Add Nozomi parser for CrowdStrike NG-SIEM

[nicoloereni]

Summary

This pull request adds a parser for Nozomi Networks data sent to CrowdStrike Next-Gen SIEM through the HEC / HTTP Event Connector.

The parser supports structured JSON events generated by Nozomi products and normalizes them according to the CrowdStrike Parsing Standard.

Supported datasets

• nozomi.alert
• nozomi.asset
• nozomi.node
• nozomi.vulnerability

Main changes

• Parses the HEC JSON envelope.
• Extracts the nested Nozomi payload.
• Normalizes common CPS and ECS fields.
• Adds dataset-specific mappings for alerts, assets, nodes, and vulnerabilities.
• Preserves relevant Nozomi-specific fields under the Vendor.* namespace.
• Adds fallback mappings when normalized fields are not present.
• Adds searchable metadata and related fields.

Breaking change

No.

This PR only adds a new parser and does not modify existing parsers or content.

Testing

The parser was validated by copying the content of the YAML script block into the CrowdStrike Next-Gen SIEM parser editor.

The following datasets were tested:

• Alerts
• Assets
• Nodes
• Vulnerabilities

The parser was also validated against the expected HEC envelope structure generated by the Nozomi integration.

Usage

1. Create a HEC / HTTP Event Connector in CrowdStrike Next-Gen SIEM.
2. Create a parser and paste the content of the YAML script block into the parser editor.
3. Associate the parser with the HEC connection.
4. Configure the Nozomi data exporter with the CrowdStrike HEC endpoint and API key.
5. Create one exporter configuration for each entity type that must be sent.

Additional notes

The parser is named Nozomi because it is intended to support events produced by multiple Nozomi Networks products, not only Vantage.

No additional documentation is included in this pull request.

[nicoloereni]

Hi @nlabadie-crwd
I’ve opened a pull request adding a new Nozomi parser for CrowdStrike Next-Gen SIEM.

Could you please review the PR and let me know whether the file location, YAML wrapper, naming, and parser structure are aligned with the repository conventions?

Thanks
Bests