Configure Cribl Search to run in-place queries against an NG-SIEM repository or view.

Before You Begin ​

In CrowdStrike, do the following:

1. Create an API client, and note its client ID and client secret.
2. Grant the API client permission to run queries against the repository or view you plan to search.
3. Note the name of the repository or view to search, and your CrowdStrike API base URL. The base URL is specific to your CrowdStrike cloud region. For the URL that matches your region, see CrowdStrike’s API documentation.

In your network, make sure Cribl Search can reach your CrowdStrike API base URL over HTTPS. If your environment restricts outbound traffic, allowlist the Cribl Search egress IP before you save the Dataset Provider.

Add a CrowdStrike NG-SIEM Dataset Provider ​

A Dataset Provider tells Cribl Search where to query and stores the access credentials for that connection.

To add a new Dataset Provider, select Data, then Dataset Providers, then Add Provider.

Next, configure the resulting New Dataset Provider modal as follows:

1. In ID, enter a unique identifier for the Dataset Provider. This is how you’ll reference it when assigning Datasets to it. Start the ID with a letter. The rest of the ID can use letters, numbers, and underscores (for example, my_ngsiem_provider).

2. Optionally, add Description to quickly describe the Dataset Provider.

3. Set Dataset Provider Type to CrowdStrike NG-SIEM, listed under Log Analytics.

4. Enter the following:

   Field	Description
   Base URL	Your CrowdStrike API base URL, for example https://api.us-2.crowdstrike.com. Must use HTTPS.
   Repository	Name of the LogScale repository or view to search.
   Client ID	The client ID of your CrowdStrike API client.
   Client secret	The client secret of your CrowdStrike API client. Cribl Search stores it encrypted at rest.

5. Select Save when finished.

When you select Save, Cribl Search tests the connection by running a small query against the repository.

If the test fails, Cribl Search doesn’t save the Dataset Provider. Instead, a message explains the cause and highlights the field to correct. See Connection Errors for the full list of messages.

Connection Errors ​

A failed connection test returns one of the following messages:

Add a CrowdStrike NG-SIEM Dataset ​

Now you’ll add a Dataset that tells Cribl Search what to query within the Dataset Provider’s repository.

To add a new Dataset, select Data, then Datasets, then Add Dataset.

Next, configure the resulting New Dataset modal as follows:

1. Select the Dataset type: Federated Dataset.
2. In ID, enter a unique identifier for the Dataset. You’ll use this to specify the Dataset in a query’s scope. Start the ID with a letter. The rest of the ID can use letters, numbers, and underscores (for example, ngsiem_firewall).
3. Optionally, add Description to quickly describe the Dataset.
4. Set Dataset Provider to the ID of a CrowdStrike NG-SIEM Dataset Provider.
5. In Query, enter the CrowdStrike Query Language (CQL) query that defines what this Dataset represents, for example #repo=base_sensor or @sourcetype=paloalto-ngfw. This field is required.
6. In Processing, you can apply rules for breaking data into discrete events. For more information, see Datatypes.
7. Select Save when finished.

Use the Query field to scope the Dataset, not to filter individual investigations. Analysts narrow results further in their own Cribl Search queries.

Search CrowdStrike NG-SIEM ​

Now that you have a Dataset Provider and Dataset, you’re ready to start searching:

dataset="ngsiem_firewall" | limit 100

When you search this Dataset, the Dataset’s Query becomes the base CQL. Cribl Search appends the filter conditions from your search to that CQL and sends it to CrowdStrike, which runs the filtering server-side. Everything Cribl Search can’t express in CQL runs locally, on the events CrowdStrike returns.

For example, if the Dataset’s Query is #repo=base_sensor and you run this search:

dataset="ngsiem_firewall"
| where status == "error"
| limit 5000

Cribl Search sends CrowdStrike this CQL:

#repo=base_sensor | "status" = "error" | tail(5000)

Narrowing your search therefore makes it faster, because CrowdStrike filters the events before sending them. Cribl Search pushes down equality, contains, regex, startswith and endswith, null checks, and boolean combinations of these.

Your search time range goes to CrowdStrike as separate API parameters, so you don’t need to express time bounds in CQL.

Cribl Search waits for CrowdStrike to finish the query before returning results.

If you cancel a search, Cribl Search attempts to stop the query in CrowdStrike on a best-effort basis. Cribl Search doesn’t confirm that the request arrived, so the job may keep running in CrowdStrike.

Cribl Search maps each returned event as follows:

LogScale field names such as @sourcetype contain special characters, so quote them with [' and '] when you reference them:

dataset="ngsiem_firewall"
| summarize count() by ['@sourcetype']

Result Limits and Warnings ​

Cribl Search automatically appends a result limit to the CQL it sends, based on your max_results_per_search setting. NG-SIEM caps this limit at 200,000 events, so Cribl Search reduces higher values.

Cribl Search appends this limit only when all of the following are true:

• Your Cribl Search query has no explicit limit.
• The Dataset’s Query contains no CQL aggregate function, such as count() or groupBy().
• The Dataset’s Query doesn’t already limit how many events it returns.

When your Cribl Search query does include a limit, Cribl Search sends that value to CrowdStrike instead. An aggregation in your Cribl Search query doesn’t change this, because the aggregation runs in Cribl Search and needs enough events to aggregate over.

When results hit a cap, Cribl Search returns the results collected so far and shows this warning:

Results were capped at N. Narrow the time range or add filters to see all matching data.

To get complete results, reduce the search time range, add filters to your query, or raise max_results_per_search.

If part of the result set fails to arrive, you get the results collected so far, along with this warning:

Some results may be missing -- a page fetch failed after retries.

Run the search again to get the full result set.