Cybersecurity
CrowdStrike Expands Federal SOC Modernization via CISA-Funded SIEMaaS
CrowdStrike’s Falcon Next‑Gen SIEM has been added to CISA’s SIEMaaS stack, giving eligible federal agencies a funded route to upgrade their SOCs through the CDM DEFEND F shared service. The integration enables agencies to ingest, correlate, and act on security telemetry at scale while leveraging CrowdStrike’s detection engine. Defenders should review eligibility, apply for funding, and integrate the SIEM into their existing Falcon platform.
What Happened
On Oct 1 2026 CrowdStrike announced that its Falcon Next‑Gen SIEM will join the CISA‑funded SIEMaaS technology stack, providing a turnkey, cloud‑native SIEM that can be deployed with federal funding through the CDM DEFEND F shared service.
Impact
Eligible federal agencies participating in the CDM program can now modernize their SOCs without the upfront capital typically required for SIEM deployments. The SIEM ingests logs from Falcon, Azure Sentinel, Splunk, and other sources, delivering unified visibility and automated threat response.
What Defenders Should Do
- Verify agency eligibility under the CDM DEFEND F program.
- Apply for CISA funding through the SIEMaaS portal.
- Integrate Falcon Next‑Gen SIEM into the existing Falcon XDR stack.
- Configure data connectors for on‑prem, cloud, and SaaS sources.
- Leverage built‑in playbooks to automate triage and containment.
Next Steps
Defenders should monitor the CISA SIEMaaS rollout schedule, attend the upcoming training webinars, and test the SIEM’s alerting against known ATT&CK techniques. The integration also supports future AI‑driven detection enhancements announced by CrowdStrike.
Related articles
CrowdStrike Unveils Agentic SOC: AI‑Driven Threat Detection and Response
CrowdStrike has launched the next generation of its Agentic SOC, embedding AI reasoning and on‑device classification into Falcon. The update equips SecOps teams with automated triage, real‑time data labeling, and Claude‑powered audit insights. Defenders should upgrade to Falcon 10.5, enable the Agentic SOC bundle, and review new AI‑driven playbooks.
Read briefing
CrowdStrike Unveils Agentic SOC Enhancements: AI‑Driven Triage and Zero‑Trust Browser Security
CrowdStrike has released new Agentic SOC capabilities that use on‑device AI to accelerate detection triage, integrate Claude for audit data ingestion, and launch Falcon Secure Access to enforce zero‑trust browser policies. These updates aim to reduce analyst burden and improve response times for Falcon XDR users.
Read briefing
CrowdStrike & Anthropic Partner to Strengthen AI‑Driven Defense for Critical Infrastructure
CrowdStrike and Anthropic have joined forces to embed Anthropic’s Claude model into the Falcon platform, giving critical infrastructure operators AI‑enhanced continuous authorization and threat detection. The move expands Falcon’s endpoint coverage to OT devices and introduces Agentic SOC capabilities for faster triage. Defenders should update deployments, enable the new AI features, and revise playbooks to leverage real‑time risk scoring.
Read briefing
CrowdStrike & NVIDIA Launch Open Agent Safety Platform to Secure AI Stack
CrowdStrike and NVIDIA have released the NVIDIA Open Agent Safety Platform, an open reference design that embeds security controls deeper into autonomous AI agents. The platform extends Falcon’s agentic SOC capabilities, tightening boundaries for AI workloads and providing defenders with new monitoring and enforcement hooks. Defenders should integrate the reference design into their AI pipelines, enforce policy checks, and update Falcon to leverage the new safety controls.
Read briefing