CrowdStrike to acquire Onum for Falcon SIEM AI data integration

CrowdStrike has announced its intention to acquire Onum, a company specialising in real-time telemetry pipeline management, with plans to integrate Onum's technology into the Falcon Next-Gen SIEM platform.

The acquisition is aimed at enhancing CrowdStrike's Falcon Next-Gen SIEM by providing a more robust data foundation for security and IT operations, with a particular focus on eliminating onboarding challenges and delivering autonomous threat detection capabilities.

Performance improvements

According to CrowdStrike, Onum brings advantages across speed, cost, and operational outcomes. Onum's platform processes security and observability data in real time, achieving up to five times more events per second than the nearest competitor. The press release states that real-time processing is achieved as opposed to traditional batch and store methods.

From a cost perspective, Onum's smart filtering technology is said to cut data storage costs by as much as 50 percent through intelligent optimisation. The platform's in-pipeline detection means incident response times are reduced by up to 70 percent and there is 40 percent less ingestion overhead before data even enters the Falcon platform.

Integration with Falcon

CrowdStrike describes the Next-Gen SIEM as the "engine that powers the modern SOC" with data being the key element enabling operations. George Kurtz, Chief Executive Officer and Founder of CrowdStrike, commented on the importance of the acquisition for the company's overarching strategy.

"Our Next-Gen SIEM is the engine that powers the modern SOC, and data is the fuel that makes the engine run. Onum is both a pipeline and a filter, which will stream high-quality, filtered data directly into the platform to drive autonomous cybersecurity at scale. This is how we stop breaches at the speed of AI while giving customers complete control over their entire data ecosystem – well beyond cybersecurity."

Falcon Next-Gen SIEM is positioned as a central element of CrowdStrike's platform, enabling customers to address complex security and IT observability needs. The integration of Onum is intended to support what the company describes as the transformation to an "AI SOC" by unlocking new capabilities and reducing costs and complexity.

Onum's capabilities

Onum's technology is built on a proprietary stateless, in-memory architecture, enabling improved speed and scalability for onboarding to Falcon Next-Gen SIEM. The platform allows customers to maintain control over their security and observability data, and brings AI-powered detections directly to third-party data sources through in-pipeline analysis. According to the statement, this starts detection before data even enters CrowdStrike's Falcon platform.

A previous challenge identified by CrowdStrike and industry participants was the friction involved in migrating data into a new SIEM platform, often leading to reliance on third-party tools. The integration of Onum in Falcon Next-Gen SIEM is aimed at eliminating such migration bottlenecks, enabling native data streaming and in-pipeline detection capabilities within the Falcon ecosystem.

Pedro Castillo, Founder and Chief Executive Officer of Onum, emphasised the company's founding vision and the scale of opportunity presented by the acquisition.

"Onum was founded on the belief that pipelines should do more than transport data, they should transform data into real-time intelligence. By joining CrowdStrike, we can deliver this vision at unprecedented scale to accelerate SOC transformation on a global scale. I'm incredibly proud of what our team has accomplished in defining real-time telemetry pipeline management, and we look forward to bringing that innovation to the Falcon platform."

Market context

CrowdStrike markets the Falcon platform as a cloud-native solution for managing enterprise cybersecurity risks, including endpoint protection, cloud workloads, identity, and data security. The stated advantage of the planned integration is in delivering more accurate detections and automated remediation supported by real-time indicators and threat intelligence within a single platform.

The combination of Onum's ingestion and processing capabilities with Falcon's existing platform architecture is positioned as a means to rapidly deploy and scale security operations while reducing operational complexity and costs.