Skip to main content

SIEM Integration

Connect Microsoft Sentinel, Splunk, CrowdStrike via REST API.

SIEM Integration

CrownSync Playbooks integrates with Security Information and Event Management (SIEM) platforms through the REST API. This allows your SIEM to create incidents in CrownSync automatically when specific alerts or detection rules trigger, and to enrich SIEM alerts with incident status from CrownSync.

SIEM integration uses the same REST API and API keys as other programmatic integrations. The examples below show how to configure common SIEM platforms.

Microsoft Sentinel

Microsoft Sentinel can send incident data to CrownSync using Logic Apps or Automation Rules:

  1. In the Azure portal, create a new Logic App or Automation Rule triggered by Sentinel incident creation
  2. Add an HTTP action to POST to the CrownSync incidents endpoint: POST /api/v1/incidents
  3. Include your CrownSync API key in the Authorization: Bearer header
  4. Map Sentinel incident fields (title, severity, description) to the CrownSync request body
  5. Optionally configure a second HTTP action to poll CrownSync for status updates and write them back to Sentinel

Severity Mapping

Sentinel uses severity levels of High, Medium, Low, and Informational. Map these to CrownSync's Critical, High, Medium, and Low respectively. Informational alerts may not require a CrownSync incident — consider filtering these at the automation rule level.

Splunk

Splunk can integrate with CrownSync using Alert Actions or the Splunk SOAR platform:

  1. Create a Saved Search or Correlation Search that triggers on the conditions you want to escalate
  2. Add a Webhook Alert Action pointing to the CrownSync incidents endpoint
  3. Configure the webhook payload to include the alert details mapped to CrownSync incident fields
  4. Include the API key in the webhook headers

For Splunk SOAR (formerly Phantom), create a playbook that calls the CrownSync API using the HTTP app to create and update incidents based on SOAR case lifecycle events.

CrowdStrike Falcon

CrowdStrike Falcon can push detection events to CrownSync using Falcon Fusion workflows:

  1. In the CrowdStrike console, navigate to Fusion → Workflows
  2. Create a new workflow triggered by detection events
  3. Add an HTTP Request action configured to POST to the CrownSync API
  4. Map CrowdStrike detection severity and details to CrownSync incident fields
  5. Include your CrownSync API key in the authorisation header

Generic HTTP Integration

Any SIEM or security tool that supports outbound HTTP requests can integrate with CrownSync Playbooks. The general pattern is:

  1. Configure an alert action or automation rule in your SIEM that triggers on the desired conditions
  2. Send an HTTP POST to https://pb.crownsync.uk/api/v1/incidents
  3. Include Authorization: Bearer YOUR_API_KEY in the headers
  4. Set the Content-Type header to application/json
  5. Send the incident data in the request body (see the API Reference for the full schema)

Information

The CrownSync API enforces rate limits to prevent abuse. See the API Reference for current rate limit details. SIEM integrations that generate high volumes of alerts should implement filtering to avoid exceeding these limits.

Integration instructions last verified: April 2026

Was this page helpful?