CrowdStrike announced that Falcon Next-Gen SIEM will support third-party EDR solutions beginning with Microsoft Defender, allowing organizations to modernize their SOC without installing a Falcon sensor. The release adds Falcon Onum for real-time data control, federated search across LogScale/ExtraHop/S3, third-party indicator management, and a Query Translation Agent to accelerate migrations and reduce data and onboarding costs. #CrowdStrike #MicrosoftDefender
Keypoints
- Falcon Next-Gen SIEM now supports third-party EDR starting with Microsoft Defender, enabling unified detection, investigation, and response without replacing endpoint agents.
- Falcon Onum is embedded to provide real-time data ingestion, filtering, enrichment, and routing at the edge, improving streaming performance and reducing storage costs (projected up to 5x faster streaming and up to 50% lower storage).
- Federated search lets analysts query live, network (ExtraHop), and archived cloud data (Amazon S3 via Athena) and Falcon LogScale storage in place, avoiding costly re-ingestion and preserving existing investments.
- Third-Party Indicator Management operationalizes external threat intelligence by ingesting, enriching, scoring, deduplicating, and lifecycle-managing indicators and correlating them with telemetry and CrowdStrike intelligence.
- The Query Translation Agent (CrowdStrike Charlotte AI) automatically translates Splunk queries or plain-language requests into CrowdStrike Query Language (CQL) to accelerate SIEM migrations and preserve existing workflows.
- The platform unifies first- and third-party data under an AI-native, index-free search model to eliminate the “data tax,” streamline onboarding, and enable agentic automation and orchestration across heterogeneous environments.
MITRE Techniques
- [T0000 ] None Mentioned – The article does not explicitly reference any MITRE ATT&CK technique IDs or technique names (‘Operationalize Microsoft Defender telemetry inside Falcon Next-Gen SIEM to unify detection, investigation, and response — without changing endpoint deployments.’)
Indicators of Compromise
- [None ] No IOCs were provided in the article – no IP addresses, file hashes, domains, or malicious file names were listed.