CrowdStrike Falcon Event Streams

Preview

Lakewatch is in Private Preview. To request access, reach out to your Databricks account team.

Lakewatch provides an API connector to ingest data from CrowdStrike Falcon Event Streams. This article covers prerequisites, configuration instructions, connector schemas, and Lakewatch parser observables.

Prerequisites

The connector requires:

1. Serverless Lakeflow Spark Declarative Pipelines turned on in your workspace.
2. Unity Catalog, with privileges to create or use a Unity Catalog connection. See Connection permissions.
3. A Falcon administrator who can create an OAuth2 API client. See CrowdStrike's Event Streams API documentation.
4. An API client with the Event streams scope and Read permission (event_streams read). The connector calls GET /sensors/entities/datafeed/v2 and consumes the returned feeds.

Known limitations

• SCD type 2 is not supported, since Falcon Event Streams are append-only.
• Historical lookback isn't available for this connector. Ingestion starts at datasource creation. See Choose how far back to ingest.

Configure CrowdStrike for ingestion

CrowdStrike authenticates Falcon Event Streams requests with an OAuth 2.0 client credentials token. Databricks exchanges the client ID and client secret for an access token, then discovers and reads Falcon Event Streams feeds. For more information, see CrowdStrike's Event Streams API documentation.

1. Sign in to the Falcon console as a Falcon administrator.
2. Go to Support and resources, then API clients and keys.
3. Click Add new API client.
4. Enter a Client name (for example, Event_Stream_Ingestor) and an optional Description.
5. Under API scopes, find Event streams and enable Read.
6. Click Create.
7. Copy the Client ID, Client Secret, and Base URL. CrowdStrike shows the client secret only one time. For the Databricks connection, enter the Base URL with the https:// scheme and no path (for example, https://api.crowdstrike.com or https://api.us-2.crowdstrike.com).

tip

When creating a connection through the Lakewatch UI, you need the Client ID, Client Secret, and Base URL gathered above.

Next steps

After completing the configuration above, create a datasource with the CrowdStrike connector in the Lakewatch UI. See API connectors for instructions.

---

Connector and Lakewatch schemas

The connector ingests the following source table from the default source schema:

Source table	CrowdStrike data	Built-in Lakewatch parser
events	Falcon Event Streams tenant events	crowdstrike_event_streams

Source table	CrowdStrike data	Built-in Lakewatch parser
events	Falcon Event Streams tenant events	crowdstrike_event_streams

The connector writes the source table to the datasource's raw destination. The built-in parser writes a separate parsed table named after the parser, unless you set a parsed destination when you configure the datasource.

Lakewatch-managed columns

The connector derives:

• time: A non-null timestamp from metadata.eventCreationTime, interpreted as Unix epoch milliseconds. The connector uses time as the cursor field for incremental ingestion.
• lw_id: A non-null string that Lakewatch uses as the primary key. The connector derives a stable, time-sortable ID from time, the event's feed, and its offset. The ID supports deduplication across incremental syncs.

For Lakewatch datasources, the raw and parsed records also include:

• lw_meta: Standard Lakewatch processing metadata.
• lw_observables: Values identified by recursively scanning the event payload for security observables.

The parser also assigns the parsed time column.

For more information, see Parser reference.

Raw connector table schema

Schema

Column	Data type
lw_id	STRING
time	TIMESTAMP
event_data	STRING
data	VARIANT

Column	Data type
lw_id	STRING
time	TIMESTAMP
event_data	STRING
data	VARIANT

note

event_data is deprecated. Use data instead. data contains the same event information as event_data, but uses the VARIANT type for improved query performance.

Parser observables

The crowdstrike_event_streams parser scans data recursively for fields whose names identify the following observable types:

Observables

Observable type	Matching field names
IP address	userip, localip, localaddress, remoteaddress
Hostname	computername, hostname, hostnamefield
Hash	md5string, sha1string, sha256string
MAC address	macaddress
Email	userid
Username	username
Trace ID	sessionid
URL	falconhostlink
MITRE ATT&CK technique	technique

Observable type	Matching field names
IP address	userip, localip, localaddress, remoteaddress
Hostname	computername, hostname, hostnamefield
Hash	md5string, sha1string, sha256string
MAC address	macaddress
Email	userid
Username	username
Trace ID	sessionid
URL	falconhostlink
MITRE ATT&CK technique	technique