Enrich and Contextualize Data in Motion
Falcon Next-Gen SIEM and the CrowdStrike Falcon® platform already deliver powerful security context through CrowdStrike threat intelligence, Falcon platform telemetry, asset context, adversary attribution, and detection workflows. This context is critical to high-fidelity detection and fast investigation.
But security operations rarely happen in one place. Data also flows to lakes, archives, observability platforms, third-party analytics tools, and operational systems. In those environments, telemetry often arrives with less context, different field structures, or no clear connection to the users, assets, applications, or locations involved. Analysts then spend time reconciling data across systems.
Falcon Onum helps add context while telemetry is still moving. Using supported enrichment patterns such as HTTP requests, Redis, static lookup files, parsing, field tagging, math expressions, and conditional logic, teams can enrich and shape events before they are stored or routed downstream. This allows each destination to receive telemetry that is more complete and better prepared for investigation, automation, and AI-driven workflows.
One practical example is an Impossible Traveler pipeline. Falcon Onum can parse VPN login events, send public IPs to a GeoIP service through an HTTP request, use Redis to retrieve the user’s prior login location, calculate the distance and time between logins, and determine whether the travel speed is suspicious. If the activity exceeds a defined threshold, Falcon Onum can build an alert and route it to a destination such as Slack, a SIEM, or another response workflow.
This kind of in-motion enrichment turns raw telemetry into actionable context before downstream systems have to process it. Analysts and AI agents spend less time interpreting raw logs because detection, investigation, and automation workflows start with better inputs.
Route Once, Deliver Downstream Without Duplication
In most enterprises, multiple teams depend on the same telemetry. Without centralized control over the pipeline, organizations respond by duplicating collectors, maintaining separate transformation layers, and building parallel integrations for each destination. Falcon Onum establishes a single, policy-driven pipeline that governs how telemetry flows across the ecosystem.
Data is processed once in motion and then routed intentionally based on defined conditions, metadata, content, or compliance requirements. A full-fidelity stream can be delivered to Falcon Next-Gen SIEM for detection and response. A search-optimized stream can be delivered to CrowdStrike Falcon LogScale for high-volume exploration. Long-tail telemetry can be archived to object storage for low-cost retention and deep historical queries. In one global telecom environment, this same approach helped ensure downstream systems received the telemetry they needed, structured and enriched for this specific operational purpose.
Routing decisions are deterministic and enforceable. Conditional logic can direct events based on severity, source, asset tags, tenant identifiers, or content inspection results. Sensitive fields can be masked or removed selectively without altering the original source stream. Each output is built for its destination rather than copied indiscriminately.
Enable Distributed Investigation with Federated Search
Investigations span multiple data homes, and the friction shows up when data is inconsistent across destinations. Federated Search is built for this. It allows analysts to query data where it already lives, across the Falcon platform and external data stores, so investigations can extend to archived and third-party telemetry without re-ingesting or duplicating it.
Falcon Onum sets up distributed investigations by shaping and tagging telemetry consistently as it moves through the pipeline. High-signal streams flow into Falcon Next Gen SIEM. Search-friendly copies can land in Falcon LogScale. Falcon Onum preserves consistent identifiers, tags, and key fields across every tier so pivots and correlations hold together across hot and cold data.
Federated access is governed through Falcon Next-Gen SIEM permissions, with query behavior dependent on the external system’s cost and performance characteristics.
In the Falcon Onum and Federated Search demo, this comes to life as an investigation flow where the analyst stays in Falcon Next Gen SIEM, pulls in archived context when needed, and keeps the same fields to pivot intact across hot and cold data. That is what makes distributed investigation feel cohesive.
Shift Signal Control Left
Security outcomes depend on what enters the platform. When telemetry arrives noisy, incomplete, or late, every downstream system inherits the problem. Detections become less precise, investigations take longer, and automation becomes harder to trust.
Falcon Onum brings control forward in the process by applying lightweight decision logic while data is still in motion. Teams can filter known-benign events, suppress repetitive noise, tag high-priority activity, route suspicious events to the right destination, and preserve full-fidelity data where it is needed for investigation or compliance.
This does not replace detection and correlation in Falcon Next-Gen SIEM. It improves what reaches those systems. By shaping telemetry upstream, Falcon Onum helps Falcon Next-Gen SIEM, Falcon LogScale, AI workflows, analytics platforms, and compliance systems operate on higher-fidelity data that is fit for purpose.
Additional Resources
- Watch the AI SOC Summit on demand to learn how to unite data, agents, and humans to stop breaches at the speed of AI. Then take the Agentic SOC Readiness Self-Assessment to evaluate where your SOC stands today and how to move toward agentic security operations.
- Establish real-time telemetry control to streamline onboarding and route high-fidelity data across SIEM, AI, storage, and analytics with Falcon Onum.
- Want to learn more about Falcon Next-Gen SIEM for Third-Party EDR? Visit the Falcon Next-Gen SIEM for Third-Party EDR product page.
- Be part of Fal.Con 2026 and connect with 10,000+ cybersecurity professionals shaping the future of the industry.
