> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onefirewall.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CrowdStrike to AWS S3

> Export CrowdStrike Falcon LogScale / Next-Gen SIEM data to an Amazon S3 bucket and ingest it into OneFirewall

## Overview

CrowdStrike **Falcon Next-Gen SIEM** (built on **Falcon LogScale**) can forward logs and events to external storage such as **Amazon S3**, Azure Blob Storage or GCP BigQuery, or push them via **Webhook / HEC (HTTP Event Collector)** to another SIEM.

This guide covers the S3 path: CrowdStrike writes the data into an S3 bucket you own, and the **OneFirewall AWS OFA Log Adapter** reads the new files and sends them to OneFirewall, as described in [S3 Log Processing](https://docs.onefirewall.com/essentials/logs-events/s3-log-processing.md).

```mermaid theme={null}
graph LR
    A[CrowdStrike Falcon<br/>LogScale / NG-SIEM] -->|s3:PutObject<br/>IAM Role + External ID| B[(Customer S3 Bucket)]
    B -->|s3:GetObject / s3:ListBucket| C(AWS OFA Log Adapter)
    C -->|ofa traffic_api| D[OneFirewall Alliance OnPrem/Whitelabel]
```

***

## Choose an Export Method

> [card] S3 Archiving
>
> Continuously copies **all ingested data** of a LogScale repository into your bucket. Best for full log replication.

> [card] S3 Action
>
> Uploads the **results of a scheduled search or alert** (CSV / NDJSON) into your bucket. Best for filtered, relevant events only.

> [card] Falcon Data Replicator
>
> Raw endpoint telemetry delivered to a **CrowdStrike-managed** bucket with an SQS queue. Requires an FDR license.

> [!TIP]
>
> For OneFirewall we recommend the **S3 Action** with a scheduled search that only exports network events (source/destination IP, ports, action). It reduces volume and cost compared to full archiving.

***

## Prerequisites

* A CrowdStrike Falcon tenant with **Next-Gen SIEM / LogScale** and permission to manage repository settings and actions.
* An AWS account where you can create an **S3 bucket** and **IAM roles**.
* An S3 bucket **without Object Lock** (S3 Archiving does not support buckets with object locking enabled).
* For S3 Archiving, archiving must be **enabled on your instance**. If you do not see the option, ask CrowdStrike Support to enable it.

***

## Step 1: Create the S3 Bucket

```bash theme={null}
aws s3api create-bucket \
  --bucket your-crowdstrike-logs \
  --region eu-west-1 \
  --create-bucket-configuration LocationConstraint=eu-west-1

# Block all public access
aws s3api put-public-access-block \
  --bucket your-crowdstrike-logs \
  --public-access-block-configuration \
  BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true
```

> [!NOTE]
>
> Add an **S3 Lifecycle rule** to expire objects after the OneFirewall adapter has processed them (e.g. 7–30 days) to keep storage costs low.

***

## Step 2: Create the IAM Role for CrowdStrike

LogScale writes to your bucket by **assuming an IAM role** in your AWS account. Since LogScale 1.177, roles are the only supported method for new S3 archiving configurations (no static access keys).

**1. Copy the identity values from LogScale**

Open the configuration page in LogScale (see Step 3) and copy:

* the **IAM Identity** (the CrowdStrike AWS principal ARN)
* the **External ID**

**2. Create the role with a custom trust policy**

In AWS go to **IAM → Roles → Create role → Custom trust policy** and paste:

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "<IAM_IDENTITY_FROM_LOGSCALE>"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<EXTERNAL_ID_FROM_LOGSCALE>"
        }
      }
    }
  ]
}
```

**3. Add the inline write policy**

Attach an inline policy that only allows writing into the bucket (keep the trailing `/*`):

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCrowdStrikeWrite",
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::your-crowdstrike-logs/*"
    }
  ]
}
```

**4. Copy the Role ARN**

Save the role and copy its ARN, e.g. `arn:aws:iam::123456789012:role/crowdstrike-logscale-s3`.

> [!TIP]
>
> The S3 Action and S3 Archiving use the same configuration model, so one role can be reused for both.

***

## Step 3: Configure the Export in CrowdStrike

> [tab] S3 Action (Recommended)
>
> The S3 Action uploads the results of a **scheduled search** or **alert** as files into your bucket (available from LogScale **1.221.0**).
>
> 1. In Falcon NG-SIEM / LogScale open **Automation → Actions → New action**.
> 2. Select **S3** as the action type.
> 3. Copy the **External ID** (and IAM identity) into the trust policy from Step 2.
> 4. Fill in:
>    * **Role ARN**: the role created in Step 2
>    * **Bucket name**: `your-crowdstrike-logs`
>    * **Region**: e.g. `eu-west-1`
>    * **File format**: **NDJSON** (recommended) or CSV
> 5. Click **Test action**, then **Save**.
> 6. Create a **Scheduled search** (e.g. every 5 minutes) that returns network events, and attach the S3 action to it.
>
> Example query returning only network connection fields:
>
> ```text theme={null}
> #event_simpleName=NetworkConnectIP4 OR #event_simpleName=NetworkReceiveAcceptIP4
> | table([@timestamp, aid, ComputerName, LocalAddressIP4, LocalPort, RemoteAddressIP4, RemotePort, Protocol])
> ```
>
> > [!WARNING]
> >
> > Each upload is limited in size (50 MB by default). Use a short schedule interval so results stay below the limit.

> [tab] S3 Archiving (Full Repository)
>
> S3 Archiving copies everything ingested into a repository to your bucket.
>
> 1. Open the repository in LogScale and go to **Settings → Egress → S3 Archiving**.
>
> 2. Copy the **IAM Identity** and **External ID** into the trust policy from Step 2.
>
> 3. Fill in:
>    * **Role ARN**: the role created in Step 2
>    * **Bucket name**: `your-crowdstrike-logs`
>    * **Region**: e.g. `eu-west-1`
>    * **Format**: **NDJSON** (recommended)
>
> 4. Click **Submit**.
>
> > [!NOTE]
> >
> > Archived files are compressed and uploaded in batches, so expect some minutes of delay between ingestion in LogScale and the file appearing in S3.

> [tab] Falcon Data Replicator (FDR)
>
> FDR delivers raw Falcon sensor events to a bucket **managed by CrowdStrike**, with an **SQS queue** that notifies new files.
>
> 1. Ensure FDR is enabled on your tenant (contact CrowdStrike Support if not).
>
> 2. In the Falcon console go to **Support and resources → API clients and keys → FDR AWS S3 credentials and SQS queue**.
>
> 3. Click **Create new credentials** and save the **Client ID**, **Secret** (shown only once) and **SQS queue URL**.
>
> > [!WARNING]
> >
> > In this model the bucket belongs to CrowdStrike: you receive static access keys instead of an IAM role. Store them in a secret manager and rotate them regularly. Provide the key, secret and SQS URL to the OneFirewall team to configure the adapter.

***

## Step 4: Connect the OneFirewall Adapter

Grant the **AWS OFA Log Adapter** read access to the bucket with a **separate** role or identity (never reuse the CrowdStrike write role):

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowOneFirewallRead",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::your-crowdstrike-logs",
        "arn:aws:s3:::your-crowdstrike-logs/*"
      ]
    }
  ]
}
```

Choose the authentication method (EC2 Instance Profile, IAM Roles Anywhere or access keys) according to where the OneFirewall VM runs. See [S3 Log Processing → Authentication Patterns](https://docs.onefirewall.com/essentials/logs-events/s3-log-processing.md#authentication-patterns).

***

## Step 5: Verify

**1. Check that CrowdStrike writes files**

```bash theme={null}
aws s3 ls s3://your-crowdstrike-logs/ --recursive | tail
```

**2. Check the file content**

```bash theme={null}
aws s3 cp s3://your-crowdstrike-logs/<path/to/file> - | zcat 2>/dev/null | head -n 5 \
  || aws s3 cp s3://your-crowdstrike-logs/<path/to/file> - | head -n 5
```

**3. Check from the OneFirewall VM**

```bash theme={null}
aws s3 ls s3://your-crowdstrike-logs/
```

Then confirm in the OneFirewall console that new events from CrowdStrike are showing up.

***

## Troubleshooting

| Issue | Possible cause |
| - | - |
| `Access Denied` when saving in LogScale | Wrong IAM identity or External ID in the trust policy, missing trailing `/*` in the resource, or a typo in bucket name/region. |
| Archiving option not visible | S3 Archiving is not enabled on the instance. Contact CrowdStrike Support. |
| Bucket rejected | Object Lock is enabled on the bucket. |
| S3 Action uploads fail or are truncated | Results exceed the file size limit. Reduce the schedule interval or the number of fields. |
| No files from FDR | SQS queue URL or region is wrong (the region is part of the queue URL). |

***

## References

* [Falcon LogScale – S3 Archiving](https://library.humio.com/falcon-logscale-cloud/archiving-s3.html)
* [Falcon LogScale – Action Type: S3](https://library.humio.com/data-analysis/automated-actions-s3.html)
* [CrowdStrike FDR (GitHub)](https://github.com/CrowdStrike/FDR)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.