Omnissa Access CrowdStrike Integration

You can configure the CrowdStrike Falcon Next-Gen SIEM adapter in Omnissa Access to automatically stream Omnissa Access audit events to CrowdStrike in addition to the standard Omnissa Access analytics service.

Prerequisite: Configure an HTTP Event Collector (HEC) in CrowdStrike

When configuring an HTTP Event Collector (HEC) in CrowdStrike for use with Omnissa Access, note the following:

• Set the data type to JSON. You may need to create and assign a JSON parser.
• After you create the connector, click Generate API Key and copy the generated API key and API URL.

Note: The CrowdStrike UI may vary depending on your version. Refer to CrowdStrike Falcon LogScale documentation.

Configure the CrowdStrike integration in Omnissa Access

1. In the Omnissa Access Console, navigate to Integrations > SIEM.

2. Select the toggle to enable the CrowdStrike Falcon Next-Gen SIEM adapter.

   Note: Only one SIEM integration can be active at a time.

3. Configure the CrowdStrike Falcon Next-Gen SIEM adapter.

   Field	Description
   CrowdStrike Server URL	The URL of the configured CrowdStrike server.
   HEC Token	The HTTP Event Collector token generated previously.
   Public SSL Certificate	(Optional) If you are using a self-signed certificate, copy the public certificate here. Can be left blank if using a publicly trusted Root CA.

4. Select Configure.

Result

You can view and search the audit data in CrowdStrike.