This article describes how to integrate Authentication Manager (AM) with CrowdStrike Falcon Next-Gen SIEM.

Configure CrowdStrike Falcon Next-Gen

Configure and Activate the HEC/HTTP Data Connector

Perform these steps to configure and activate the HEC/HTTP Data Connector.

Procedure

1. In the Falcon console, go to Data connectors > Data connectors > Data connections.
2. Click + Add connection.
3. On the Data Connectors page, filter by connector name to find and select the HEC / HTTP Event Connector.
4. On the New connection page, review the connector metadata, version, and description.
5. Click Configure.

Note: For connectors that are in a pre-production state, a warning appears. Click Accept to continue configuration.

6. On the Add new connector page, provide the following details:
   1. Data source: Name for the data source to display on the connection's Details page.
   2. Connector name: Name to identify the connector. This name is displayed in the Connections list.
   3. (Optional) Description: Description of the connector.
   4. Parsers: A parser to use for this connection. In the Parsers drop-down list, select rsa-authenticationmanager.
7. Select the Terms and Conditions check box and click Save.
   A banner message appears in the Falcon console when your API key and API URL are ready to be generated.
8. To generate the API key, go to Data connectors > Data connectors > Data connections, click the Open menu for the data connector, and click Generate API key.
9. Copy and safely store the API key and API URL to use during connector configuration.

Important: Save your API key, which is displayed only once during connector setup.

Configure Your Data Shipper

Perform these steps to configure your data chipper.

You can use any data shipper that supports the HEC API to complete this step. We recommend using the Falcon LogScale Collector.

Procedure

1. In the Falcon console, go to Next-Gen SIEM > Log management > Data onboarding and click the Fleet Management tab.
2. On the Fleet overview tab, click Get LogScale Collector.

We recommend following the Full install instructions.

Note: Full install allows for configuring and updating the Falcon LogScale Collector within the Falcon user interface and a robust fleet management system with metrics. Custom install requires local updates through a systems package manager.

3. 1. Select your operating system: macOS/Linux or Windows.
   2. Select an enrollment token: An enrollment token associates instances of the Falcon Log Collector with the config file. A Default Collector install token is provided and selected. No additional action is required.
   3. Run the provided curl or PowerShell command in your terminal to download and install the Falcon LogScale Collector.
4. Close the Get Falcon LogScale Collector window. On the Fleet overview, confirm if your Falcon LogSale Collector is now available.
5. On the Config overview tab, click + New config.
6. Enter a name for the configuration and select Empty config.
7. Click Create new.
   The Draft editor appears.
8. Edit the config based on your environment.

The following is an example of a basic config when using the Falcon LogScale Collector with a data connector.

Important: This example includes the default listening port of the Falcon LogScale Collector. If you use this port, make sure other services are not listening on port 514. If you add additional sources, each source must have a distinct port. Before saving your config, check your local firewall to confirm that the configured port is not blocked and your traffic allowlist includes the Falcon LogScale Collector.

# Example config using default listening port 514

sources:

syslog_udp_514:

type: syslog

mode: udp

port: 514 15. sink: ngsiem

sinks:

ngsiem:

type: hec

proxy: none

token: <API_key_generated_during_data_connector_setup>

url: <API_URL_generated_during_data_connector_setup>

9. On the Fleet overview tab, assign the config you created to the instance of the Falcon LogScale Collector you installed.

Tip: If you need to associate a config file with multiple instances of the Falcon LogScale Collector, you can create Groups in Fleet Management.

10. In the row of the Falcon LogScale Collector you installed, click the Open menu and select Extend config.
    The Extend configuration window appears.
11. Select the config you created.
12. Click Save.

Configure AM

Perform these steps to configure AM.

Procedure

1. Log in to the AM Security Console.
2. Go to Setup > System Settings.
3. Click Logging.
4. Select an instance.
5. Click Next.
6. Configure the Log Levels:
   1. Trace Log: Select Information.
   2. Administrative Audit Log: Select Success.
   3. Runtime Audit Log: Select Success.
   4. System Log: Select Success.
7. Configure the Log Data Destinations:
   1. For Administrative Audit Log Data, Runtime Audit Log Data, Trace Log, and System Log Data: Select Save to internal database and remote syslog at the following hostname or IP address.
   2. Enter the IP address of the Falcon LogScale Collector for each destination.

Note: If you update the IP address or hostname for a remote syslog server, you must restart AM services to apply the change.

8. (Optional) To apply these settings to replica instances, select Apply the above settings to the replica instance(s) upon save.

9. Click Save.

10. After saving the configuration, restart the AM services:

    1. Log in to the appliance operating system as rsaadmin.

    2. Navigate to the server directory:

cd /opt/rsa/am/server

1. 3. Restart all services:

./rsaserv restart all

Verify Data Ingestion

Perform these steps to verify that data ingestion is successful.

Procedure

Important: Before verifying successful data ingestion, wait for at least 15 minutes after the setup to allow initial event data to be generated. Search results are not generated until an applicable event occurs. If an event timestamp is greater than the retention period, the data is not visible in search. If you do not see the raw data after 15 minutes, the product may need more time.

Verify that data is being ingested and appears in Next-Gen SIEM search results:

1. In the Falcon console, go to Data connectors > Data connectors > Data connections.
2. In the Status column, verify that the data connection status is Active.
3. In the Actions column, click the Open menu and select Show events to see all events related to this data connection in Advanced Event Search. Confirm that at least one match is generated.

If you need to manually verify data ingestion, run this query and confirm that at least one match is generated:

#Vendor="rsa" | #event.module="authenticationmanager"