No. Falcon Onum can be deployed independently to modernize telemetry pipelines, reduce data volume, improve signal quality, and optimize the broader security stack.

When used with Falcon Next-Gen-SIEM, Onum accelerates onboarding, enhances data control, enables intelligent data routing, and makes it easier to enrich data in motion.

As an independent solution, Falcon Onum operates as a high-performance, real-time data pipeline that collects, structures, enriches, and routes telemetry across your security and IT ecosystem. Onum provides:

• Real-time parsing and enrichment of logs in motion
• Noise reduction, filtering, masking, enrichment, and data shaping at the source
• Intelligent, multi-destination routing to SIEMs, data lakes, analytics tools, and storage
• Support for in-pipeline detections and transformations for non Falcon Next-Gen-SIEM destinations

In this mode, Falcon Onum gives teams fine-grained control over how telemetry moves across their environment, helping reduce cost, improve data quality, and accelerate downstream tools.

Falcon Onum works alongside both Falcon Next-Gen SIEM and Falcon Complete as a data control and routing layer, but the level of transformation allowed depends on the destination.

Falcon Next-Gen SIEM

• Falcon Onum handles the data control plane, with routing and PII masking into Falcon Next-Gen SIEM
• Falcon Onum sends raw, CrowdStrike Parsing Standard (CPS)-aligned events directly into Falcon Next-Gen SIEM for indexing and detection
• Falcon Onum enriches, filters, and reshapes telemetry before delivering optimized copies to secondary destinations such as data lakes, analytics tools, and third-party systems

Falcon Complete Next-Gen MDR

• Falcon Complete ingests sensor-native telemetry directly, and Onum does not modify or influence this ingest path
• Falcon Onum may process and route copies of telemetry to secondary destinations (storage, analytics, third-party SIEMs), applying masking, filtering, or enrichment only on those branches while preserving Falcon Complete’s full visibility and MDR efficacy

This joint architecture ensures fast onboarding, control over data flow, and full SIEM detection accuracy.

Falcon Onum can apply transformations for secondary destinations, including:

• Field-level masking and tokenization
• Enrichment (GeoIP, asset data, threat intelligence, tags)
• Filtering, suppression, and shaping
• Format normalization (JSON, KV, CSV, XML, and more)

For data flowing into Falcon Next-Gen SIEM, Onum supports:

• PII masking
• Selective routing and copying to cold storage
• Data hygiene actions that do not alter Falcon Next-Gen SIEM required CPS structure

This ensures customers gain upstream control while preserving Falcon Next-Gen SIEM detection logic.

Yes. Falcon Onum supports inline detections such as Sigma rule evaluation, IOC matching, and pattern-based triggers when routing to third-party destinations like data lakes, SOAR, observability tools, and external SIEMs.

When used with Falcon Next-Gen SIEM:

• Inline detections are supported only for non-Next-Gen SIEM routes, not for the Next-Gen SIEM ingestion path
• All Next-Gen SIEM detections are performed within Falcon Next-Gen SIEM using CPS-structured raw telemetry
• Falcon Onum can still route the detection results (tags, flags, metadata) to alternate destinations, while keeping Next-Gen SIEM data intact

This gives customers flexibility without impacting Falcon Next-Gen SIEM’s native detection pipeline.