BeyondTrust EPM, Password Safe, PRA Feed Falcon Next-Gen SIEM

BeyondTrust Pathfinder Adds EPM, Password Safe and PRA Feeds to Falcon Next-Gen SIEM​

VMblog carried the announcement and BeyondTrust's own press release matches it. BeyondTrust announced new integrations between solutions on the BeyondTrust Pathfinder Platform and CrowdStrike Falcon® Next-Gen SIEM. The integrations bring BeyondTrust's identity and privilege intelligence directly into the CrowdStrike Falcon® platform. The stated aim is to set identity relationships and privilege exposure beside Falcon's threat telemetry so investigations move faster. That covers human, non-human and AI-agent identities, and the release's closing paragraph adds workload identities.

The release lists three products and what each one sends:

This is a data integration. BeyondTrust describes visibility, correlation and investigation context. It does not claim the integration blocks identity attacks or triggers automatic remediation from inside Falcon. The release also leaves out supported product versions, licensing requirements, availability dates and field-level schemas for the three product feeds. Before you plan a deployment, get those details from your account team.

Why EPM Elevation and PRA Session Events Belong Next to Falcon Telemetry​

BeyondTrust's case rests on a familiar shift in attacker behaviour. Security teams are increasingly confronting attackers who gain access using legitimate, compromised credentials rather than traditional malware, making identity and privilege two of the most consequential risk surfaces in the enterprise. The company backs this with a figure from its own Phantom Labs research: roughly 75% of modern attack paths exploit identity relationships rather than software vulnerabilities alone. That number is a vendor research claim and no independent source has validated it. The underlying point is still sound. When an attacker logs in with valid credentials, an endpoint sensor sees mostly legitimate-looking activity.

This is where each feed helps. An EPM blocked-execution event recorded in the same time window as a Falcon endpoint detection tells the analyst that someone tried to run something with elevated rights and policy stopped it. An EPM policy change could mean an administrator loosened controls, or an attacker did. A PRA console authentication or configuration change can link a suspicious session on a server to the remote-access path it came through. These are the questions analysts usually answer by jumping between the SIEM and each vendor's console.

BeyondTrust's David Manks, vice president of strategic alliances, framed it this way: "By bringing BeyondTrust's identity and privilege intelligence into CrowdStrike Falcon, joint customers can connect privilege risk with threat activity". That describes the intended result. Whether it improves your investigations depends on your detection content and on how your analysts use the extra fields.

This fits CrowdStrike's broader strategy of making Next-Gen SIEM a destination for third-party data. The CrowdStrike Falcon Next-Gen SIEM ISV ecosystem allows security teams to seamlessly ingest, retain, search and analyze data from over 500 sources. Earlier this year the company also said that Falcon® Next-Gen SIEM now ingests and correlates Microsoft Defender for Endpoint telemetry. That is relevant for Windows shops running Defender alongside BeyondTrust. The privilege context from EPM could sit next to endpoint telemetry that did not come from a CrowdStrike sensor.

Several BeyondTrust-to-Falcon Connectors Were Already Live​

A "launch" framing suggests something brand new. The record is more mixed. The CrowdStrike Marketplace already lists a BeyondTrust Secure Remote Access Data Connector. It ingests configuration changes, console authentications, system events and session data, including user actions, and it requires Falcon Next-Gen SIEM. Those categories closely match what the press release attributes to PRA. The Marketplace uses the name "Secure Remote Access" and the announcement uses "Privileged Remote Access", so the listing supports the PRA data categories but does not prove the two are exactly the same package.

EPM also had an existing path. The Marketplace index includes a listing described as a way to easily ingest logs from BeyondTrust Endpoint Privilege Management into the Falcon Platform. The Identity Security Insights route goes back further. A CrowdStrike demonstration video from December 2024 shows that this integration allows BeyondTrust Identity Security Insights to forward detections to CrowdStrike Next-Gen SIEM using a pre-configured webhook template. That detail sits awkwardly beside the Identity Security Insights 26.09 release notes of September 15, 2026, which present Falcon forwarding as a new capability. The 26.09 release may formalize or productize something that previously existed as a documented webhook recipe. Either way, some teams already running these vendors may have part of this plumbing in place.

For buyers, the practical reading is this. The September announcement confirms a supported, named set of BeyondTrust feeds for Falcon Next-Gen SIEM across EPM, Password Safe and PRA, and points customers to the CrowdStrike Marketplace to find them. If you have already built a custom pipeline for any of these products, compare it with the official connector before replacing it.

How the Identity Security Insights 26.09 Webhook Gets Data Into Falcon​

The only fully documented setup procedure in the public record is for Identity Security Insights, BeyondTrust's correlation layer. It is not one of the three products named in the press release. Do not assume EPM, Password Safe or PRA use the same mechanism. The Marketplace describes the Secure Remote Access connector as a Falcon Data Connector, which suggests a different route. The Insights procedure does show what "integration" means in practice: it is a configured data path, not a single switch.

According to the 26.09 release notes, every forwarded event includes severity, incident type, affected entities, source address and location, timestamps, and a link back to the incident in Insights. BeyondTrust says Insights forwards analyzed detections and recommendations, not raw event streams.

Prerequisites​

• You need access to a site with the Insights app and an Identity Security Insights account with administrator privileges.
• You need a CrowdStrike Falcon account with Next-Gen SIEM enabled.
• Your CrowdStrike role must allow you to create parsers and data connectors.

Setup steps​

1. In CrowdStrike, go to Next-Gen SIEM > Data onboarding > Parsers and add a new parser, for example "BeyondTrust Identity Security Insights". Paste in the parser definition from BeyondTrust. It parses the JSON payload, reads the timestamp in UTC, tags the vendor as BeyondTrust, and normalizes each event as a detection-type alert. Validate it with the supplied test data and save.
2. In Next-Gen SIEM > Data onboarding, select HEC / HTTP Event Connector, give it a name, assign the parser from step 1, and save.
3. Copy the connector's API URL and API key. The API key is displayed only once, so store it securely before you leave the page.
4. In Insights, go to Integrations > Webhooks > Create Integration. Enter the connector's API URL as the webhook URL, choose Bearer as the authorization type, paste the API key as the token, and enter BeyondTrust's JSON webhook template.
5. Save the integration.

The parser's test data and the webhook template must share the same field structure. If you change one, change the other to match. Otherwise events will arrive in Falcon but won't parse as you expect.

Verifying delivery​

Edit the saved webhook and click Test Settings. If it works, Insights shows "Configuration successfully tested." If the test fails, BeyondTrust's guidance is to recheck every entry, especially the API URL and API key. Then search your third-party data in CrowdStrike for the source you configured and confirm the test event is present and searchable. Do this before you build any detection or response logic on top of the feed.

Once the webhook is set up, analysts can also push a single item on demand. Open a detection or recommendation in Insights, click Take Action, and select the CrowdStrike webhook. Insights then sends that item's context to Falcon.

Direct EPM, Password Safe and PRA Feeds Versus Insights: The Ingest Trade-off​

BeyondTrust's own documentation makes clear there are two ways to get its data into Falcon. According to the Insights setup guide, Insights correlates events across BeyondTrust products and identity providers before sending them. As a result it sends far fewer events than each BeyondTrust product sends when reporting to CrowdStrike directly.

This choice has operational consequences. A direct product feed from EPM or PRA gives you granular activity: individual elevation requests, blocked executions, console logins and session actions. That supports forensic timelines and custom detection rules. It also means more ingest volume, which affects SIEM cost. The Insights route gives you fewer, higher-level findings, each with a severity and a link back to the incident. That makes triage easier but provides less raw material for building your own rules.

The two approaches can be combined. A reasonable design, which is our inference and not something BeyondTrust prescribes, is to send Insights detections for analyst triage and add direct product feeds only where you need granular events, such as PRA session data for privileged access to production infrastructure. Neither vendor has published guidance on de-duplicating events when both paths run together.

What this means for Falcon and BeyondTrust shops​

Only organizations that already license both Falcon Next-Gen SIEM and at least one BeyondTrust Pathfinder product need to act. Nothing here matters to anyone else. Even for joint customers this is an opt-in project, not an update that applies itself. If you run BeyondTrust EPM, Password Safe or PRA and Falcon Next-Gen SIEM, the question is whether your analysts currently jump between consoles to answer "who had privilege and how did they get it" during investigations. If they do, these feeds are worth evaluating. If you already built a custom pipeline, compare it with the official Marketplace connector and don't assume you need to rebuild.

• Check the CrowdStrike Marketplace BeyondTrust listings first. A Secure Remote Access data connector and an EPM log-ingestion listing already exist, and BeyondTrust points customers there for the new integrations.
• Decide between direct product feeds and Identity Security Insights based on ingest budget and detection needs. BeyondTrust says Insights sends far fewer, pre-correlated events.
• Confirm your Falcon role can create parsers and data connectors before starting, since the documented Insights setup requires both.
• Store the HTTP Event Connector API key as soon as it is generated, because CrowdStrike shows it only once.
• Run the webhook test and then confirm the test event is searchable in Falcon's third-party data before you base any response process on it.
• Ask BeyondTrust for supported versions, licensing terms and event schemas for the EPM, Password Safe and PRA feeds, because the announcement does not include them.

This announcement gives joint customers a supported way to put privilege data where their SOC already works, and some of that plumbing was already available before the press release. For Falcon Next-Gen SIEM shops, the immediate job is practical: pick a feed, wire the connector, and verify the events are searchable. BeyondTrust ties the Falcon work to the Pathfinder capabilities it showed at Black Hat USA 2026, so expect more Pathfinder data types, especially for AI-agent and non-human identities, to appear as Marketplace connectors next.