You need to ingest data from a custom internal application hosted on-prem.

The correct answer is B. HTTP Event Connector .

CrowdStrike describes the HTTP Event Connector (HEC) as the generic mechanism used to bring third-party data into Falcon Next-Gen SIEM when you need to onboard logs from sources that are not tied to a specific cloud-native connector. CrowdStrike’s own Next-Gen SIEM materials highlight pre-built connectors and HTTP Event Collectors as the way to extend visibility to many different third-party sources.

Because this question describes a custom internal application hosted on-prem , the cloud-specific connectors in options A , C , and D do not fit. The broad, flexible connector option intended for custom or non-native sources is the HTTP Event Connector . Also, CrowdStrike’s vCenter example shows an architecture where logs are first centralized and then onboarded to Falcon Next-Gen SIEM through an HTTP Event Connector , which aligns with this kind of custom-source pattern.