1. In the Falcon console, go to Next-Gen SIEM > Log management > Data onboarding.

2. Select Add Connection.

3. Find and select the Lumu Defender Connector. You can use the Filter by Connector Name search box and type Lumu and apply the filter for a quick lookup.

4. Then, select Configure in the Lumu Defender Connector modal.

5. Fill in the required data as follows:

• Under Connection name, set your preferred name for the data connection.
  
• Enter a connector description if needed.
• For Data timezone, ensure UTC +00:00 is selected.
• Leave the Enable host enrichment option checked.
• Confirm the CrowdStrike terms and conditions.
  
• When finished, click Create connection.
  

6. After creating the connector, a confirmation box will appear. Close it.

7. Click Generate API Key.

8. Make sure to collect the URL and API Key information in this window. Save these values; they will be used during the Integration Setup step.

Having completed these steps, you can proceed to configure the integration in the Lumu Portal.

Integration Setup - Lumu portal

This section describes the steps you must complete on the Lumu portal to properly set up the CrowdStrike Falcon® Next-Gen SIEM integration. To start, log in to your Lumu account through the Lumu Portal.

1. In the Lumu Portal, head to the panel on the left and go to Integrations > Apps.

2. Go to the Available Apps tab and select the SecOps option.

3. Locate the CrowdStrike Falcon® Next-Gen SIEM integration and click Add.

4. Review the detailed description provided for the app to understand the integration, and click Activate to proceed with the activation.

5. Type the name and choose the Lumu events you want to ingest. Note that the New Incident event is always selected and sent. Once you have selected the desired events, click Next.

6. Enter the URL and API Key you saved earlier under URL and Token, respectively. Then, click Activate.

7. Once the integration is activated, you will see details of the created integration.

Deleting the Lumu Defender Connector will result in the integration going offline. We recommend avoiding deletion unless necessary. Alternatively, you can edit the token if needed.You can find the injected events in Next-Gen SIEM > Advanced event search. Lumu detections will be displayed in the CrowdStrike Falcon Next-Gen SIEM Unified Detection portal. 

Next steps

Once the integration is activated, you can find the injected events, including detections, in the following CrowdStrike Falcon® NG-SIEM sections:

1. Unified detections: Lumu-reported detections will be included as part of CrowdStrike Falcon® endpoint detections.
2. Advanced search: Lumu events and detections can be searched among the CrowdStrike Falcon® NG-SIEM collected events.
   

Unified detections

To check Lumu-reported detections within your CrowdStrike Falcon® Next Gen console, click the hamburger menu at the top right side of your screen. Then, head to the Next-Gen SIEM > Detections section.

Lumu detections will be displayed alongside CrowdStrike Falcon® Endpoint detections. You can use the Source product filter as well.

Advanced Search

Events reported by the Lumu integration, operative and alert events, can be found through the Advanced Search module. You can find this module under the Next-Gen SIEM > Log Management section. 

You can use the following string to search for Lumu events reported to your CrowdStrike Falcon® NG-SIEM console.

@sourcetype = "lumu-defender"

Select the appropriate time interval and run your search. Your results should look as follows: