CrowdStrike Adds Third-Party IOC Management to Falcon Next-Gen SIEM
Summary
CrowdStrike says Falcon Next-Gen SIEM’s new feature lets teams ingest, manage and correlate third-party indicators with security telemetry for detection and investigation workflows.
Key points
- Third-Party IOC Management supports indicators including IP addresses, domains, URLs and file hashes.
- Indicators can be ingested through STIX/TAXII, APIs and direct uploads, with duplicate consolidation across sources.
- Teams can use automatically updated indicator lists in correlation rules and threat-hunting searches.
- Expiration settings and lifecycle management are intended to limit noise from outdated indicators.
- A vendor-described example uses financial-sector phishing indicators to search telemetry and build correlation rules for potentially related activity.
Article Details
- Event Type
- CrowdStrike announced Third-Party IOC Management, a feature in Falcon Next-Gen SIEM for incorporating external and proprietary threat intelligence into detection and investigation workflows.
- Impact
- CrowdStrike says the feature can centralize IOC ingestion and lifecycle management, reduce manual maintenance and noise from stale indicators, and help security teams use intelligence in correlation rules and threat hunting. These are vendor-described capabilities; the article does not report a specific security incident or measured outcome.
Vendors
Products
CrowdStrike Falcon Next-Gen SIEMmoving indicators between disconnected tools, security teams can manage their intelligence within Falcon Next-Gen SIEM, reducing operational complexity and accelerating the path from threat intelligence to actionableThird-Party IOC ManagementCrowdStrike Falcon® Next-Gen SIEM brings threat intelligence and security telemetry together in Third-Party IOC Management, a new feature that enables organizations to incorporate their own intelligence directly into