CrowdStrike Integration

Stream detection events to CrowdStrike Falcon LogScale (formerly Humio) for centralized SIEM analysis, threat correlation, and security monitoring.

Prerequisites

• CrowdStrike Falcon LogScale account
• Ingest Token (from LogScale)
• LogScale repository configured

Getting CrowdStrike Credentials

Ingest Token

1. Log into CrowdStrike Falcon LogScale (or your regional URL)
2. Navigate to your repository
3. Go to Settings → Ingest Tokens
4. Click Add Token
5. Name it “WebDecoy Integration”
6. Copy the token

Regional URLs

Region	LogScale URL
US	cloud.us.humio.com
EU	cloud.humio.com
US-2	cloud.community.humio.com

Configuring Integration

1. Go to Integrations → CrowdStrike

2. Click Add CrowdStrike Integration

3. Enter:

   Field	Description
   Name	Friendly name for this integration
   LogScale URL	Your LogScale instance URL
   Ingest Token	Token from LogScale
   Source	Event source name (default: webdecoy)
   Source Type	Event source type (default: webdecoy:detection)

4. Configure trigger conditions:

   Trigger	Description
   On Detection	Send every detection event
   On High Risk	Only send high-risk detections (score ≥ 75)
   On Rule Enforced	Send when blocking rules are triggered

5. Configure optional filters:

   Filter	Description
   Minimum Bot Score	Only send detections above this score
   Specific Decoys	Limit to specific decoy IDs

6. Click Save

Event Format

WebDecoy sends events using the HTTP Event Collector (HEC) format:

{
  "detection_id": "det_abc123",
  "timestamp": "2026-07-15T10:30:00Z",
  "detection_type": "detection",
  "threat_level": "critical",
  "source_ip": "192.168.1.100",
  "user_agent": "Mozilla/5.0...",
  "referer": "https://example.com/",
  "unified_score": 85,
  "confidence": 0.94,
  "threat_category": "scanner",
  "cryptographic_trust": null,
  "signature_verified": null,
  "signature_agent": null,
  "property_id": "prop_def456",
  "organization_id": "org_xyz789",
  "decoy_id": "dec_ghi789"
}

Event Fields

Field	Description	Example
detection_id	Unique detection ID	det_abc123
timestamp	Detection time (ISO 8601)	2026-07-15T10:30:00Z
detection_type	Event type	detection
threat_level	Risk level	minimal, low, medium, high, critical
source_ip	Source IP	192.168.1.100
unified_score	Headline risk score (0-100)	85
confidence	Detection confidence	0.94
threat_category	Classification	scraper, scanner, attacker
cryptographic_trust / signature_verified / signature_agent	Cryptographic identity checks	n/a
property_id / organization_id / decoy_id	Resource identifiers	n/a

For full enriched detail (geo, signals, MITRE mapping), fetch the detection from the WebDecoy API using detection_id.

LogScale Queries

Recent Detections

sourcetype="webdecoy:detection"
| table([@timestamp, source_ip, event.threat_level, event.detection_type, event.path])

High-Risk Detections

sourcetype="webdecoy:detection" event.threat_level="critical" OR event.threat_level="high"
| sort(@timestamp, order=desc)

Detection Count by Type

sourcetype="webdecoy:detection"
| groupBy(event.detection_type, function=count())

Top Attacking IPs

sourcetype="webdecoy:detection"
| groupBy(source_ip, function=[count(), avg(unified_score)])
| sort(_count, order=desc)
| head(20)

Geographic Distribution

sourcetype="webdecoy:detection"
| groupBy(event.country, function=count())
| sort(_count, order=desc)

Bot vs Human Detections

sourcetype="webdecoy:detection"
| case {
    event.is_bot=true | detection_source := "Bot";
    * | detection_source := "Human";
  }
| groupBy(detection_source, function=count())

Building Dashboards

Recommended Widgets

Detection Timeline:

• Time chart of detections over time
• Group by threat_level for color coding

Threat Level Breakdown:

• Pie chart by event.threat_level
• Shows distribution of severity

Top IPs:

• Table of attacking IPs
• Include count and average score

Geographic Map:

• World map visualization
• Color by detection count per country

Threat Categories:

• Bar chart of threat categories
• Shows attack types detected

Sample Dashboard

Create a dashboard with these panels:

1. Detections Over Time - Timechart grouped by threat_level
2. Threat Level Distribution - Pie chart
3. Top 10 Attacking IPs - Table with count
4. Detection Types - Bar chart
5. Bot vs Human - Pie chart
6. Countries - World map or table

Alerting

Create LogScale alerts for WebDecoy events:

Critical Detection Alert

sourcetype="webdecoy:detection" event.threat_level="critical"
| count()

• Trigger: count > 0
• Window: 5 minutes
• Action: Notify security team

Detection Spike Alert

sourcetype="webdecoy:detection"
| bucket(span=5m)
| count()

• Trigger: count > 100 (adjust based on baseline)
• Action: Alert on anomaly

Known Attacker Alert

sourcetype="webdecoy:detection"
| groupBy(source_ip, function=count())
| _count > 10

• Trigger: Any result
• Window: 1 hour
• Action: Block IP / investigate

Integration with Falcon Platform

Correlating with Endpoint Data

WebDecoy detections can be correlated with CrowdStrike Falcon endpoint data:

1. Use IP address to find matching endpoint alerts
2. Correlate by timestamp for attack timeline
3. Link web reconnaissance to endpoint compromise attempts

Threat Graph Integration

Add WebDecoy detections to your threat graph:

1. Create custom IOC from detected IPs
2. Track attack progression from web to endpoint
3. Build attack timelines across data sources

Trigger Tracking

WebDecoy tracks integration activity:

Metric	Description
Trigger Count	Total events sent
Failure Count	Failed delivery attempts
Last Triggered	Most recent event sent
Last Error	Most recent error message

View these in the integration details page.

Best Practices

Do’s

• ✅ Use descriptive source/sourcetype names
• ✅ Start with “On High Risk” to reduce volume
• ✅ Create dashboards for visibility
• ✅ Set up alerts for critical detections
• ✅ Correlate with endpoint data
• ✅ Use threat_category and unified_score for triage

Don’ts

• ❌ Forward all events without filtering first
• ❌ Use overly broad ingest tokens
• ❌ Ignore integration error metrics
• ❌ Skip dashboard creation

Troubleshooting

Events Not Appearing

1. Verify Ingest Token is correct
2. Check LogScale URL matches your region
3. Ensure integration is active (toggle enabled)
4. Check the integration’s failure count
5. Query LogScale: sourcetype="webdecoy:detection" | head(10)

Authentication Errors

1. Regenerate Ingest Token in LogScale
2. Verify token has write permissions
3. Check token hasn’t expired
4. Ensure correct repository selected

Missing Events

1. Check trigger conditions match your detections
2. Verify minimum bot score filter
3. Check decoy ID filter if configured
4. Review last error message in integration details

High Failure Count

1. Check LogScale service status
2. Verify network connectivity
3. Check rate limits on your account
4. Review error messages in integration

---

Next Steps

• Datadog - Alternative SIEM integration
• Cloudflare - Automatic IP blocking
• Overview - All integrations