CrowdStrike Falcon
Integrate CrowdStrike Falcon to retrieve endpoint protection data
The CrowdStrike Falcon connector allows you to retrieve inventory and detection data from your CrowdStrike platform directly into OverView for a consolidated view of your security posture.
Objective
The CrowdStrike Falcon connector retrieves the following information:
- Inventory of hosts and host groups
- Security detections and incidents (alerts)
- Applications and assets (Falcon Discover)
- Vulnerabilities identified on endpoints (Falcon Spotlight)
Prerequisites
- Access to the CrowdStrike Falcon console
- Administrator permissions to create API keys
- The Falcon Discover module — required for application and asset data;
discover:readwill not appear in your console without it
Information to provide in OverView
| Field | Description |
|---|---|
| API Base URL | Base URL of the CrowdStrike Falcon API (e.g., https://api.crowdstrike.com) |
| Client ID | Client identifier for OAuth2 authentication |
| Client Secret | Client secret key for OAuth2 authentication |
Parameters
These parameters are optional. Leave them at their default value unless you have a specific reason to change them.
| Parameter | Description | Default |
|---|---|---|
| Vulnerability Retrieval Days | Number of days to retrieve vulnerabilities | — |
| Alert Retrieval Days | Number of days to retrieve alerts | 30 |
| Application Retrieval Days | Number of days to retrieve applications | 30 |
Procedure
Create an API Key in CrowdStrike
- Sign in to the CrowdStrike Falcon console.
- Go to Support > API Clients and Keys.
- Click Add new API client.
- Give it a descriptive name (e.g., "OverView Integration").
- Grant Read access to the following API scopes. If a scope is missing, the corresponding data will be silently skipped and the import will be partial:
- Host Groups (
host-groups:read) - Alerts (
alerts:read) - Falcon Discover (
discover:read) — requires the Falcon Discover module - Falcon Spotlight Vulnerabilities (
spotlight-vulnerabilities:read)
- Host Groups (
- Click Create.
- Copy the Client ID and Client Secret immediately.
Retrieve the API URL
The API URL depends on your region:
- US-1: https://api.crowdstrike.com
- US-2: https://api.us-2.crowdstrike.com
- EU: https://api.eu-1.crowdstrike.com
Verify your region in your console settings.
Configure the Connector in OverView
- In OverView, go to Data Sources Settings > Sources.
- Select CrowdStrike Falcon and click Configure.
- Fill in the required fields:
- API Base URL
- Client ID
- Client Secret
- Click Save Configuration.
View CrowdStrike API documentation
Required Permissions
The API client must be granted Read access to the scopes below. If a scope is missing or the corresponding module is not licensed, that category of data will not be imported — the rest of the import continues normally.
| Data retrieved | Scope (Falcon console) | API scope | Note |
|---|---|---|---|
| Hosts inventory / groups | Host Groups | host-groups:read | |
| Detections & incidents | Alerts | alerts:read | |
| Applications & assets | Falcon Discover | discover:read | Requires the Falcon Discover module |
| Vulnerabilities | Falcon Spotlight Vulnerabilities | spotlight-vulnerabilities:read |
Alternative: file import through DropPoint
The API access described above is the recommended method for this connector. Where it is not available (a segregated network, a version or licence without API, an export you already produce), OverView accepts file exports, to be uploaded to the bucket dedicated to CrowdStrike Falcon.
Bucket : s3://crowdstrike/
Example : s3://crowdstrike/export.csv
The procedure is described in the OverView DropPoint guide: generating credentials, configuring the client, then sending files from the OverView web interface, the AWS CLI or an SDK. Its examples come pre-filled with this bucket when you follow this link.