CrowdStrike Next-Gen SIEM Destination

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.
이용 가능:

Logs

Use Observability Pipelines’ CrowdStrike Next-Gen SIEM destination to send logs to CrowdStrike Next-Gen SIEM.

Setup

Set up the CrowdStrike NG-SIEM destination and its environment variables when you set up a pipeline. The information below is configured in the pipelines UI.

Set up the destination

To use the CrowdStrike NG-SIEM destination, you need to set up a CrowdStrike data connector using the HEC/HTTP Event Connector. See Step 1: Set up the HEC/HTTP event data connector for instructions. When you set up the data connector, you are given a HEC API key and URL, which you use when you configure the Observability Pipelines Worker later on.

Only enter the identifiers for the CrowdStrike NG-SIEM endpoint URL, token, and if applicable, the TLS pass key. Do not enter the actual values.
  1. Enter the identifier for your CrowdStrike NG-SIEM endpoint URL. If you leave it blank, the default is used.
  2. Enter the identifier for your CrowdStrike NG-SIEM token. If you leave it blank, the default is used.
  3. Select JSON or Raw encoding in the dropdown menu.

Optional settings

Enable compressions
  1. Toggle the switch to Enable compressions.
  2. Select an algorithm (gzip or zlib) in the dropdown menu.
Enable TLS

Toggle the switch to Enable TLS. If you enable TLS, the following certificate and key files are required. Note: All file paths are made relative to the configuration data directory, which is /var/lib/observability-pipelines-worker/config/ by default. See Advanced Worker Configurations for more information. The file must be owned by the observability-pipelines-worker group and observability-pipelines-worker user, or at least readable by the group or user.

  • Enter the identifier for your CrowdStrike NG-SIEM key pass. If you leave it blank, the default is used.
  • Server Certificate Path: The path to the certificate file that has been signed by your Certificate Authority (CA) root file in DER or PEM (X.509).
  • CA Certificate Path: The path to the certificate file that is your Certificate Authority (CA) root file in DER or PEM (X.509).
  • Private Key Path: The path to the .key private key file that belongs to your Server Certificate Path in DER or PEM (PKCS#8) format.
Buffering options

Toggle the switch to enable Buffering Options. Enable a configurable buffer on your destination to ensure intermittent latency or an outage at the destination doesn’t create immediate backpressure, and allow events to continue to be ingested from your source. Disk buffers can also increase pipeline durability by writing logs to disk, ensuring buffered logs persist through a Worker restart. See Configurable buffers for destinations for more information.

  • If left unconfigured, your destination uses a memory buffer with a capacity of 500 events.
  • To configure a buffer on your destination:
    1. Select the buffer type you want to set (Memory or Disk).
    2. Enter the buffer size and select the unit.
      1. Maximum memory buffer size is 128 GB.
      2. Maximum disk buffer size is 500 GB.

Set secrets

These are the defaults used for secret identifiers and environment variables.

Note: If you enter identifiers for your secrets and then choose to use environment variables, the environment variable is the identifier entered and prepended with DD_OP. For example, if you entered PASSWORD_1 for a password identifier, the environment variable for that password is DD_OP_PASSWORD_1.

    • CrowdStrike NG-SIEM endpoint URL identifier:
      • In your secrets manager, do not include the suffix /services/collector in the URL. The URL must follow this format: https://<your_instance_id>.ingest.us-1.crowdstrike.com.
      • The default identifier is DESTINATION_CROWDSTRIKE_NEXT_GEN_SIEM_ENDPOINT_URL.
    • CrowdStrike NG-SIEM token identifier:
      • The default identifier is DESTINATION_CROWDSTRIKE_NEXT_GEN_SIEM_TOKEN.
    • CrowdStrike NG-SIEM TLS passphrase identifier (when TLS is enabled):
      • The default identifier is DESTINATION_CROWDSTRIKE_NEXT_GEN_SIEM_KEY_PASS.
    • CrowdStrike HEC ingestion URL:
      • Note: Do not include the suffix /services/collector in the URL. The URL must follow this format: https://<your_instance_id>.ingest.us-1.crowdstrike.com.
      • The default environment variable is DD_OP_DESTINATION_CROWDSTRIKE_NEXT_GEN_SIEM_ENDPOINT_URL.
    • CrowdStrike HEC API token:
      • The default environment variable is DD_OP_DESTINATION_CROWDSTRIKE_NEXT_GEN_SIEM_TOKEN.
    • CrowdStrike Next-Gen SIEM HEC TLS passphrase:
      • The default environment variable is DD_OP_DESTINATION_CROWDSTRIKE_NEXT_GEN_SIEM_KEY_PASS.

    How the destination works

    Event batching

    A batch of events is flushed when one of these parameters is met. See event batching for more information.

    Max EventsMax BytesTimeout (seconds)
    None1,000,0001