CrowdStream

CrowdStream is a built-in data ingestion and routing capability within Falcon NextGen SIEM and Falcon LogScale Collector that provides a unified framework for collecting, transforming, and routing log data from any source.

As a native component of the CrowdStrike platform, CrowdStream simplifies the ingestion process by providing pre-configured connectors for common data sources and built-in transformation capabilities to normalize data before it reaches LogScale.

Data Flow

The following diagram shows how CrowdStream routes data through Log Collector's ingestion pipeline:

flowchart LR A[CrowdStrike Events] --> B[CrowdStream] B --> C[LogScale HTTP Endpoint] C --> D[Parser Pipeline] subgraph "Parser Types" D --> D1[CrowdStrike Event Parser] D --> D2[JSON Parser] D --> D3[Falcon Data Replicator Parser] D --> D4[Detection Event Parser] end D1 & D2 & D3 & D4 --> E[Compression] E --> F[Repository Storage]
flowchart LR A[CrowdStrike Events] --> B[CrowdStream] B --> C[LogScale HTTP Endpoint] C --> D[Parser Pipeline] subgraph "Parser Types" D --> D1[CrowdStrike Event Parser] D --> D2[JSON Parser] D --> D3[Falcon Data Replicator Parser] D --> D4[Detection Event Parser] end D1 & D2 & D3 & D4 --> E[Compression] E --> F[Repository Storage]

The unified data routing framework allows organizations to define ingestion pipelines that can split, transform, and route data to multiple destinations based on content, enrichment rules, and business logic.