# CrowdStrike Falcon Next-Gen SIEM

### Overview

Keeper supports event streaming into CrowdStrike Next-Gen SIEM. External logging is real-time, and new events will appear almost immediately. Setup instructions are below.

{% stepper %}
{% step %}

### Add the Data Connector

* From the CrowdStrike dashboard, visit the Data onboarding > Data Connectors screen.
* Select "+ Add connection" and search for Keeper
* Click "Configure", assign a name, and then "Create connection".

<figure><img src="https://4290574019-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LO5CAzpxoaEquZJBpYz%2Fuploads%2FTGreyHTRn07Z3QK06HQz%2FScreenshot%202025-07-04%20at%203.38.31%E2%80%AFPM.png?alt=media&#x26;token=cf2d5052-bdb0-4b66-a6e8-41956edf8ed0" alt=""><figcaption><p>Data connectors</p></figcaption></figure>

<figure><img src="https://4290574019-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LO5CAzpxoaEquZJBpYz%2Fuploads%2F8S4KW7bRb6ObOShWUYot%2FScreenshot%202025-07-04%20at%203.38.58%E2%80%AFPM.png?alt=media&#x26;token=50103d6e-4475-452b-b278-ada9d5a88db8" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4290574019-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LO5CAzpxoaEquZJBpYz%2Fuploads%2FXUf20SPlGfDrMjMkBC1h%2FScreenshot%202025-07-04%20at%203.39.24%E2%80%AFPM.png?alt=media&#x26;token=b7c95e09-654a-4d25-9e61-5618aa73980c" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

### Create the API Key

* From the Data Connector screen, in the Keeper row click the overflow menu and then "Generate API Key".
* Save the `API Key` and `API URL` for the next step.

<figure><img src="https://4290574019-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LO5CAzpxoaEquZJBpYz%2Fuploads%2FVMWMmI3R3a01tFH9udb0%2FScreenshot%202025-07-04%20at%203.39.59%E2%80%AFPM.png?alt=media&#x26;token=d6aef4f3-0bf1-41ae-930e-46665b8c7338" alt=""><figcaption><p>Create API Key</p></figcaption></figure>

<figure><img src="https://4290574019-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LO5CAzpxoaEquZJBpYz%2Fuploads%2Fxm8goKGo6MbUwa1n1DpI%2FScreenshot%202025-07-04%20at%203.40.13%E2%80%AFPM.png?alt=media&#x26;token=181e312b-8958-49f2-9c3a-4151ee979ab3" alt=""><figcaption><p>Copy the API Key and API URL</p></figcaption></figure>
{% endstep %}

{% step %}

### Activate the Integration

* From the **Keeper Admin Console**, go to **Reporting & Alerts** > **External Logging**
* Select **CrowdStrike Falcon Next-Gen SIEM**
* Provide the `API Key` and `API URL` from Step 2.
* Click **Test** and then **Save**.
  {% endstep %}
  {% endstepper %}

### Setup Complete!

When SIEM logs are sent from Keeper to CrowdStrike, the data will begin to populate in the "Third Party" source within a few minutes.

<figure><img src="https://4290574019-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LO5CAzpxoaEquZJBpYz%2Fuploads%2FzLChJFhvo3RwE3os7EOI%2FScreenshot%202025-07-04%20at%204.04.44%E2%80%AFPM.png?alt=media&#x26;token=224fa601-2a07-476a-8812-31f0d2ae491e" alt=""><figcaption><p>Event Logs in Crowdstrike</p></figcaption></figure>
