Skip to main content

​
Overview

CrowdStrike Falcon Next-Gen SIEM (built on Falcon LogScale) can forward logs and events to external storage such as Amazon S3, Azure Blob Storage or GCP BigQuery, or push them via Webhook / HEC (HTTP Event Collector) to another SIEM. This guide covers the S3 path: CrowdStrike writes the data into an S3 bucket you own, and the OneFirewall AWS OFA Log Adapter reads the new files and sends them to OneFirewall, as described in S3 Log Processing.

​
Choose an Export Method

S3 Archiving

Continuously copies all ingested data of a LogScale repository into your bucket. Best for full log replication.

S3 Action

Uploads the results of a scheduled search or alert (CSV / NDJSON) into your bucket. Best for filtered, relevant events only.

Falcon Data Replicator

Raw endpoint telemetry delivered to a CrowdStrike-managed bucket with an SQS queue. Requires an FDR license.
For OneFirewall we recommend the S3 Action with a scheduled search that only exports network events (source/destination IP, ports, action). It reduces volume and cost compared to full archiving.

​
Prerequisites

  • A CrowdStrike Falcon tenant with Next-Gen SIEM / LogScale and permission to manage repository settings and actions.
  • An AWS account where you can create an S3 bucket and IAM roles.
  • An S3 bucket without Object Lock (S3 Archiving does not support buckets with object locking enabled).
  • For S3 Archiving, archiving must be enabled on your instance. If you do not see the option, ask CrowdStrike Support to enable it.

​
Step 1: Create the S3 Bucket

Add an S3 Lifecycle rule to expire objects after the OneFirewall adapter has processed them (e.g. 7–30 days) to keep storage costs low.

​
Step 2: Create the IAM Role for CrowdStrike

LogScale writes to your bucket by assuming an IAM role in your AWS account. Since LogScale 1.177, roles are the only supported method for new S3 archiving configurations (no static access keys).
1

Copy the identity values from LogScale

Open the configuration page in LogScale (see Step 3) and copy:
  • the IAM Identity (the CrowdStrike AWS principal ARN)
  • the External ID
2

Create the role with a custom trust policy

In AWS go to IAM → Roles → Create role → Custom trust policy and paste:
3

Add the inline write policy

Attach an inline policy that only allows writing into the bucket (keep the trailing /*):
4

Copy the Role ARN

Save the role and copy its ARN, e.g. arn:aws:iam::123456789012:role/crowdstrike-logscale-s3.
The S3 Action and S3 Archiving use the same configuration model, so one role can be reused for both.

​
Step 3: Configure the Export in CrowdStrike

The S3 Action uploads the results of a scheduled search or alert as files into your bucket (available from LogScale 1.221.0).
  1. In Falcon NG-SIEM / LogScale open Automation → Actions → New action.
  2. Select S3 as the action type.
  3. Copy the External ID (and IAM identity) into the trust policy from Step 2.
  4. Fill in:
    • Role ARN: the role created in Step 2
    • Bucket name: your-crowdstrike-logs
    • Region: e.g. eu-west-1
    • File format: NDJSON (recommended) or CSV
  5. Click Test action, then Save.
  6. Create a Scheduled search (e.g. every 5 minutes) that returns network events, and attach the S3 action to it.
Example query returning only network connection fields:
Each upload is limited in size (50 MB by default). Use a short schedule interval so results stay below the limit.

​
Step 4: Connect the OneFirewall Adapter

Grant the AWS OFA Log Adapter read access to the bucket with a separate role or identity (never reuse the CrowdStrike write role):
Choose the authentication method (EC2 Instance Profile, IAM Roles Anywhere or access keys) according to where the OneFirewall VM runs. See S3 Log Processing → Authentication Patterns.

​
Step 5: Verify

1

Check that CrowdStrike writes files

2

Check the file content

3

Check from the OneFirewall VM

Then confirm in the OneFirewall console that new events from CrowdStrike are showing up.

​
Troubleshooting

​
References