New feature
Beta
CrowdStrike Falcon Event Stream connector
CrowdStrike Falcon Event Stream connector is a Databricks data engineering capability, introduced September 2026.
A managed Lakeflow Connect connector that ingests Falcon Event Stream events from CrowdStrike Falcon into Databricks, authenticated with OAuth 2.0 client credentials.
- No time travel on day one: with no checkpoint it starts the Event Stream feed at offset 0 and does not backfill a multi-day history.
- The Base URL is fussy - a bare https:// API hostname, and adding /sensors or any other path breaks it.
- One table, events - detections, hosts and Falcon Data Replicator stay on the CrowdStrike side.
Limitations: In Beta, switched on from the Previews page. Ingests only the events table, with no SCD Type 2 and no historical backfill (a new feed starts at offset 0). The connection Base URL must be a bare API hostname with no path.
Open in REbricked →- Category
- Data engineering
- Also known as
- CrowdStrike Falcon Event Stream, CrowdStrike Falcon, Falcon Event Stream, Lakeflow Connect for CrowdStrike Falcon Event Stream
- Verified
- 2026-10-20
Sources
- Official Official Databricks / Microsoft docs
- Official Databricks release notes: CrowdStrike Falcon Event Stream connector (Beta) (September 28, 2026)
- Official Databricks docs: Configure authentication to CrowdStrike Falcon
- Official Databricks docs: CrowdStrike Falcon Event Stream connector limitations