> For the complete documentation index, see [llms.txt](https://docs.oort.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.oort.io/integrations/crowdstrike.md).

# CrowdStrike Falcon

Cisco Identity Intelligence can integrate with CrowdStrike Falcon NGSIEM (Falcon LogScale) to retrieve log data created by CrowdStrike agents on endpoints. This article explains how to create the required CrowdStrike API client and connect it to Identity Intelligence.

{% hint style="warning" %}
The CrowdStrike integration is currently in Alpha and can only be enabled by the Identity Intelligence team. Please contact Support to have it enabled for your account.
{% endhint %}

### Overview

To connect CrowdStrike to Identity Intelligence:

1. Confirm that your CrowdStrike environment meets the [prerequisites](#prerequisites)
2. Create a dedicated Falcon API client with the required NGSIEM permissions and, if desired, MCP configuration file collection permissions and recommended read permissions for planned capabilities
3. Copy the API client ID and secret
4. Add the CrowdStrike integration in Identity Intelligence
5. Verify the connection and configure network allowlisting if required

### Prerequisites

Before you begin, make sure that:

* Your CrowdStrike environment has an active CrowdStrike **NGSIEM (Falcon LogScale)** license provisioned
* You have access to the **Falcon Console**
* You are a **Falcon administrator**, or have permission to manage Falcon API clients
* You have the necessary permissions to manage integrations in Identity Intelligence

#### Permissions

| Permissions                   | Required for                                 | Purpose                                                                                                                                                                                                                                                           |
| ----------------------------- | -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `NGSIEM:WRITE`                | All installations                            | <p>Required to send queries to the CrowdStrike cloud and retrieve relevant NGSIEM data<br><br>Submits the NGSIEM search job used to query endpoint logs. The <code>WRITE</code> label refers to creating the search job; it does not write files to endpoints</p> |
| `NGSIEM:READ`                 | All installations                            | <p>Allows the integration to read or query NGSIEM data and receive the query results<br><br>Polls and reads search-job results, including DNS-request and process-launch events used to identify relevant activity</p>                                            |
| **Real time response: Read**  | MCP configuration-file collection is enabled | Reads RTR session information and command results or status during file retrieval                                                                                                                                                                                 |
| **Real time response: Write** | MCP configuration-file collection is enabled | Executes the RTR `get` command to retrieve files from target endpoints                                                                                                                                                                                            |

The two NGSIEM scopes are the *minimum* required for NGSIEM collection. MCP configuration-file collection requires **both** Real time response scopes.

**Additional MCP pre-requisite:** A Falcon **Response Policy** assigned to the target hosts must permit the RTR `get` command. This is a host policy setting, separate from the API scopes. In particular, it is not the same as the optional **Response policies — Read** scope listed below.

CrowdStrike documents the [NGSIEM search-job API](https://developer.crowdstrike.com/api-reference/collections/ngsiem/) and [RTR API](https://developer.crowdstrike.com/api-reference/collections/real-time-response/).\
\
**(Recommended) Permissions for Future Capabilities**

The following read permissions are optional for the current integration and do not enable additional endpoint or policy collection today; however, to prepare for expanded CrowdStrike data collection and future capabilities that Identity Intelligence plans to support in the next approximately 3-6 months (delivery timeline subject to change, we highly recommend granting the following read permissions when you create the API client. This avoids the need to make manual integration updates in the future to grant these permissions.\
\
**Recommended approach:** Grant **Hosts - Read** if you want the integration to be ready for planned endpoint inventory collection. Policy permissions are recommended; grant read scopes for policy types whose IDs you want Identity Intelligence to resolve to friendly names.

<table data-search="false"><thead><tr><th width="224.24044799804688">Planned capability</th><th width="220.45660400390625">Falcon scope</th><th>Potential future use</th></tr></thead><tbody><tr><td>Endpoint inventory</td><td><strong>Hosts — Read</strong></td><td>Collect endpoint inventory</td></tr><tr><td>Policy name resolution</td><td><strong>Prevention policies — Read</strong></td><td>Resolve prevention policy IDs to friendly names</td></tr><tr><td>Policy name resolution</td><td><strong>Firewall management — Read</strong></td><td>Resolve firewall policy IDs to friendly names</td></tr><tr><td>Policy name resolution</td><td><strong>Sensor update policies — Read</strong></td><td>Resolve sensor update policy IDs to friendly names</td></tr><tr><td>Policy name resolution</td><td><strong>Device control policies — Read</strong></td><td>Resolve device control policy IDs to friendly names</td></tr><tr><td>Policy name resolution</td><td><strong>Response policies — Read</strong></td><td>Resolve response policy IDs to friendly names</td></tr></tbody></table>

### CrowdStrike configuration

Create a dedicated Falcon API client for the Identity Intelligence integration:

1. Sign in to the Falcon Console with a Falcon Administrator role
2. Open **Support and resources** from the left navigation
3. Under **Resources and tools**, select **API clients and keys**

<figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FDB514CrOn2B25oHT0BTy%2Fcrowdstrike-api-clients-navigation.png?alt=media&amp;token=ffbddc26-1b47-45ee-901e-7b73f26fa416" alt=""><figcaption></figcaption></figure>

4. Select **Create API client**

<figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FEEHXjkozAkNXjRpfkk20%2Fcrowdstrike-api-client-create.png?alt=media&amp;token=f2fa9d5d-f160-4291-99d0-7f02d374b514" alt="" width="563"><figcaption></figcaption></figure>

5. Enter a descriptive client name, for example, `cii-crowdstrike-integration` . Optionally, add a description to identify the client’s purpose
6. In the scope search field, enter `ngsiem`
7. On the **NGSIEM** row, select both the **Read** and **Write** checkboxes. These selections grant `NGSIEM:READ` and `NGSIEM:WRITE`

<figure><img src="https://582105988-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FqPSBzsjxd7KYg9DNVZ4l%2Fuploads%2FVECiccDinLxx6aRryVyt%2Fcrowdstrike-api-client-ngsiem-scopes.png?alt=media&amp;token=20df8c65-db54-4e09-9994-abea625e7cd1" alt="" width="563"><figcaption></figcaption></figure>

9. \[*Skip this step if not collecting MCP Configuration Files]* If you would like to collect **MCP configuration files**, search for **Real time response** in the scope list and select *both* **Read** and **Write. As mentioned in the** [#permissions](#permissions "mention") section above, both of these permissions are required to collect data about MCP configuration files
   1. Confirm that the Falcon Response Policy assigned to the target hosts permits the RTR `get` command
10. Grant the `read` permissions described in the [Recommended Permissions](#permissions) table above for planned capabilities. Granting them now will reduce the need to update the API client when the planned capabilities become available in the near future
11. Select **Create**
12. Copy the **Client ID** and **Client Secret**, and store them securely. Proceed to the [#identity-intelligence-configuration](#identity-intelligence-configuration "mention") section, to enter these values in Identity Intelligence and complete the integration process

{% hint style="warning" %}
Your client secret is sensitive. Do not include it in your org's internal documentation, source control, or support tickets. Use a dedicated client for Identity Intelligence and follow your organization’s credential-rotation policy.
{% endhint %}

### Identity Intelligence configuration

1. Log in to Identity Intelligence with an Admin role and navigate to **Integrations**
2. Select the **Add Integration** button
3. Find the **CrowdStrike** tile and select **Add Integration** in the respective tile
4. Enter a name for the integration, such as `CrowdStrike-production`
5. Enter the **API client ID** created in the Falcon Console
6. Enter the corresponding **API client secret** when prompted
7. Enter the **CrowdStrike account ID** for the Falcon environment you want to monitor
8. If needed, enter the **CrowdStrike API base URL** for your Falcon API region. The API clients and keys page displays this value as **Base URL**. This field is optional. For example:

   ```
   https://api.us-2.crowdstrike.com
   ```
9. Select **Save**

### Verify the integration

After saving the integration:

1. Confirm that the integration appears in the Identity Intelligence integrations list
2. Confirm that its connection status is successful or connected
3. Return to the product in the next 24 hours to review that CrowdStrike data begins appearing in the Identity Intelligence views that use this integration

If the connection fails, check the troubleshooting list below before creating a new client

***

### IP allowlisting

If your organization restricts access to CrowdStrike by source IP address, add the Identity Intelligence egress addresses to the relevant allowlist:

```
18.119.58.52
3.135.12.148
18.116.228.18
3.140.6.181
```

Confirm the current addresses shown in your Identity Intelligence integration setup screen before applying an allowlist. Egress addresses can be environment- or region-specific.

***

### Troubleshooting checklist

If Identity Intelligence is not receiving CrowdStrike data, verify the following:

* The CrowdStrike NGSIEM license is active
* The API client was created in the Falcon environment you intend to monitor
* The API client has both `NGSIEM:WRITE` and `NGSIEM:READ` permissions
* The Client ID and Client Secret were copied correctly
* The CrowdStrike account ID is correct
* The API base URL is correct for the CrowdStrike region, or is left blank when the default is appropriate
* Any required Identity Intelligence IP addresses are allowlisted by your organization
* The API client remains enabled in CrowdStrike

### Rotate CrowdStrike credentials

When the Falcon API client secret must be rotated:

1. Create or regenerate the credentials for the dedicated Falcon API client in the Falcon Console
2. In Identity Intelligence, navigate to **Integrations**, and select **Edit Settings** for the relevant CrowdStrike integration
3. Resetting credentials removes the current stored credentials from the integration, so keep the replacement secret available before starting the reset
4. Select **Reset Credentials**
5. Enter the new Client ID and Client Secret
6. Select **Save**
7. Confirm that the integration reconnects successfully