In short: CrowdStrike Falcon Next-Gen SIEM is a security information and event management platform built into Falcon. It brings Falcon data together with third-party logs for fast search, detection, AI-assisted investigation and automated response. The add-on we supply includes 365-day retention, is licensed by the gigabyte, and has a Complete version managed by CrowdStrike.
What Falcon Next-Gen SIEM is
A SIEM collects logs from across your environment, keeps them searchable, and raises detections when patterns across those logs point to an attack. With many SIEMs, much of the effort goes into getting data in and keeping searches fast. Falcon Next-Gen SIEM takes a different route by building the SIEM into the Falcon platform.
Data from the Falcon modules you already license, such as endpoint and identity, is available natively; CrowdStrike states it comes in without additional ingestion charges and needs no connectors. Third-party sources, such as firewalls, Microsoft 365, cloud platforms and other security tools, are added alongside it. Search uses an index-free architecture designed for speed at scale, and Charlotte AI assists with triage, investigation and report summaries. Falcon Fusion no-code workflows automate response.
What it includes
| Capability | What it gives you |
|---|---|
| Next-generation SIEM | Detection, search and investigation across Falcon and third-party data |
| 365-day retention | A year of searchable log data, included in the add-on we supply |
| Native Falcon data | Endpoint, identity and other licensed Falcon data without re-ingestion |
| Third-party ingest | Logs from firewalls, cloud, SaaS and other tools |
| AI-assisted investigation | Charlotte AI triage, investigation and report summaries |
| Incident visualisation | Graphical view of how an incident unfolded across sources |
| Workflow automation | Falcon Fusion no-code workflows for response |
A year of retention matters for incident response, cyber insurance and regulatory obligations, where you may need to look back months to establish how an attacker first got in.
How it is licensed
Falcon Next-Gen SIEM is licensed by the gigabyte of data, and comes in two versions:
| Option | What you get | Term |
|---|---|---|
| Next-Gen SIEM with 365-day retention | The SIEM, run by your team, with a year of retention | Monthly, per gigabyte |
| Next-Gen SIEM Complete | The SIEM with CrowdStrike's Falcon Complete team monitoring and responding | Monthly, per gigabyte |
Sizing depends on which third-party sources you send and how much they log, so we estimate data volumes with you before quoting. Ask us for a quote.
Requirements and deployment
Next-Gen SIEM sits in the Falcon console, so if you already run Falcon there is no new platform to stand up. Third-party data is brought in through connectors and log collectors; CrowdStrike also offers a data pipeline product, Falcon Onum, to filter, transform and route data before it reaches the SIEM, which helps control volume.
We start by agreeing which sources give real security value, typically firewalls, identity providers, Microsoft 365 and key servers, then onboard them in stages and tune detections so alerts are meaningful.
Who it suits and how we help
Next-Gen SIEM suits organisations already running CrowdStrike that need central logging and correlation, often because an insurer, auditor or customer requires log retention and monitoring. The Complete version suits those who want that monitoring done for them alongside Falcon Complete Defend.
We size the licence, onboard your data sources, build dashboards and reports and handle licence changes as your data grows, all on one Forever Systems account. Compare options in EDR, XDR and MDR.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How is CrowdStrike Next-Gen SIEM licensed?
By the gigabyte of data, with 365-day retention included in the add-on we supply. There is a standard version run by your team and a Complete version managed by CrowdStrike.
Do I have to pay to ingest my Falcon endpoint data?
CrowdStrike states that data from licensed Falcon modules, such as endpoint and identity, comes into Next-Gen SIEM without an additional ingestion charge. Third-party data is what drives sizing.
Can Next-Gen SIEM ingest Microsoft 365 and firewall logs?
Yes. It ingests third-party security and IT data, such as firewall and Microsoft 365 logs, alongside Falcon data. We check the connectors for your specific sources and estimate their volumes before quoting.
What is Next-Gen SIEM Complete?
The Complete version adds CrowdStrike's Falcon Complete team monitoring and responding to detections in your SIEM, rather than your own team doing it.