CrowdStrike Falcon Next-Gen SIEM

Your SIEM is only as good as the data it receives. Falcon Next-Gen SIEM is exceptional at correlating signals across your environment, but credentials stolen in third-party breaches, malware infections, and successful phishes never touch your network. The SpyCloud Workforce Threat Protection/Employee ATO Prevention Data Connector puts pre-attack identity intelligence where your team already works.

It continuously delivers recaptured exposure data from the criminal underground - breaches, infostealer malware logs, phishing kits, and combolists - directly into Advanced Event Search, parsed and host-enriched alongside every other Falcon signal. Your analysts can see compromised employee credentials weeks before they're weaponized, without changing a single thing about how they investigate.

🚀 What you get

• Breach Watchlist Events: Alerts when monitored users or domains appear in SpyCloud's recaptured breach, malware log, or phishing data, which is the earliest available signal of credential compromise before it is used in an attack.
• Breach Catalog Events: Threat intelligence on newly discovered breaches, enriched with malware family, infected device details, severity scoring, and plaintext password data for proactive hunting and investigation enrichment without leaving the Falcon console.

📋 Requirements

CrowdStrike

SpyCloud

🔧 Setup

Step 1: Retrieve your SpyCloud API key

1. In the SpyCloud portal, navigate to API at portal.spycloud.com/api.
2. Copy your API Key.
3. Confirm your Watchlist is populated at portal.spycloud.com/watchlist.

Step 2: Configure and activate the SpyCloud Workforce Threat Protection/Employee ATO Prevention Data Connector in Falcon

1. In the Falcon console, go to Next-Gen SIEM › Log management › Data onboarding.
2. Click + Add connection.
3. On the Data Connectors page, search for and select SpyCloud Workforce Threat Protection/Employee ATO Prevention Data Connector.
4. In the New connection dialog, review the connector metadata, version, and description. Click Configure to open the New Connection details page.

5. Enter a name and optional description for this connection.
6. In Source Configuration, select the sources to ingest:
   • Breach Catalog: Threat intelligence on newly discovered breaches
   • Breach Watchlist: Credential exposure events for monitored domains and users

7. To add a new data source configuration, click Manage.
8. Click to accept the terms and conditions, then click Add configuration and enter the following:
   • Configuration name: SpyCloud-Workforce-Threat-Protection
   • Base URL: api.spycloud.com
   • Access Key: [YOUR SPYCLOUD API KEY]
9. Click Save configuration and close the configuration windows.
10. From the Data source configuration dropdown, select the configuration you just created.
11. In Parsing and enrichment, the default parser and host enrichment are pre-selected and enabled by default.
    • To use a custom parser, check Enable parser selection and accept the terms.
    • To disable host enrichment, uncheck Enable host enrichment.
12. Review the terms and conditions and select the checkbox to agree.
13. Click Create Connection.

Step 3: Verify data ingestion

To verify that data is being ingested and appears in the Next-Gen SIEM search results, follow these steps:

1. In the Falcon console, go to Data connectors › Data connectors › Data connections.
2. Confirm the Status column shows Active.
3. In the Actions column, click Open menu › Show events to see all events related to this data connection in Advanced Event Search. Confirm at least one match is generated.

To verify manually, run this query and confirm at least one match is generated:

#Vendor = "spycloud" | #event.module = "workforce-threat-protection"

🔎 Parser

The default parser recommended to parse incoming data for this connection is spycloud-workforcethreatprotection. This parser requires logs in JSON format.

Breach Watchlist event schema

{
  "document_id": "bw_12345678",
  "spycloud_publish_date": "2026-01-15T10:30:45.123Z",
  "email": "[email protected]",
  "email_username": "user",
  "email_domain": "company.com",
  "severity": 25,
  "target_url": "https://compromised-site.com",
  "target_domain": "compromised-site.com",
  "ip_addresses": ["192.168.1.100"],
  "user_hostname": "DESKTOP-ABC123",
  "user_os": "Windows 10",
  "country_code": "US",
  "infected_time": "2026-01-10T08:15:30.000Z",
  "infected_path": "C:\\Users\\User\\AppData\\Local\\malware.exe",
  "malware_family": "InfoStealer",
  "password_type": "plaintext",
  "sighting": 3
}

Breach Catalog event schema

{
  "id": "bc_87654321",
  "spycloud_publish_date": "2026-01-15T12:00:00.000Z",
  "breach_category": "data_breach",
  "breach_main_category": "breach",
  "title": "Major E-commerce Site Breach",
  "description": "Large-scale breach affecting millions of user accounts",
  "site": "compromised-ecommerce.com",
  "num_records": 5000000,
  "confidence": 90,
  "tlp": "WHITE",
  "malware_family": "Stealer"
}

🛠️ Troubleshooting

📚 Resources

SpyCloud

• SpyCloud API Documentation
• SpyCloud Customer Portal — API Key & Watchlist Management
• Workforce Threat Protection — Product Page

CrowdStrike

• Falcon Next-Gen SIEM — Product Page