CrowdStrike SIEM Adds Support for Microsoft Defender and Other Third-Party EDR Tools
Summary
CrowdStrike says Falcon Next-Gen SIEM will support third-party EDR, beginning with Microsoft Defender, without requiring a Falcon sensor. The announcement also covers data pipelines, federated search, indicator management, and query translation.
Key points
- Falcon Next-Gen SIEM will support Microsoft Defender telemetry without requiring organizations to install a Falcon sensor.
- Embedded Falcon Onum ingests, filters, enriches, and routes data in real time; CrowdStrike projects up to 5x faster streaming and up to 50% lower storage costs, based on internal analysis and customer pre-sale metrics.
- Federated search will reach Falcon LogScale, ExtraHop, and archived Amazon S3 data via Athena, allowing queries without re-ingesting or moving data.
- Third-Party Indicator Management supports ingesting, enriching, scoring, deduplicating, and managing external indicators, then correlating them with telemetry and CrowdStrike intelligence.
- The Query Translation Agent, delivered through Charlotte AI, translates Splunk queries or plain-language requests into CrowdStrike Query Language (CQL).
- The article notes that unreleased features remain in development and may change.
Article Details
- Event Type
- Product announcement and capability expansion
- Impact
- CrowdStrike announced that Falcon Next-Gen SIEM will support third-party EDR solutions, beginning with Microsoft Defender, without requiring a Falcon sensor on those endpoints. The announced capabilities also include real-time data control, federated search, third-party indicator management, and AI-assisted query translation. The article projects up to 5x faster streaming and up to 50% lower storage costs from Falcon Onum; it says actual results depend on deployment and environment.
Vendors
AmazonFederated search lets analysts query live, network (ExtraHop), and archived cloud data (Amazon S3 via Athena) and Falcon LogScale storage in place, avoiding costly re-ingestion and preserving existing investments.CrowdStrikeCrowdStrike announced that Falcon Next-Gen SIEM will support third-party EDR solutions beginning with Microsoft Defender, allowing organizations to modernize their SOC without installing a Falcon sensor.ExtraHopThe release adds Falcon Onum for real-time data control, federated search across LogScale/ExtraHop/S3, third-party indicator management, and a Query Translation Agent to accelerate migrations and reduce data andMicrosoftCrowdStrike announced that Falcon Next-Gen SIEM will support third-party EDR solutions beginning with Microsoft Defender, allowing organizations to modernize their SOC without installing a Falcon sensor.SplunkThe Query Translation Agent (CrowdStrike Charlotte AI) automatically translates Splunk queries or plain-language requests into CrowdStrike Query Language (CQL) to accelerate SIEM migrations and preserve existing
Products
Amazon S3Federated search lets analysts query live, network (ExtraHop), and archived cloud data (Amazon S3 via Athena) and Falcon LogScale storage in place, avoiding costly re-ingestion and preserving existing investments.AthenaFederated search lets analysts query live, network (ExtraHop), and archived cloud data (Amazon S3 via Athena) and Falcon LogScale storage in place, avoiding costly re-ingestion and preserving existing investments.CrowdStrike Charlotte AIThe Query Translation Agent (CrowdStrike Charlotte AI) automatically translates Splunk queries or plain-language requests into CrowdStrike Query Language (CQL) to accelerate SIEM migrations and preserve existingCrowdStrike Falcon Next-Gen SIEMCrowdStrike announced that Falcon Next-Gen SIEM will support third-party EDR solutions beginning with Microsoft Defender, allowing organizations to modernize their SOC without installing a Falcon sensor.ExtraHopThe release adds Falcon Onum for real-time data control, federated search across LogScale/ExtraHop/S3, third-party indicator management, and a Query Translation Agent to accelerate migrations and reduce data andFalcon LogScaleFederated search lets analysts query live, network (ExtraHop), and archived cloud data (Amazon S3 via Athena) and Falcon LogScale storage in place, avoiding costly re-ingestion and preserving existing investments.Falcon OnumThe release adds Falcon Onum for real-time data control, federated search across LogScale/ExtraHop/S3, third-party indicator management, and a Query Translation Agent to accelerate migrations and reduce data andMicrosoft Defender Antimalware PlatformCrowdStrike announced that Falcon Next-Gen SIEM will support third-party EDR solutions beginning with Microsoft Defender, allowing organizations to modernize their SOC without installing a Falcon sensor.SplunkThe Query Translation Agent (CrowdStrike Charlotte AI) automatically translates Splunk queries or plain-language requests into CrowdStrike Query Language (CQL) to accelerate SIEM migrations and preserve existing