CrowdStrike Falcon Data Replicator

Use Crowdstrike Falcom Data Replicator data with Cortex XSIAM.

You can configure collecting raw EDR event data from CrowdStrike Falcon Data Replicator (FDR) using a standard data source, content pack integration (onboarded prior to July 26, 2026), or connector (onboarded after July 26, 2026):

Collection Method	Description
Standard collector overview	Forward raw EDR event data from CrowdStrike Falcon Data Replicator (FDR), streamed to Amazon S3, and Cortex XSIAM using the CrowdStrike Falcon Data Replicator data source. In addition to all standard SIEM capabilities, this integration unlocks some advanced Cortex XSIAM features, enabling comprehensive analysis of data from all sources, enhanced detection and response, and deeper visibility into CrowdStrike FDR data.
Link to standard collector instructions	Ingest raw EDR events from CrowdStrike Falcon Data Replicator
Links to content pack integration details (onboarded prior to July 26, 2026)	The CrowdStrike Falcon content pack contains automations to load the CrowdStrike process file content and transform the data . It also includes the following integration: CrowdStrike Falcon: Use this integration to perform endpoint security operations such as fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment. It includes commands for immediate actions, including searching devices, resolving detections, running remote commands on hosts, and managing custom Indicators of Compromise (IOCs).
Link to connector (onboarded after July 26, 2026)	CrowdStrike