave CrowdStrike, confirm that the URL looks like this:

https://8eace6bd8b3e47e2928feb624e7c8327.ingest.us-2.crowdstrike.com/services/collector
        └──────── connection ID ────────┘        └─ region ─┘            └─ required path ─┘

Three things to check:

• It ends in /services/collector. NodeZero validates this and rejects a URL without it.
• The region matches your Falcon cloud, such as us-1, us-2, or eu-1. CrowdStrike generates it correctly; the risk is pasting a URL kept from another tenant.
• The connection ID matches the Connection ID on the connection detail page, confirming that you copied the URL for the connection you just made.

Part C – Connect the Instance in NodeZero¶

Add the CrowdStrike connector in NodeZero and verify the instance with the API URL and key.

Start the Wizard¶

1. In NodeZero, go to Settings > Integrations.
2. Confirm that the account switcher in the top right shows the right account.
3. On the Connected Integrations tab, select Add Integration.

Choose the Connector¶

In Choose a connector, select the CrowdStrike card. Its chips show the datasets this connector accepts: Pentest Data and Tripwires.

Select Next.

Selecting the CrowdStrike connector

Enter the Instance Details¶

Three fields are required here. The Summary panel on the right fills in as you type, so you can confirm the endpoint before submitting.

Common paste errors, all of which cause the same generic failure:

• The URL is missing the trailing /services/collector.
• Leading or trailing whitespace on the token, picked up from a copy.
• A truncated token, from a partial selection rather than the copy icon.
• The URL from one connection paired with the API key from another.

Select Verify Authentication.

Instance details filled in for a CrowdStrike connector

Verification Checks¶

NodeZero runs two checks at this point:

1. Endpoint format. The URL is well-formed and carries the required collector path.
2. Authentication. The endpoint accepts the token.

No event is sent to CrowdStrike at this stage. Passing this step puts nothing in your SIEM (Security Information and Event Management) and leaves the connection at Pending. The on-demand check available later through Verify Now ingests a single synthetic test event; see What the Test Event Looks Like.

Connected and Verified¶

On success:

✓ Connected and verified.

Develop - US won't receive anything until a workflow names it as a destination.

The Summary panel shows Connector, Instance Label, Instance URL, Authentication Passed and Health Verified, and two toasts confirm that the instance is connected and healthy.

The credential works, but no data flows yet. Creating the workflow in Part D is what starts it.

Success: a connected and verified integration

Select New Workflow to continue. (Add Workflow Later finishes here and leaves the instance with No workflows on the Connected Integrations tab.)

Part D – Create the Workflow¶

The workflow is the rule that sends data.

Creating a Workflow

Expand What gets dispatched to CrowdStrike? for a description of the selected dataset. For Pentest Data:

Send pentest findings to CrowdStrike NG-SIEM as security events after each pentest completes. Findings and results from NodeZero pentest operations.

Select Save Workflow. You'll see Workflow saved and activated, and the workflow appears under the CrowdStrike card as Pentest Data > Develop - US, Status Active, Sync Automatic, Last Dispatch –.

Confirmation that the Workflow is saved

Sending Both Datasets¶

A workflow carries exactly one dataset. Sending both Pentest Data and Tripwires to the same Falcon tenant takes two workflows: use ⋮ > Duplicate on the first, then change the dataset on the copy.

Sending to Two Falcon Tenants¶

The same pattern one level up. A second CrowdStrike connection, a second NodeZero instance, and a duplicated workflow pointed at the new destination.

Part E – Verify End-to-End¶

Verification passed and the workflow is Active, but nothing has been sent yet: Automatic dispatch waits for qualifying data.

Produce Some Data¶

Run an assessment from Pentests > Run Assessment, or wait for a scheduled one. Pentest Data dispatches after a pentest completes. Tripwires dispatch when a tripwire fires.

Check the NodeZero Side¶

Settings > Integrations > Activity Log. You want a row with:

• Connector: CrowdStrike Falcon Next-Gen SIEM.
• Dataset: Pentest Data.
• Destination: your instance label.
• Records: a non-zero count.
• Status: Success.

Select View to open the dispatch's own page, which carries the summary, the Delivery destination, and a Dispatch Log table (Created / Type / Message) breaking down what happened in that run. That page has its own URL, so you can paste it into a ticket.

On Connected Integrations, the instance's Last Dispatch should now show a timestamp with a green Success in place of the –.

Check the CrowdStrike Side¶

Back in Next-Gen SIEM > Data onboarding > Data connections, find your connection in the Connections table. Two things should have changed:

Data connections overview

On the connection's detail page, Last ingested now carries a timestamp, and Execution history shows entries.

Understanding the CrowdStrike Connection Statuses¶

Falcon shows one of these statuses on the connection:

Connection statuses, with ingest counts

Search for the Events¶

In NG-SIEM search, query the connection you just created, and confirm that the events are parsed: named fields with values in them rather than raw text. Unparsed events point at the parser selection; see Troubleshooting.

Datasets: What Gets Sent¶

This connector can send the following datasets:

What This Gives Your SOC¶

The distinguishing property of this data is not that it is another vulnerability feed. It is that every finding carries proof – NodeZero reached it, exploited it, and recorded what that achieved. In Falcon that supports questions a scanner feed cannot answer:

• Which exploitable hosts have no Falcon sensor on them?
• Which proven-exploitable weaknesses sit on hosts that are also generating detections?
• Did a shipped fix close the path, according to re-verification?

Scope and Filtering¶

The workflow carries no user-configurable filters or transforms. Each dataset has a defined scope, and dispatches are incremental: NodeZero sends what is new rather than resending the whole history. Narrow what reaches your analysts in Falcon, with search, dashboards, and correlation rules.

Volume Planning¶

NodeZero volume arrives in bursts, and tracks pentest cadence and estate size rather than a steady events-per-second rate. Before enabling this on a tenant near its ingest ceiling:

• Check Avg ingest per day against your limit on the Data connections page.
• Turn on one dataset first, run one pentest, and read the resulting Ingest (24h) figure.
• Scale that against your assessment cadence.

Operating the Integration¶

Rotate the ingest key, pause traffic, check health on demand, and retry failed dispatches without losing history.

Rotating the CrowdStrike API Key¶

When the key is rotated or revoked on the CrowdStrike side:

1. In CrowdStrike, open the connection and Generate API key. Copy the new key; it is shown once, as before.
2. In NodeZero, on the CrowdStrike instance row: ⋮ > Edit Instance. Paste the new key into the HEC token field and save.

Edit Instance is where secrets are replaced; there is no separate rotate action. The stored token is never shown back to you, and the field reads Leave blank to keep the stored credential: leave it empty to change only the label or endpoint, or type a value to replace the secret.

Regenerating a key does not change the API URL.

Do not delete and recreate the NodeZero instance. Deleting removes its workflows and their dispatch history permanently. Editing in place preserves the instance, its label, and every workflow.

Saving the edit re-verifies the instance. A wrong key sends it straight to Action needed with the reason printed in the row. Verify Now stays available in the row menu for a full health check.

Pausing the Flow¶

To stop sending during a Falcon maintenance window, an ingest-budget squeeze, or a noisy period, deactivate in NodeZero. Either select the workflow rows and use Take Action > Deactivate, or deactivate the whole instance (⋮ > Deactivate) to pause every workflow that targets it at once. Both are reversible and preserve history.

Deleting the CrowdStrike connection invalidates its API URL and key permanently, which means rebuilding both sides. Deactivate instead.

Checking Health on Demand¶

⋮ > Verify Now on the instance re-runs the connector's checks, including one that ingests a single synthetic test event into your Falcon connection. That event is real ingest: it lands in your tenant, appears in the connection's history and counts toward your volume. Run it before a large scheduled pentest, rather than on a loop.

What the Test Event Looks Like¶

The probe is a single record, marked so that you can recognize and exclude it:

{
  "WeaknessID": "H3-CONNECTION-TEST",
  "Name": "NodeZero -> CrowdStrike NG-SIEM connectivity probe",
  "Severity": "LOW",
  "created_at": "2026-09-18T06:29:25.097176+00:00",
  "Description": "Synthetic event emitted by the NodeZero integration to verify transport."
}

H3-CONNECTION-TEST is the marker. It is a fixed literal that does not vary per tenant, instance, or run, so exclusions can safely key on it.

• Exclude it from dashboards and correlation rules. At LOW severity it will not trigger critical-severity rules, but it does appear in "all NodeZero findings" counts and inflates them by one per verification. Filter it out at the panel or rule level.
• Use it as transport proof. It is the only NodeZero event you can produce on demand, so searching for H3-CONNECTION-TEST after a Verify Now confirms the path without waiting for a pentest.

It carries no finding data: no host, no CVE, no proof.

Retrying a Failed Dispatch¶

From the Activity Log, open the failed dispatch and select Retry. Dispatches carry an idempotency key, so a retry cannot duplicate records already delivered to Falcon. See Integrations for the full retry behavior.

Troubleshooting¶

Work setup failures first, then a nothing-arriving checklist, then other post-setup symptoms.

Setup-Time Failures¶

These failures show up while you are connecting the instance:

Post-Setup: Nothing Arriving¶

Work down this list in order.

Step 3 accounts for most reports of a setup that produced nothing. Automatic dispatch waits for a pentest to complete or a tripwire to fire; it does not poll on a timer.

Post-Setup: Other Symptoms¶

If data is flowing but something still looks wrong:

Frequently Asked Questions¶

Which value goes in which field? CrowdStrike's API URL > NodeZero's Instance URL. CrowdStrike's API key > NodeZero's HEC token. The naming differs because each side uses its own vocabulary for the same HEC pair.

Does NodeZero read anything out of CrowdStrike? No. This is a one-way push. NodeZero never queries Falcon and holds no Falcon API credentials beyond the ingest key.

Does CrowdStrike need any NodeZero credentials? No. The connector is Push type, so NodeZero initiates and nothing needs to be opened inbound.

Do I need the Falcon sensor installed on the hosts NodeZero tests? No. The integration works independently of sensor coverage. Host enrichment joins NodeZero findings to hosts Falcon already knows, and the findings that fail to join are the useful output: proven-exploitable hosts carrying no sensor.

Can I send to more than one Falcon tenant? Yes. One CrowdStrike connection and one NodeZero instance per tenant, plus a workflow per dataset per tenant. Label the instances distinctly, since the label is all that separates them in the destination picker.

Can I filter to only critical findings? Not on the workflow, which carries no user-configurable filters. Filter in Falcon using search, dashboards and correlation rules.

How often does data flow? There is no schedule. Pentest Data dispatches after each pentest completes; Tripwires dispatch when a tripwire fires. Between those, the connection sits Idle.

Will retrying duplicate findings in my SIEM? No. Dispatches carry an idempotency key, so already-delivered records are not sent again.

How much of my ingest allowance will this use? That depends on estate size and pentest cadence. Enable one dataset, run one pentest, and read the resulting Ingest (24h) figure on the connection. That is your per-pentest cost; multiply by your cadence.

Can I test this without polluting production? Yes. Create a second CrowdStrike connection for testing, in a non-production Falcon tenant if you have one, and point a separate NodeZero instance at it. Events sent there stay isolated from your production connection and age out under your retention policy.

What happens if I delete the CrowdStrike connection? Its API URL and key stop working permanently, the NodeZero instance moves to Action needed, and dispatches fail. A replacement Falcon connection gets a new API URL as well as a new key, so you would edit the NodeZero instance with both values. Deactivate the NodeZero instance or its workflows instead if you only need to pause.

Why is my connection still Pending? Pending means it has never received data, either because no dispatch has happened yet or because dispatches are failing on the NodeZero side. Check the Activity Log first, then work the checklist in Troubleshooting.

What does the parser do? It maps NodeZero's fields onto CrowdStrike's field standard. With the correct parser, events are searchable by name and usable in dashboards and correlation rules. With the wrong one they still ingest, and still cost you ingest volume, but arrive unusable. Leave horizon3-nodezero-pentests selected.

Appendix A – Event Field Reference¶

Once ingested and parsed, events are searchable in NG-SIEM by named field. This appendix is for the Falcon-side owner: what the fields are, what they mean, and which NodeZero concept feeds each one.

Constants – The Same on Every NodeZero Event¶

Every NodeZero event carries these constants:

Core Event Fields¶

These fields describe the finding itself:

Vulnerability Fields¶

These fields carry the vulnerability identifier and scores:

Asset, Identity, and Threat Fields¶

These fields identify the affected host, identity, and related threat context:

Severity Banding¶

NodeZero's score is mapped onto CrowdStrike's 1–100 event.severity scale:

Falcon interprets the numeric scale as Informational 1–19, Low 20–39, Medium 40–59, High 60–79, Critical 80–100.

Two consequences:

• Banding runs off NodeZero's effective score, the context-adjusted one rather than the raw CVSS base score. A medium-CVSS weakness on a host that reaches your domain controllers can band higher than a high-CVSS weakness on an isolated host.
• event.severity is the single prioritization surface. event.risk_score is left unpopulated, so do not build rules against it.

Appendix B – Getting Started in NG-SIEM Search¶

Starting points for the Falcon-side owner. Adapt the field values to your environment, and confirm each against your own data before building dashboards on it.

Everything NodeZero has sent

#event.module=nodezero

Only proven-exploitable findings

#event.module=nodezero event.action=exploitation-verified

Critical proven findings, newest first

#event.module=nodezero event.action=exploitation-verified event.severity>=80
| sort(@timestamp, order=desc)

Which hosts have the most proven-exploitable findings

#event.module=nodezero event.action=exploitation-verified
| groupBy(host.name, function=count(as=findings))
| sort(findings, order=desc)

Findings with a known CVE

#event.module=nodezero vulnerability.enumeration=CVE
| groupBy([vulnerability.id, vulnerability.severity], function=count(as=instances))
| sort(instances, order=desc)

Where context raised the risk above the CVSS base score

#event.module=nodezero
| test(vulnerability.score.environmental > vulnerability.score.base)
| table([host.name, vulnerability.id, vulnerability.score.base, vulnerability.score.environmental, event.url])

Pivot on an IP, hostname, or identity regardless of which side it appeared on

#event.module=nodezero related.ip=10.0.4.4

Findings mapped to a specific ATT&CK technique

#event.module=nodezero threat.technique.id=T1110

One dataset only

#event.dataset=nodezero.tripwires

Find the connectivity probe, as transport proof after a Verify Now

#event.module=nodezero "H3-CONNECTION-TEST"
| sort(@timestamp, order=desc)

Exclude the probe from a findings panel

#event.module=nodezero
| "H3-CONNECTION-TEST" != *

Building from Here¶

• Deep-link back. Include event.url in any table you build. It takes an analyst straight to the finding in NodeZero with the proof attached.
• Sensor coverage. With host enrichment on, you can join NodeZero findings against the hosts Falcon manages. The non-matches are the useful output: proven-exploitable hosts with no sensor.
• Decide escalation in a correlation rule. Nearly every NodeZero finding is proven, so they arrive as events rather than alerts; promoting all of them would bury your analysts. Promote the slice you care about with a rule keyed on event.severity and event.action.
• Key rules on stable identifiers. Where a rule references NodeZero content, key on IDs rather than display names. Names are editable and can change under you.