Crowdstrike Logscale

CrowdStrike LogScale is a high-performance log management and observability platform designed for security operations, threat hunting, incident response, and real-time log analytics. Formerly known as Humio, LogScale provides organizations with the ability to ingest, index, search, and analyze massive volumes of log data and events at scale with sub-second query response times.

Category	SIEM
Direction	Query source
Sign-in	API Token
Query languages	STIX

Before you start

Huntbase signs in to Crowdstrike Logscale with API Token. Create the credential in Crowdstrike Logscale first, then keep it to hand for the Connect step.

1. In LogScale, open the repository list and select the repository Huntbase should search.
2. Click Settings, then select Tokens under Access Control.
3. Click + Add new, give the token a name, set an expiration if your policy allows it, and click Next.
4. Select only the Read data permission, click Create token, and copy the token string.

Permissions:

• Read data

Watch out for

• The token string is shown only once, when you create it.
• This connection expects the repository to hold CrowdStrike Falcon EDR detection logs in JSON format.

For the vendor's own instructions, see LogScale repository API token documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Crowdstrike Logscale

1. Go to Connections and click New connection, or click New connection on the Crowdstrike Logscale product page.
2. On Product, pick Crowdstrike Logscale and choose the Owner.
3. On Details, give the connection a Name and, optionally, a Description.
4. On Connect, fill in the settings and credentials described below.
5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings

Where your Crowdstrike Logscale lives:

Field	Required	Notes
Server Address	Yes	The hostname of your LogScale instance, without a path.
Repository	Yes	The name of the repository you created the token in. A repository token works only for its own repository.

Credentials

The only Method is API Token. Enter a Credential label (for example Production), then fill in:

Field	Required	Notes
API Token	Yes	The API token of a Repository to access the repository related API's. Secret — not shown again after you save it.

Query it

Once connected, Crowdstrike Logscale can serve these languages in a query tab, and Scout can use it when you ask in Auto:

Language	Use it for
STIX	STIX patterns for indicator sweeps, translated into the product's native search.

Next steps

• Connections — health, credentials and settings after you connect
• Query languages — syntax, parameters and time ranges
• Chatting with Scout — ask questions without writing a query
• All integrations — the rest of the catalog