Overview

The CrowdStrike Streaming integration ingests Falcon events into Torq using the CrowdStrike Streaming API. Ingested events can be routed to workflows or Auto Triage. This integration supports event ingestion only and cannot be used to authorize steps.

How to use

Generate a CrowdStrike Streaming API key

Open API settings: In Falcon, go to Support > API Clients and Keys.
Create an API client: Click Create API Client, enter a meaningful name and description.
Set permissions: Search for stream, and enable Read for Event streams.
Save credentials: Copy the Client ID and Client Secret and store them securely, you won't be able to access them again.
Copy the Base URL.
Finalize: Click Done.

Create a CrowdStrike Streaming integration in Torq

Add the integration: Go to Build > Integrations > Steps > CrowdStrike Streaming and click Add Instance.
Name the integration: Enter a unique and meaningful name.
Enter credentials: Paste the Client ID, Client Secret, and Base URL you copied earlier.
Set the Token URL: Enter the OAuth2 token URL for your CrowdStrike region. To find your region, check the URL in your browser after logging into the Falcon Console.
(Optional) Event filters: Enter a JSON object to filter ingested events by any supported field.
Select routing destination: Choose where events will be sent:
- Workflows
- Auto Triage
(Optional) Conditional filters: Add one or more field-based conditions to control which events are ingested. See Conditional filters below.
Finalize: Click Add.

Region	Token URL
US-1	`https://api.crowdstrike.com/oauth2/token`
US-2	`https://api.us-2.crowdstrike.com/oauth2/token`
EU-1	`https://api.eu-1.crowdstrike.com/oauth2/token`
US Gov	`https://api.laggar.gcw.crowdstrike.com/oauth2/token`

Conditional filters

Conditional filters limit which events are ingested from the connector. Only events that match all defined conditions are passed, reducing noise and preserving ingestion quota.

Each condition consists of a field reference and an operator. Some operators require an additional value. Conditions are joined by AND or OR logic, selected when adding each new condition.

Add a condition

Use conditional filters to control which events are processed based on field values.

Add a condition row: In the Conditional filters section, click +, then select AND or OR to define how the condition relates to the previous one.
Enter a field reference: In the left input, enter a field reference, for example
{{ $.event.SeverityName }}.
Select an operator: Choose an operator from the dropdown. Available operators: Equals, Not Equals, Is In, Is Not In, Contains, Not Contains, Regex Match, Regex Not Match, Is Empty, Not Empty.
Enter a value: If the operator requires a value, enter it in the field below, for example ["High", "Critical"].

To remove a condition, click the Delete icon on the right of the condition row.

Example

The following configuration ingests only endpoint detections where SeverityName is not empty, and its value is High or Critical:

{{ $.event.metadata.eventType }} Equals DetectionSummaryEvent
AND {{ $.event.SeverityName }} : Not Empty
AND {{ $.event.SeverityName }} Is In ["High", "Critical"]

Default severity ingestion

By default, the CrowdStrike Streaming data connector ingests only High and Critical severity events. Events below that threshold (Medium, Low, Informational) are filtered out before reaching Auto Triage, keeping your workflows focused on events that warrant action. These defaults can be adjusted per connection instance if you need to raise or lower the severity threshold for a specific source.

Default: High and Critical

The following event types are ingested when their severity is High or Critical.

Event type	Description
Endpoint detections	Detections from Falcon's endpoint protection (EPP)
Incident summaries	Correlated groups of related detections
Hash spreading	A known-malicious file spreading across your environment
Custom IOC matches	Matches against your own indicators of compromise
Identity detections	Identity threat detections (IDP)
Recon alerts	Brand and external exposure monitoring alerts
Mobile detections	Detections from Falcon for Mobile
Data protection detections	Data loss and exfiltration detections

Exceptions: High only

Three event types ingest High severity only. Critical is not applied because these sources do not emit a Critical tier.

Event type	Description
Identity protection events	Real-time identity protection signals
Cloud posture (CSPM) findings	Cloud security posture misconfigurations
Cloud indicators of attack (IOA)	Behavioral attack indicators in cloud environments