How to easily integrate CrowdStrike logs with Microsoft Sentinel – with Azure Functions

In this article, we'll show you how to leverage CrowdStrike Falcon Data Replicator (FDR) to connect logs to Microsoft Sentinel using Azure Functions, making it easy for beginners!

1. Benefits of integrating CrowdStrike logs with Sentinel

✅ Benefits of Integration

🔹 Centralized monitoring with unified management → Analyze logs from multiple endpoints at once!
🔹 Real-time detection → Leverage Microsoft Sentinel rules to quickly identify threats!
🔹 Automated Incident Response Automate your response with → Sentinel playbooks!
🔹 Long-term retention and detailed analysis → Leverage Log Analytics to analyze past attacks!

This mechanism reduces the burden of SOC operations while enabling more robust security oversight.

2. How does the collaboration work?

To send CrowdStrike logs to Sentinel, you can do the following:

1. CrowdStrike Falcon → Store Logs in AWS S3 via Falcon Data Replicator (FDR)
2. Azure Functions → Retrieve data from AWS S3/SQS and transfer it to Microsoft Sentinel
3. Collect and analyze CrowdStrike logs via Microsoft Sentinel → Log Analytics

This approach eliminates the need to connect CrowdStrike Falcon directly to Sentinel and provides greater management flexibility.

3. Setup Instructions

(1) Enabling CrowdStrike Falcon Data Replicator (FDR)

First, let's get ready to forward CrowdStrike Falcon logs to AWS S3.

📌 Procedure

1. Contact CrowdStrike support and enable FDR
2. Ensure that AWS S3 buckets and SQS queues are automatically created
3. Get access and secret keys for AWS IAM users

(2) Deploying Azure Functions

Next, deploy Azure Functions, retrieve logs from AWS S3, and send them to Sentinel.

📌 Procedure

1. Create Azure Functions in the Azure portal (choose Python or C#)
2. Associate storage accounts
3. Use ARM templates to deploy Azure Functions

az deployment group create --resource-group <ResourceGroupName> \
  --template-uri https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CrowdStrike-Falcon/FalconDataReplicatorConnector.json

4. Set Azure Functions environment variables
   • AWS_ACCESS_KEY_ID = <取得したAWSアクセスキー>
   • AWS_SECRET_ACCESS_KEY = <取得したAWSシークレットキー>
   • AWS_REGION = <AWSリージョン>
   • SQS_QUEUE_URL = <AWS sqsキューのurl="">
   • LOG_ANALYTICS_WORKSPACE_ID = <SentinelのワークスペースID>
   • LOG_ANALYTICS_SHARED_KEY = <Sentinelのプライマリキー>

(3) Reviewing Logs with Sentinel

Once you're set up, it's time to verify that Microsoft Sentinel is collecting logs correctly.

📌 How to check

1. Check logs with KQL queries

Syslog
| where Hostname contains "CrowdStrike"
| project TimeGenerated, Hostname, Message
| sort by TimeGenerated desc

2. Check Azure Functions logs

az functionapp log tail --name<FunctionAppName>```

3. **Check if Data Collection Rules (DCRs) are applied**

Heartbeat | where Category == "CrowdStrike"

---

## **4\. Conclusion – Here's the point! **

To integrate CrowdStrike Falcon logs with Microsoft Sentinel,

✅ **Leverage Falcon Data Replicator (FDR) to store logs via AWS S3/SQS**<br>✅ **Leverage Azure Functions to retrieve data from AWS and transfer it to Sentinel**<br>✅ **Leverage KQL queries to monitor threats in real time**

This method allows for **smooth integration with Sentinel without the need for agents**.

💡 **If you want to reduce the burden on your SOC and achieve robust security monitoring, you should definitely try this method! **

🔍 If **you want to learn more, consider Colorkrew Security's SOC services! **</FunctionAppName></Sentinelのプライマリキー></SentinelのワークスペースID></AWS></AWSリージョン></取得したAWSシークレットキー></取得したAWSアクセスキー></ResourceGroupName>