---
title: CrowdStrike Falcon SIEM connector
description: "Coralogix provides seamless integration with\_CrowdStrike Falcon, allowing you\_to correlate security-related events with your application and infrastructure logs and detect and respond to security incidents more effectively."
url: https://coralogix.com/docs/integrations/security/crowdstrike-falcon-siem-connector/
product: ingress
feature: CrowdStrike Ingress
feature_id: logs.crowdstrike-ingress
feature_identifier: ingress/logs.crowdstrike-ingress
last_updated: '2026-10-27'
---

# CrowdStrike Falcon SIEM connector

Coralogix provides seamless integration with [CrowdStrike Falcon](https://www.crowdstrike.com/falcon-platform/), allowing you to correlate security-related events with your application and infrastructure logs and detect and respond to security incidents more effectively.

While this integration allows you to choose your preferred log shipper, we **strongly recommend** using OpenTelemetry as a best practice. Other available shippers can be found [here](https://coralogix.com/docs/integrations.md).

Note

This integration has been replaced. Refer to our new [integration document](https://coralogix.com/docs/integrations/security/crowdstrike-falcon.md).

## **Configuration**

The following is an example configuration.

**STEP 1**. [Install](https://www.crowdstrike.com/blog/tech-center/integrate-with-your-siem/) the Crowdstrike Falcon SIEM connector.

**STEP 2**. Configure it to stream CrowdStrike events into a local file. By default the SIEM connector stores its data in /var/log/crowdstrike/falconhoseclient/. Change the default data storage location if necessary.

**STEP 3**. Download OpenTelemetry on the SIEM connector host. Get started [here](https://opentelemetry.io/docs/collector/getting-started/).

## **Example**

Use the example below as a basis for shipping your logs, which adopt a multiline logs pattern.

Replace the `private_key` with your Coralogix [Send-Your-Data API key](https://coralogix.com/docs/user-guides/account-management/api-keys/send-your-data-api-key.md) and `domain` with your [Coralogix domain](https://coralogix.com/docs/user-guides/account-management/account-settings/coralogix-domain.md).

```
receivers:

  filelog:

    start_at: beginning

    include:

      - /var/log/crowdstrike/falconhoseclient/output

    multiline:

      line_start_pattern: "^{"

    operators:

      - type: json_parser

        parse_to: body

exporters:

  coralogix:

    domain: "eu2.coralogix.com"

    private_key: "your Send-Your-Data API key"

    application_name: "open-test-app"

    subsystem_name: "CrowdStrike-Falcon"

    application_name_attributes:

      - "cx.application.name"

    subsystem_name_attributes:

      - "cx.subsystem.name"

    timeout: 30s

service:

  pipelines:

    logs:

      receivers: [ filelog ]

      exporters: [ coralogix ]
```