> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/endpoint-protection/crowdstrike.md). # CrowdStrike Falcon By integrating CrowdStrike Falcon with ThreatDefence via the Falcon OAuth2 API, you can seamlessly ingest endpoint detection data into ThreatDefence for centralized monitoring, and take containment actions on compromised hosts directly from the ThreatDefence platform. This integration enhances visibility into: * Falcon alerts and detections raised across your endpoint estate * Incidents correlated by CrowdStrike from related detections * Host inventory and endpoint details, including containment status Beyond visibility, the integration also supports **active response**. With the appropriate permissions granted to the API client, ThreatDefence can **isolate (network contain) a host** and **lift containment** once the threat has been remediated, allowing analysts to stop an active compromise from spreading without leaving the platform. {% hint style="info" %} **Before you begin:** * You must log in to the Falcon console with an account holding the **Falcon Administrator** role - only that role can create API clients and grant API scopes. * Decide up front whether you want **visibility only** or **visibility plus host isolation**. The scopes required differ, and adding scopes later requires editing the API client in Falcon. * Note your Falcon **cloud region**, as it determines the API base URL used by the integration (see Step 1). {% endhint %} *** ## Step 1: Identify your Falcon cloud region CrowdStrike hosts customers across several regional clouds, and the integration must point at the correct one. 1. **Log in to the Falcon console** * Go to [https://falcon.crowdstrike.com](https://falcon.crowdstrike.com/) with credentials that have the **Falcon Administrator** role. 2. **Determine your region** * The region is visible in the URL of your Falcon console and in **Support and resources → API Clients and Keys**, where the **Base URL** is displayed alongside your API clients. Common base URLs: | Falcon cloud | Base URL | | ------------ | ---------------------------------------- | | US-1 | `https://api.crowdstrike.com` | | US-2 | `https://api.us-2.crowdstrike.com` | | EU-1 | `https://api.eu-1.crowdstrike.com` | | US-GOV-1 | `https://api.laggar.gcw.crowdstrike.com` | {% hint style="info" %} **Note:** Always use the Base URL shown in your own Falcon console. Using the wrong regional endpoint will cause authentication to fail even when the client credentials are correct. Reference: [Crowdstrike API Regionsl URLs](https://developer.crowdstrike.com/falcon-mcp/getting-started/credentials/#api-region-urls) {% endhint %} *** ## **Step 2: Create an API Client** 1. **Navigate to API Clients and Keys**: * In the Falcon UI, navigate to Support and resources > API Clients and Keys. Here, you can view existing clients, add new API clients, or view the audit log.\ ![Crowdstrike Customer Portal Data Connectors API Client & Keys](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-4676ea13d928740ff66e8dc44632caa942c3cbbd%2Fapiclientkeys.png?alt=media) 2. **Add a New API Client**: * Click on "Add new API Client" and provide a descriptive name for the client (e.g., `"ThreatDefence Integration"`).\ ![Create API client button](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-bba76cc2f93384460f67ff27ed672f0a73407cab%2Fnewapiclient.png?alt=media) * For Crowdstrike API integration, the following permissions are required. * **Alerts: Read** * **Incidents: Read** 3. **Grant the required API scopes** * Select the scopes below according to the capabilities you want to enable.
API scopePermissionRequired?Purpose
AlertsREADRequiredIngest Falcon alerts and detections
IncidentsREADRequiredIngest CrowdStrike-correlated incidents
HostsREADRequiredSearch and list hosts, retrieve host details
HostsWRITERequiredIsolate a host (network contain) and lift containment
Real Time ResponseREADOptionalRTR connectivity probe only

Hosts: WRITE is what enables ThreatDefence to isolate hosts and lift containment. If this scope is not granted, the integration will still ingest data normally but host isolation will be unavailable.

Real Time Response: READ is optional and used only to verify RTR connectivity — it does not grant ThreatDefence the ability to run RTR commands on your endpoints.

4. **Save Client Information**: * After saving the new API client, you will be presented with the Client ID and Client Secret. * The Client Secret will only be shown once and should be stored securely. * In case the Client Secret is lost, a reset must be performed, and any applications relying on it will need to be updated with the new credentials.\ ![API client created](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-b33b6ae4f3e7caed6eb500aa12154d320126d826%2Fclientcreated.png?alt=media) *** ## Onboarding the integration Please follow the [Managing Integrations](/platform-management/managing-integrations.md) instructions and onboard the integration. The credentials saved above are required in this process. If you encounter difficulties with onboarding, please email the following credentials to * Client ID * Client Secret * Base URL --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.threatdefence.com/siem-integrations/endpoint-protection/crowdstrike.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.