Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

CrowdStrike

Cisco Identity Intelligence can integrate with CrowdStrike Falcon NGSIEM (Falcon LogScale) to retrieve log data created by CrowdStrike agents on endpoints. This article explains how to create the required CrowdStrike API client and connect it to Identity Intelligence.

The CrowdStrike integration is currently in Alpha and can only be enabled by the Identity Intelligence team. Please contact Support to have it enabled for your account.

Overview

To connect CrowdStrike to Identity Intelligence:

  1. Confirm that your CrowdStrike environment meets the prerequisites

  2. Create a Falcon API client with the required NGSIEM permissions and, if approved, the recommended read permissions for planned capabilities

  3. Copy the API client ID and secret

  4. Add the CrowdStrike integration in Identity Intelligence

  5. Verify the connection and configure network allowlisting if required

Prerequisites

Before you begin, make sure that:

  • An active CrowdStrike NGSIEM (Falcon LogScale) license is provisioned

  • You have access to the Falcon Console

  • You are a Falcon administrator, or have permission to manage Falcon API clients

  • You have the necessary permissions to manage integrations in your Identity Intelligence tenant

CrowdStrike configuration

Create a dedicated Falcon API client for the Identity Intelligence integration:

  1. Sign in to the Falcon Console with a Falcon Administrator role

  2. Open Support and resources from the left navigation

  3. Under Resources and tools, select API clients and keys

  1. Select Create API client

  1. Enter a descriptive client name, for example, cii-crowdstrike-integration

  2. Optionally, add a description to identify the client’s purpose

  3. In the scope search field, enter ngsiem

  4. On the NGSIEM row, select both the Read and Write checkboxes. These selections grant NGSIEM:READ and NGSIEM:WRITE

  1. Grant the read permissions described in Recommended permissions for planned capabilities. Granting them now will reduce the need to update the API client when the planned capabilities become available in the near future

  2. Select Create

  3. Copy the Client ID and Client Secret, and store them securely. Proceed to the Identity Intelligence configuration section, to enter these values in Identity Intelligence and complete the integration process

Your client secret is sensitive. Do not include it in your org's internal documentation, source control, or support tickets. Use a dedicated client for Identity Intelligence and follow your organization’s credential-rotation policy.

Required permissions

Permission
Purpose

NGSIEM:WRITE

Required by the integration to send queries to the CrowdStrike cloud and retrieve relevant NGSIEM data.

NGSIEM:READ

Allows the integration to read or query NGSIEM data and receive the query results.

Recommended permissions for planned capabilities

To prepare for expanded CrowdStrike data collection, consider granting the following read permissions when you create the API client. Recommended approach: Grant Hosts - Read if you want the integration to be ready for planned endpoint inventory collection. Policy permissions are recommended; grant read scopes for policy types whose IDs you want Identity Intelligence to resolve to friendly names.

These permissions are optional for the current integration and do not enable additional endpoint or policy collection today. They are intended to support capabilities planned for approximately the next 3-6 months, though the delivery timeline may change.

Planned capability
Falcon scope
Access
Potential future use

Endpoint inventory - recommended

Hosts

Read

Core permission for collecting endpoint inventory.

Policy name resolution

Prevention policies

Read

Resolve prevention policy IDs to friendly names.

Policy name resolution

Firewall management

Read

Resolve firewall policy IDs to friendly names.

Policy name resolution

Sensor update policies

Read

Resolve sensor update policy IDs to friendly names.

Policy name resolution

Device control policies

Read

Resolve device control policy IDs to friendly names.

Policy name resolution

Response policies

Read

Resolve response policy IDs to friendly names.

Identity Intelligence configuration

  1. Log in to Identity Intelligence with an Admin role and navigate to Integrations

  2. Select the Add Integration button

  3. Find the CrowdStrike tile and select Add Integration in the respective tile

  4. Enter a name for the integration, such as CrowdStrike-production

  5. Enter the API client ID created in the Falcon Console

  6. Enter the corresponding API client secret when prompted

  7. Enter the CrowdStrike account ID for the Falcon environment you want to monitor

  8. If needed, enter the CrowdStrike API base URL for your Falcon API region. The API clients and keys page displays this value as Base URL. This field is optional. For example:

  9. Select Save

Verify the integration

After saving the integration:

  1. Confirm that the integration appears in the Identity Intelligence integrations list

  2. Confirm that its connection status is successful or connected

  3. Return to the product in the next 24 hours to review that CrowdStrike data begins appearing in the Identity Intelligence views that use this integration

If the connection fails, check the troubleshooting list below before creating a new client

IP allowlisting

If your organization restricts access to CrowdStrike by source IP address, add the Identity Intelligence egress addresses to the relevant allowlist:

Confirm the current addresses shown in your Identity Intelligence integration setup screen before applying an allowlist. Egress addresses can be environment- or region-specific.

Troubleshooting checklist

If Identity Intelligence is not receiving CrowdStrike data, verify the following:

  • The CrowdStrike NGSIEM license is active

  • The API client was created in the Falcon environment you intend to monitor

  • The API client has both NGSIEM:WRITE and NGSIEM:READ permissions

  • The Client ID and Client Secret were copied correctly

  • The CrowdStrike account ID is correct

  • The API base URL is correct for the CrowdStrike region, or is left blank when the default is appropriate

  • Any required Identity Intelligence IP addresses are allowlisted by your organization

  • The API client remains enabled in CrowdStrike

Rotate CrowdStrike credentials

When the Falcon API client secret must be rotated:

  1. Create or regenerate the credentials for the dedicated Falcon API client in the Falcon Console

  2. In Identity Intelligence, navigate to Integrations, and select Edit Settings for the relevant CrowdStrike integration

  3. Resetting credentials removes the current stored credentials from the integration, so keep the replacement secret available before starting the reset

  4. Select Reset Credentials

  5. Enter the new Client ID and Client Secret

  6. Select Save

  7. Confirm that the integration reconnects successfully

PreviousBloodhound Enterprise
NextDatadog

Last updated