Files.com keeps a record of everything that happens to your files: every login, upload, download, permission change, and automation run. This integration sends that record into CrowdStrike Next-Gen SIEM as it happens, so file activity is searchable next to the endpoint, identity, and threat-intelligence data your team already correlates in Falcon.
Your security team already runs detections on endpoint, identity, and network data in Falcon. File movement is usually the gap — partner SFTP sessions and transfers of regulated data happen inside the file platform, where the sensor can't see them. Files.com closes that gap by sending its own activity into Next-Gen SIEM.
Files.com sends a record of every login, upload, download, permission change, automation run, and API call into CrowdStrike the moment it happens. File activity lands alongside the endpoint, identity, and threat-intelligence data your team already watches in Falcon, so a suspicious transfer correlates with what the endpoint was doing at the same moment.
Files.com delivers events in JSON over HTTP to CrowdStrike's HEC-compatible ingestion endpoint — the path Next-Gen SIEM is built to receive on. There is no collector, forwarder, or middleware to install and keep running.
Every log type is enabled by default, and you can trim the stream per CrowdStrike instance — send everything, or just the types your detections use. The selection lives in Files.com, so changing it never touches your Falcon configuration.
Every event sent to CrowdStrike comes from the immutable Files.com audit log. If an investigation needs the original record, it's there — unaltered and retained for years, independent of what your SIEM keeps.
CrowdStrike reads the events. It doesn't decide who can touch which files or keep the record of what they did. Files.com does that part: access folder by folder, every action written to a record that can't be changed, and the same company logins your team already uses. That record is exactly what gets sent to Falcon.
Files.com controls access folder by folder, per user, group, and partner. CrowdStrike sees the events; Files.com is the control that decides who could touch the file in the first place.
Every file action, session, and settings change is written to an audit log that can't be altered. That record is the source feeding your Falcon environment.
Files.com plugs into your SSO and identity provider, so the usernames in the events CrowdStrike ingests match the identities the rest of your security stack already tracks.
The stream to CrowdStrike is encrypted and authenticated with your connector token. Files.com also logs the act of sending, so a failed delivery is visible instead of silent.
The main path. Files.com sends each event to your CrowdStrike HEC endpoint the moment it happens, so detections and dashboards run on file activity in near real time. SIEM streaming is an Enterprise-plan feature.
Files.com can also write log files to a folder on a schedule, from every 5 minutes up to every 6 hours. Useful for batch ingestion, locked-down networks, or keeping a long-term archive alongside the live feed.
A user downloads an unusual volume of files and, minutes later, an endpoint starts behaving strangely. Because file events and Falcon telemetry live in the same place, one detection rule sees both — instead of two teams each holding half the story.
After a compromised credential, your team searches CrowdStrike for every file the account touched: uploads, downloads, links opened, permissions changed. Every event traces back to the tamper-proof Files.com record.
Write detection rules and dashboards in Next-Gen SIEM that include Files.com activity — failed partner logins, off-hours transfers, mass deletions — scored and triaged in the same queue as the rest of your alerts.
The 7+ year record that can't be altered. It is the trustworthy source every event sent to CrowdStrike comes from.
Learn MoreEvery automation run is an event you can watch and alert on in CrowdStrike, so a job that breaks shows up instead of failing quietly.
Learn MoreThe same trustworthy record feeding CrowdStrike is the evidence a SOC 2, HIPAA, or GDPR review asks for.
Learn MoreWhat buyers ask about how Files.com connects to CrowdStrike, what it costs, and what the integration actually does.
Start a free 7-day trial. Create the HEC connector in Falcon, paste in the endpoint and token, and watch file activity land in Advanced Event Search. No credit card required.
No credit card required • 7-day free trial • Setup in minutes