Skip to main content

Agent 0.5.9 (Aug 2026)

New Features​

CrowdStrike source​

Added a CrowdStrike source that streams detections and audit events from the Falcon Event Streams API into your pipelines.

Authenticates with a Falcon API client using OAuth2 client credentials, then discovers and consumes the tenant's Event Streams datafeed.

  • Set endpoint to your regional Falcon API base (default https://api.us-2.crowdstrike.com).
  • app_id names this consumer to CrowdStrike and defines its read cursor: reusing the same app_id after a restart resumes from the last event consumed; a new app_id starts an independent consumer.