CrowdStrike Falcon

By integrating CrowdStrike Falcon with ThreatDefence via the Falcon OAuth2 API, you can seamlessly ingest endpoint detection data into ThreatDefence for centralized monitoring, and take containment actions on compromised hosts directly from the ThreatDefence platform.

This integration enhances visibility into:

• Falcon alerts and detections raised across your endpoint estate

• Incidents correlated by CrowdStrike from related detections

• Host inventory and endpoint details, including containment status

Beyond visibility, the integration also supports active response. With the appropriate permissions granted to the API client, ThreatDefence can isolate (network contain) a host and lift containment once the threat has been remediated, allowing analysts to stop an active compromise from spreading without leaving the platform.

Before you begin:

• You must log in to the Falcon console with an account holding the Falcon Administrator role - only that role can create API clients and grant API scopes.

• Decide up front whether you want visibility only or visibility plus host isolation. The scopes required differ, and adding scopes later requires editing the API client in Falcon.

• Note your Falcon cloud region, as it determines the API base URL used by the integration (see Step 1).

---

Step 1: Identify your Falcon cloud region

CrowdStrike hosts customers across several regional clouds, and the integration must point at the correct one.

1. Log in to the Falcon console

   • Go to https://falcon.crowdstrike.com with credentials that have the Falcon Administrator role.

2. Determine your region

   • The region is visible in the URL of your Falcon console and in Support and resources → API Clients and Keys, where the Base URL is displayed alongside your API clients.

Common base URLs:

Falcon cloud	Base URL
US-1	https://api.crowdstrike.com
US-2	https://api.us-2.crowdstrike.com
EU-1	https://api.eu-1.crowdstrike.com
US-GOV-1	https://api.laggar.gcw.crowdstrike.com

Note: Always use the Base URL shown in your own Falcon console. Using the wrong regional endpoint will cause authentication to fail even when the client credentials are correct.

Reference: Crowdstrike API Regionsl URLs

---

Step 2: Create an API Client

1. Navigate to API Clients and Keys:

   • In the Falcon UI, navigate to Support and resources > API Clients and Keys. Here, you can view existing clients, add new API clients, or view the audit log.

2. Add a New API Client:

   • Click on "Add new API Client" and provide a descriptive name for the client (e.g., "ThreatDefence Integration").

   • For Crowdstrike API integration, the following permissions are required.

     • Alerts: Read

     • Incidents: Read

3. Grant the required API scopes

   • Select the scopes below according to the capabilities you want to enable.

   API scope	Permission	Required?	Purpose
   Alerts	READ	Required	Ingest Falcon alerts and detections
   Incidents	READ	Required	Ingest CrowdStrike-correlated incidents
   Hosts	READ	Required	Search and list hosts, retrieve host details
   Hosts	WRITE	Required	Isolate a host (network contain) and lift containment
   Real Time Response	READ	Optional	RTR connectivity probe only

   Hosts: WRITE is what enables ThreatDefence to isolate hosts and lift containment. If this scope is not granted, the integration will still ingest data normally but host isolation will be unavailable.

   Real Time Response: READ is optional and used only to verify RTR connectivity — it does not grant ThreatDefence the ability to run RTR commands on your endpoints.

4. Save Client Information:

• After saving the new API client, you will be presented with the Client ID and Client Secret.

• The Client Secret will only be shown once and should be stored securely.

• In case the Client Secret is lost, a reset must be performed, and any applications relying on it will need to be updated with the new credentials.

---

Onboarding the integration

Please follow the Managing Integrations instructions and onboard the integration. The credentials saved above are required in this process.

If you encounter difficulties with onboarding, please email the following credentials to [e-mail]

• Client ID

• Client Secret

• Base URL