Forwarding NordLayer logs to CrowdStrike via SIEM

This guide explains how to integrate CrowdStrike Falcon Next-Gen SIEM with NordLayer to enhance visibility and response capabilities. NordLayer Control Panel Actions and Network Connections logs are automatically forwarded to your CrowdStrike environment, enabling centralized monitoring and faster incident response.

Step 1. Initiate the setup in the NordLayer Control Panel

1. Log into the NordLayer Control Panel and click the Integrations tab on the left side.

2. Toggle on the CrowdStrike Falcon Next-Gen SIEM integration.

3. A window will open with the API URL and API Key you'll need to continue setup on the CrowdStrike dashboard.

Step 2. Continue the setup on CrowdStrike

1. Keep the NordLayer window open, and in a new tab, log in to the CrowdStrike Falcon portal.

2. Click the Next-Gen SIEM icon and go to Data onboarding.

3. Go to the Data connections tab and click Add connection.

4. Enter NordLayer in the search bar and select Nord Security NordLayer Data Connector.

5. Click Configure.

6. Fill in Connection name, Description, select appropriate checkboxes and click Create connection.

7. Confirm Connector creation notification.

8. Once creation is completed click the Generate API key on top right this window.

9. Copy the API URL and API Key.

Step 3. Finalize the setup

1. Return to the NordLayer Control Panel and paste both API URL and API Key.

2. Click Finish setup to complete the integration.

Note: In case you have any questions or issues, press 'Chat with support' at the bottom of the page.