Skip to main content

​
Overview

CrowdStrike Falcon can contribute normalized endpoint detections, malware findings, host context, and incident activity. Reviewed examples include:
  • detection.confirmed — detection confirmed
  • malware.detected — endpoint malware detections
  • incident.opened — incident opened
See how integration data becomes signals. To authenticate with CrowdStrike, you need:
  1. Client ID - A unique identifier for your API client.
  2. Client Secret - A confidential key used to authenticate the identity of the application (client).
  3. Base URL - The API base URL for your CrowdStrike cloud environment.
This guide will walk you through obtaining these credentials within CrowdStrike.

​
Prerequisites:

  • You must have access to the CrowdStrike Falcon console.

​
Instructions:

​
Step 1: Creating an API Client

  1. Log in to your CrowdStrike Falcon console.
  2. From the search toolbar, search for API Clients and Keys and select it.
  1. Click on Create API Client.
  1. Enter a Name and Description, select Alerts: Read and Hosts: Read scopes, and then click Create.
  2. Your Client ID, Client Secret, and Base URL will be displayed for you. The Base URL is the domain portion (e.g., api.crowdstrike.com) without the https:// prefix.

​
Step 2: Enter credentials in the Living Security Platform

Once you have your Client ID, Client Secret, and Base URL:
  1. Open the form where you need to authenticate with CrowdStrike.
  2. Enter your Base URL, Client ID, and Client Secret in their respective fields.
  3. Submit the form, and you should be successfully authenticated.
You are now connected to CrowdStrike.
Portions of this documentation are adapted from Nango, used under the Elastic License 2.0.

​
Network access

Skip this section unless your Falcon tenant restricts API access by source IP address. Most tenants do not.