CrowdStrike Falcon Event Stream connector

Important

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for CrowdStrike Falcon Event Stream from the Previews page. See Manage Azure Databricks previews.

The managed CrowdStrike Falcon Event Stream connector in Lakeflow Connect ingests Falcon Event Stream events from CrowdStrike Falcon into Azure Databricks.

Feature availability

Feature	Availability
UI-based pipeline authoring	Not supported
API-based pipeline authoring	Supported
Declarative Automation Bundles	Supported
Incremental ingestion	Supported
Unity Catalog governance	Supported
Orchestration using Databricks Workflows	Supported
API-based column selection and deselection	Supported
API-based row filtering	Not supported
SCD Type 2	Not supported
Automated schema evolution: New and deleted columns	Supported
Automated schema evolution: Data type changes	Not supported
Automated schema evolution: Column renames	Supported Treated as a new column (new name) and deleted column (old name).

Authentication methods

Authentication method	Availability
OAuth U2M	Not supported
OAuth M2M	Supported OAuth 2.0 client credentials from a CrowdStrike Falcon API client.
Basic authentication (username/password)	Not supported
Basic authentication (API key)	Not supported

What to know before you start

Note

Before starting, review the Azure Databricks user persona, supported interfaces, ingestion frequency, and common patterns.

Start ingesting from CrowdStrike Falcon

1. Configure CrowdStrike Falcon for ingestion (Admins). Set up CrowdStrike Falcon to authenticate with Azure Databricks.
2. Create a Unity Catalog connection (Admins). Create a connection in Catalog Explorer so non-admins can create pipelines.
3. Create an ingestion pipeline (Admins or non-admins). Select any supported interface and create a pipeline from an existing connection.