Integrate CrowdStrike Falcon (EDR)

Connect CrowdStrike Falcon with Agent Identity Security to detect and identify Shadow AI agents using activity signals collected from endpoint machines.

Prerequisites

Before you begin, complete the steps in the following section to generate the API credentials required for this integration.
  1. Log in to the Falcon Console.
  2. Navigate to Support and resources.
  3. Under Resources and tools, select API clients and keys.
  4. Select Create API client.
  5. Enter a Client name and Description.
  6. Assign the following scopes:
    • NGSIEM: Read (Retrieve query job status and results).
    • NGSIEM: Write (Start NGSIEM search query jobs).
  7. Copy the Client ID, Secret, and Base URL.
    Important: The Client Secret is shown only once at creation. Copy and store it securely before closing this screen. If you lose it, you must generate a new API client.

Integrate CrowdStrike Falcon

Add CrowdStrike Falcon as an integration instance in the Agent Identity Security.
  1. On the Integrations page, select Add Integration.
  2. In the Integration Catalog, select CrowdStrike Falcon.
    The CrowdStrike Falcon configuration screen is displayed.
  3. Under Instance Details, enter the following:
    FieldDescription
    *Instance Name Unique name for this integration instance.
    Description Optional description to identify the purpose or environment covered.
    Note: Fields marked with * are mandatory.
  4. Under Credentials, enter the following:
    FieldDescription
    *Client ID Client ID from the CrowdStrike Falcon API client.
    *Client Secret Secret from the CrowdStrike Falcon API client.
    API Base URL Base URL from the CrowdStrike Falcon API client.
    Note: Fields marked with * are mandatory.
  5. Select Test Configuration.
    AIS validates the OAuth2 credentials against the Falcon API. A checkmark indicates that the connection is successful.
  6. Select Create Instance.
    The integration instance is created and the browser redirects to the Integrations list.