SIEM Integration Overview: Crowdstrike NG-SIEM
Install Foundary App
Locate the GreyNoise App within Foundary and install it. Then review the available components in the App Manager:

Foundry App Components
The GreyNoise Foundry App for CrowdStrike Falcon includes three components:
- An integration to the GreyNoise API to use within Fusion SOAR Workflows
- A logic function that interacts with the GreyNoise API to create a Lookup File and uploads it to NG-SIEM
- A pre-built Workflow to run the logic function daily at 0300 UTC.
Configure an Instance of the GreyNoise App
After installing the Foundry App, two configuration sections need to be configured.

GreyNoise API Configuration
This setting section includes two values and enables the authentication for adding GreyNoise API actions into Fusion SOAR workflows.
- Name: A name for the API credentials to help identify them, i.e.
GreyNoise - Service Account Alpha
- API Key: The API key to be used, from the GreyNoise Visualizer: Visualizer - My API Key
Workflow Settings
This section provides the necessary settings for the automated workflow that creates and uploads the CSV file daily into the NG-SIEM Lookup files section.
- API Key: The API key to be used, from the GreyNoise Visualizer: Visualizer - My API Key
- Max Indicator Count: This option allows you to set a cap on the maximum number of indicators that will be stored in the lookup file. Ideally, this number should be larger than the total number of indicators in the defined query if you desire the file to contain all indicators from the query.
- Query: The GreyNoise Query (GNQL) retrieves indicators from the GreyNoise API. By default, this should be set to
last_seen:1d
which will allow for all indicators observed in the last 24h to be stored in the lookup file. - Repository: This should be the name of the NG-SIEM lookup file repository that the Lookup File will be uploaded to with NG-SIEM. A default value of
search-all
will most commonly be used.
Lookup File Workflow
The Foundry App installs and auto-enables a workflow to update the GreyNoise Lookup file daily. The workflow includes the following components:
- Workflow: GreyNoise Indicator Import Scheduler
- Function: greynoise-ti-bulk-import
Once the settings are configured, the workflow can be found in the Fusion SOAR Workflows section and should be marked as enabled:

The execution log will show the state of each of the workflow runs:

This will then generate and update the ti_greynoise_indicators.csv
file within NG-SIEM:


Incorporating the Lookup File
The lookup file is designed to use the match()
function to incorporate the GreyNoise data into the searches created within NG-SIEM. This additional metadata can then be used to filter out unnecessary events or to create additional alert types, depending on the use case.
The following is a sample search incorporating the lookup file:
#type = "greynoise-sensor-data"
| match(file="ti_greynoise_indicators.csv", field=[source.ip] , column=[source.ip], strict=false)
| "source.ip.greynoise.internet_scanner_intelligence.found" != True



Dashboards
The GreyNoise lookup file intelligence can also be incorporated into dashboards to monitor data sources and bring important information into view for users:

Updated about 14 hours ago