Horizon3 links NodeZero to CrowdStrike Falcon SIEM

Horizon3 has launched an integration with CrowdStrike Falcon Next-Gen SIEM, allowing validated findings from Horizon3's NodeZero platform to flow into CrowdStrike's security information and event management system.

The integration lets security teams bring NodeZero findings into Falcon Next-Gen SIEM and use them alongside other security data during investigations. It gives security operations teams additional context by correlating validated exposure information with endpoint, identity, cloud and other telemetry.

Security teams often struggle to manage large volumes of data from across an organisation's technology estate. The new link addresses that by placing validated exposure findings within a broader investigation workflow, rather than leaving them in a separate testing or assessment tool.

NodeZero provides security findings and exposure data intended to highlight exploitable attack paths and remediation priorities. Feeding those findings into Falcon Next-Gen SIEM allows organisations to compare them with data already collected through security monitoring and incident response processes.

CrowdStrike's SIEM product is positioned as a platform that combines first-party and third-party data, threat intelligence, artificial intelligence and workflow automation for security operations. Within that environment, Horizon3's findings can now serve as another data source for analysts reviewing alerts, incidents and potential weaknesses.

Operational use

According to Horizon3, the integration supports three main uses: ingesting validated NodeZero findings into Falcon Next-Gen SIEM, correlating that exposure data with telemetry from across the environment, and incorporating the information into existing security operations workflows.

The approach reflects a wider cyber security trend of linking proactive testing data with defensive monitoring tools. Rather than treating attack-path validation as a standalone exercise, suppliers are increasingly feeding those findings directly into the day-to-day systems used by security analysts.

Horizon3 says more than 7,000 organisations use its products, including defence agencies, large enterprises, banks and healthcare providers. It describes NodeZero as a tool for autonomously testing defences, uncovering exploitable paths and verifying fixes.

The integration's availability through the CrowdStrike Marketplace also places Horizon3 within CrowdStrike's broader partner ecosystem of third-party security products. Marketplace distribution can make it easier for joint customers to add integrations without building custom connections between tools.

The integration is available now through the CrowdStrike Marketplace.

"By combining NodeZero's offensive insights with CrowdStrike Falcon Next-Gen SIEM, security teams can rapidly identify coverage gaps, tune policies in real time, and verify fixes with confidence. This powerful synergy helps close the loop between proactive validation and runtime protection, helping organisations improve cyber resilience while maximising the value of their security investments," said Snehal Antani, Chief Executive Officer and Co-Founder, Horizon3.

CrowdStrike described the move as a way to add another stream of security information to existing investigations and prioritisation efforts, arguing that security operations are strongest when teams can work across multiple sources of information from their wider security environment.

"Security operations are most effective when teams can bring together data from across their security ecosystem. Making Horizon3 findings available within Falcon Next-Gen SIEM gives customers another source of security data they can incorporate into their existing security operations workflows, helping them investigate and prioritise proactive risk more efficiently," said Bernard.