> ## Documentation Index
> Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CrowdStrike Falcon integration setup

> Connect CrowdStrike Falcon to Living Security for endpoint detections, malware findings, hosts, and incidents.

export const EgressIpAllowlistBothSets = ({system}) => <Warning>
    <strong>{system} needs two sets of addresses, not one.</strong> Living Security mints this
    integration's access token on its own infrastructure and refreshes it continuously, so setup
    traffic and sync traffic leave from different networks. Allowlist both sets in {system}, and
    keep both in place — this is not a setup-only requirement.
    <br />
    <br />
    <strong>Integration sync traffic</strong> — the same in every region:
    <br />
    <code>52.34.139.153/32</code>, <code>54.69.127.183/32</code>, <code>44.247.133.183/32</code>,{' '}
    <code>52.26.211.56/32</code>
    <br />
    <br />
    <strong>Platform traffic</strong> — use only the row for the region that hosts your
    organization:
    <br />
    United States: <code>98.91.60.249/32</code>, <code>13.216.91.102/32</code>
    <br />
    European Union: <code>34.246.236.210/32</code>, <code>52.31.102.238/32</code>
    <br />
    <br />
    Allowlist only the sync set and setup never completes. Allowlist only the platform set and
    setup succeeds while every sync fails. See{' '}
    <a href="/integrations/managing/egress-ip-addresses">
      Configuring Integration Egress IP Addresses
    </a>{' '}
    for both failure signatures and the change policy.
  </Warning>;

export const PublicIntegrationNextSteps = () => <>
    <hr />
    <h2>Related resources</h2>
    <ul>
      <li>
        <a href="/signals/data-sources">Learn how integration data becomes Human Risk Management signals</a>
      </li>
      <li>
        <a href="https://www.livingsecurity.com/integrations">Explore Living Security integrations</a>
      </li>
      <li>
        <a href="https://app.livingsecurity.ai/">Open the Living Security Platform</a>
      </li>
      <li>
        <a href="https://www.livingsecurity.com/request-demo/">Request a Living Security demo</a>
      </li>
    </ul>
  </>;

# Overview

CrowdStrike Falcon can contribute normalized endpoint detections, malware findings, host context, and incident activity. Reviewed examples include:

* `detection.confirmed` — detection confirmed
* `malware.detected` — endpoint malware detections
* `incident.opened` — incident opened

See [how integration data becomes signals](/signals/data-sources).

To authenticate with CrowdStrike, you need:

1. **Client ID** - A unique identifier for your API client.
2. **Client Secret** - A confidential key used to authenticate the identity of the application (client).
3. **Base URL** - The API base URL for your CrowdStrike cloud environment.

This guide will walk you through obtaining these credentials within CrowdStrike.

### Prerequisites:

* You must have access to the CrowdStrike Falcon console.

### Instructions:

#### Step 1: Creating an API Client

1. Log in to your [CrowdStrike Falcon console](https://falcon.crowdstrike.com/).
2. From the search toolbar, search for **API Clients and Keys** and select it.

<img src="https://raw.githubusercontent.com/NangoHQ/nango/master/docs/integrations/all/crowdstrike/search.png" />

3. Click on **Create API Client**.

<img src="https://raw.githubusercontent.com/NangoHQ/nango/master/docs/integrations/all/crowdstrike/create_api_client.png" />

4. Enter a Name and Description, select **Alerts: Read** and **Hosts: Read** scopes, and then click **Create**.
5. Your **Client ID**, **Client Secret**, and **Base URL** will be displayed for you. The **Base URL** is the domain portion (e.g., `api.crowdstrike.com`) without the `https://` prefix.

<img src="https://raw.githubusercontent.com/NangoHQ/nango/master/docs/integrations/all/crowdstrike/credentials.png" />

#### Step 2: Enter credentials in the Living Security Platform

Once you have your **Client ID**, **Client Secret**, and **Base URL**:

1. Open the form where you need to authenticate with CrowdStrike.
2. Enter your **Base URL**, **Client ID**, and **Client Secret** in their respective fields.
3. Submit the form, and you should be successfully authenticated.

<img style={{maxWidth: "450px" }} src="https://mintcdn.com/livingsecurity/oVkrOMkYmNevekTI/integrations/images/crowdstrike/connect-dialog.png?fit=max&auto=format&n=oVkrOMkYmNevekTI&q=85&s=672bd99630a10a73b2a88c0554077588" className="connect-dialog-img" width="576" height="752" data-path="integrations/images/crowdstrike/connect-dialog.png" />

You are now connected to CrowdStrike.

***

<Note>Portions of this documentation are adapted from [Nango](https://nango.dev/docs/), used under the [Elastic License 2.0](https://github.com/NangoHQ/nango?tab=License-1-ov-file#readme).</Note>

## Network access

Skip this section unless your Falcon tenant restricts API access by source IP address. Most tenants do not.

<EgressIpAllowlistBothSets system="CrowdStrike Falcon" />

<PublicIntegrationNextSteps />