CrowdStrike Integration

Stream detection events to CrowdStrike Falcon LogScale (formerly Humio) for centralized SIEM analysis, threat correlation, and security monitoring.

Prerequisites

• CrowdStrike Falcon LogScale account
• Ingest Token (from LogScale)
• LogScale repository configured

Getting CrowdStrike Credentials

Ingest Token

1. Log into CrowdStrike Falcon LogScale (or your regional URL)
2. Navigate to your repository
3. Go to Settings → Ingest Tokens
4. Click Add Token
5. Name it “WebDecoy Integration”
6. Copy the token

Regional URLs

Region	LogScale URL
US	cloud.us.humio.com
EU	cloud.humio.com
Community	cloud.community.humio.com

Use the base URL of your LogScale instance. WebDecoy posts to <LogScale URL>/api/v1/ingest/hec.

Configuring Integration

1. Go to Integrations → CrowdStrike

2. Click Add CrowdStrike Integration

3. Enter:

   Field	Description
   Name	Friendly name for this integration
   LogScale URL	Your LogScale instance URL
   Ingest Token	Token from LogScale
   Source Type	The sourcetype value on each event (default: webdecoy:detection)
   Source	The source value on each event (default: webdecoy)
   Index (optional)	A LogScale repository/index

4. Configure trigger conditions (a detection is sent if any selected condition matches):

   Trigger	Description
   All Detections	Send every detection event
   High Risk Detections	Send detections with a unified score or bot score of 80 or more, the same rule every integration uses
   Rule Enforced Events	Send detections where a response action enforced

5. Configure optional filters:

   Filter	Description
   Minimum Score (optional)	Only send detections whose unified score is at least this value
   Filter by Decoys (optional)	Limit to specific decoys

6. Click Create Integration, then use Test on the integration card to send a test event.

Event Format

WebDecoy sends each detection as one HTTP Event Collector (HEC) event. Illustrative example (fields with no value for a detection are omitted):

{
  "time": 1784111400.123,
  "host": "webdecoy",
  "source": "webdecoy",
  "sourcetype": "webdecoy:detection",
  "event": {
    "detection_id": "5d0c8f1e-...",
    "timestamp": "2026-07-15T10:30:00Z",
    "detection_type": "decoy_link",
    "threat_level": "CRITICAL",
    "source_ip": "198.51.100.23",
    "user_agent": "Mozilla/5.0...",
    "referer": "https://example.com/",
    "unified_score": 85,
    "confidence": 0.94,
    "threat_category": "scanner",
    "cryptographic_trust": 0,
    "request_method": "GET",
    "rule_enforced": false,
    "property_id": "8b7d4e21-...",
    "organization_id": "3f1c2a9e-...",
    "decoy_id": "c2e9f6a0-...",
    "metadata": { "geoip": { "country": "US", "city": "New York" } }
  },
  "fields": {
    "#severity": "critical",
    "#product": "webdecoy",
    "#detection_source": "decoy_link"
  }
}

Event Fields

Field	Description	Example
detection_id	Unique detection ID	UUID
timestamp	Detection time (ISO 8601)	2026-07-15T10:30:00Z
detection_type	Detection source	decoy_link, bot_scanner, endpoint, sdk
threat_level	Risk level	MINIMAL, LOW, MEDIUM, HIGH, CRITICAL
source_ip	Source IP	198.51.100.23
user_agent / referer / request_method	Request details	n/a
unified_score	Headline risk score (0-100)	85
confidence	Detection confidence (0 to 1)	0.94
threat_category	Classification	scraper, scanner, attacker
cryptographic_trust / signature_verified / signature_agent	Cryptographic identity checks	n/a
rule_enforced	Whether a response action enforced	false
property_id / organization_id / decoy_id	Resource identifiers	n/a
fingerprint	Client fingerprint object, when the sensor collected one	n/a
metadata	The detection’s stored metadata (for example GeoIP and threat intel), as an object	n/a

The fields block adds #severity (lowercased threat level), #product and #detection_source.

For the headline MITRE tactic and score breakdown, fetch the detection from the WebDecoy API using detection_id.

LogScale Queries

Recent Detections

sourcetype="webdecoy:detection"
| table([@timestamp, source_ip, event.threat_level, event.detection_type, event.threat_category])

High-Risk Detections

Threat level HIGH starts at a score of 60, so this query is broader than the High Risk Detections trigger (score 80 or more). To match the trigger, filter on event.unified_score >= 80 instead.

sourcetype="webdecoy:detection" event.threat_level="CRITICAL" OR event.threat_level="HIGH"
| sort(@timestamp, order=desc)

Detection Count by Type

sourcetype="webdecoy:detection"
| groupBy(event.detection_type, function=count())

Top Attacking IPs

sourcetype="webdecoy:detection"
| groupBy(source_ip, function=[count(), avg(unified_score)])
| sort(_count, order=desc)
| head(20)

Geographic Distribution

sourcetype="webdecoy:detection"
| groupBy(event.metadata.geoip.country, function=count())
| sort(_count, order=desc)

Detections by Threat Category

sourcetype="webdecoy:detection"
| groupBy(event.threat_category, function=count())
| sort(_count, order=desc)

Building Dashboards

Recommended Widgets

Detection Timeline:

• Time chart of detections over time
• Group by threat_level for color coding

Threat Level Breakdown:

• Pie chart by event.threat_level
• Shows distribution of severity

Top IPs:

• Table of attacking IPs
• Include count and average score

Geographic Map:

• World map visualization
• Color by detection count per country

Threat Categories:

• Bar chart of threat categories
• Shows attack types detected

Sample Dashboard

Create a dashboard with these panels:

1. Detections Over Time - Timechart grouped by threat_level
2. Threat Level Distribution - Pie chart
3. Top 10 Attacking IPs - Table with count
4. Detection Sources - Bar chart by detection_type
5. Threat Categories - Bar chart by threat_category
6. Countries - World map or table

Alerting

Create LogScale alerts for WebDecoy events:

Critical Detection Alert

sourcetype="webdecoy:detection" event.threat_level="CRITICAL"
| count()

• Trigger: count > 0
• Window: 5 minutes
• Action: Notify security team

Detection Spike Alert

sourcetype="webdecoy:detection"
| bucket(span=5m)
| count()

• Trigger: count > 100 (adjust based on baseline)
• Action: Alert on anomaly

Known Attacker Alert

sourcetype="webdecoy:detection"
| groupBy(source_ip, function=count())
| _count > 10

• Trigger: Any result
• Window: 1 hour
• Action: Notify the team to investigate. The integration only forwards events; to block, use a WebDecoy response action or your WAF

Integration with Falcon Platform

Correlating with Endpoint Data

WebDecoy detections can be correlated with CrowdStrike Falcon endpoint data:

1. Use IP address to find matching endpoint alerts
2. Correlate by timestamp for attack timeline
3. Link web reconnaissance to endpoint compromise attempts

Using detected IPs as indicators

The integration sends log events only; it does not create IOCs or write to Falcon. If you want to, you can do this yourself in Falcon:

1. Create custom IOCs from detected IPs
2. Track attack progression from web to endpoint
3. Build attack timelines across data sources

Trigger Tracking

WebDecoy tracks integration activity:

Metric	Description
Trigger Count	Total events sent
Failure Count	Failed delivery attempts
Last Triggered	Most recent event sent
Last Error	Most recent error message

View these in the integration details page.

Best Practices

Do’s

• ✅ Use descriptive source/sourcetype names
• ✅ Start with “On High Risk” to reduce volume
• ✅ Create dashboards for visibility
• ✅ Set up alerts for critical detections
• ✅ Correlate with endpoint data
• ✅ Use threat_category and unified_score for triage

Don’ts

• ❌ Forward all events without filtering first
• ❌ Use overly broad ingest tokens
• ❌ Ignore integration error metrics
• ❌ Skip dashboard creation

Troubleshooting

Events Not Appearing

1. Verify Ingest Token is correct
2. Check LogScale URL matches your region
3. Ensure integration is active (toggle enabled)
4. Check the integration’s failure count
5. Query LogScale: sourcetype="webdecoy:detection" | head(10)

Authentication Errors

1. Regenerate Ingest Token in LogScale
2. Verify token has write permissions
3. Check token hasn’t expired
4. Ensure correct repository selected

Missing Events

1. Check trigger conditions match your detections
2. Verify the minimum score filter
3. Check decoy ID filter if configured
4. Review last error message in integration details

High Failure Count

1. Check LogScale service status
2. Verify network connectivity
3. Check rate limits on your account
4. Review error messages in integration

---

Next Steps

• Datadog - Alternative SIEM integration
• Cloudflare - Block actors at your Cloudflare WAF
• Overview - All integrations