CrowdStrike - Serval Documentation

About CrowdStrike

CrowdStrike Falcon is a cloud-native endpoint protection (EDR/XDR) platform. Serval connects to your Falcon tenant using an OAuth2 API client - a Client ID and Client Secret you create in the Falcon console - scoped to your CrowdStrike cloud region. Once connected, workflows read from and act on Falcon live: querying hosts, triaging detection alerts, looking up users, and reaching the rest of the Falcon API as needed. Authentication: OAuth 2.0 client credentials (a Falcon API client). Serval exchanges your stored Client ID and Client Secret for short-lived access tokens automatically - there is no browser redirect or per-user sign-in, and the same machine credential is used for every workflow run. Data sync: on demand only. There is no background sync and no entity ingestion - workflows call the Falcon API live in your selected cloud region when they run.

What the CrowdStrike integration enables

Capability	Description
Query and resolve hosts	List the device IDs in your tenant, then resolve them into full device details - the foundation for inventory, hygiene, and containment workflows.
Read detection alerts	Query alerts through the current Falcon Alerts API (the replacement for the deprecated Detects API) to drive triage and incident-response workflows.
Look up Falcon users	List the user accounts in your connected tenant, for access audits and user-management workflows.
Generic Falcon API access	Call any Falcon REST endpoint through Serval’s CrowdStrike API request action - 906 typed endpoint paths spanning alerts, devices and hosts, incidents, real-time response, custom IOCs, prevention, response, and sensor-update policies, users, and more. Serval injects the access token automatically; your API client must hold the matching Falcon scopes.

Anything defined in the CrowdStrike API can be accessed through Serval.

Get your credentials

Serval needs an OAuth2 API client created in the CrowdStrike Falcon console, with the API scopes your workflows will use. See CrowdStrike’s OAuth2-based APIs documentation for full details.

Use the console for your cloud region: falcon.crowdstrike.com (US-1), falcon.us-2.crowdstrike.com (US-2), falcon.eu-1.crowdstrike.com (EU-1), or falcon.laggar.gcw.crowdstrike.com (US-GOV-1); US-3 and US-GOV-2 tenants use their region’s own Falcon console. Note which one you use - you will select the matching region in Serval.

Open API clients and keys

Navigate to Support and resources > API clients and keys (direct link).

Add a new API client

Click Add new API client and give it a descriptive name (for example, “Serval Integration”) and description.

Assign API scopes

Start with read-only scopes. To pass all of Serval’s connection health checks, the client needs at minimum Hosts: Read, Alerts: Read, User management: Read, and Sensor download: Read; also grant Sensor update policies: Read, which is part of the scope set the integration records by default. Add write scopes only as your workflows require them - see the scope reference below.

Create the client and copy its credentials

Click Add, then copy the Client ID and Client Secret.

The Client Secret is displayed only once, at creation, and cannot be retrieved later. Copy it before closing the dialog - if you lose it, you will need to generate a new secret (or a new client) in the Falcon console.

The scopes assigned to this API client in the Falcon console are what actually govern the connection’s permissions. If a workflow needs to reach additional Falcon areas later (real-time response, custom IOCs, policies, incidents), grant the matching scopes to this client there.

Falcon API scopes reference

Falcon scopes are granular. The console groups them under human-readable names; error messages and API documentation refer to them by identifier. The scopes most relevant to IT and security automation with Serval:

Falcon console scope	API scope identifiers	What it unlocks
Hosts	devices:read, devices:write	Search and resolve hosts and their details (read); network-contain a host or lift containment (write).
Host groups	host-group:read, host-group:write	View host groups (read); create and modify group membership (write).
Alerts	alerts:read, alerts:write	List and read detection alerts (read); update alert status, assignment, and comments (write).
Incidents	incidents:read, incidents:write	View incidents and scores (read); update incident status and ownership (write).
Prevention policies	prevention-policies:read, prevention-policies:write	View prevention policy configuration and assignments (read); create, modify, and assign policies (write).
Response policies	response-policies:read, response-policies:write	View response policy configuration (read); create, modify, and assign policies (write).
Sensor update policies	sensor-update-policies:read, sensor-update-policies:write	Monitor sensor versions and update rings (read); manage rollout policies and schedules (write).
Sensor download	sensor-installers:read	Read the sensor installer catalog - this is the scope Serval’s “Test CrowdStrike Connection” health check exercises.
Real time response	real-time-response:read, real-time-response:write, real-time-response-admin:write	Start remote sessions and run diagnostic commands on endpoints; admin write adds elevated commands, script execution, and file transfer.
User management	usermgmt:read, usermgmt:write	List Falcon users and their roles (read); create and modify users and role grants (write).
IOC management	ioc:read, ioc:write	Review custom indicators of compromise (read); create IOCs to block or monitor artifacts (write).

Host containment impact: network containment cuts a host off from everything except the CrowdStrike cloud. Grant the Hosts write scope deliberately, use containment actions carefully in workflows, and keep a documented procedure for lifting containment.

Connect in Serval

Open the CrowdStrike connect form

In Serval, open the CrowdStrike integration and start a new connection.

Enter an Instance Name (required)

A name to identify this CrowdStrike instance (e.g., ‘Production’, ‘Corporate’). Required to distinguish between multiple CrowdStrike connections. Leaving it empty shows “This field is required”; a whitespace-only value is rejected with “Instance name is required”.

Select your API Domain (required)

A dropdown to select your CrowdStrike cloud region: US-1 (api.crowdstrike.com), US-2 (api.us-2.crowdstrike.com), US-3 (api.us-3.crowdstrike.com), EU-1 (api.eu-1.crowdstrike.com), US-GOV-1 (api.laggar.gcw.crowdstrike.com), or US-GOV-2 (api.us-gov-2.crowdstrike.mil). If missing, you will see “API domain is required”.

Enter your Client ID (required)

Your CrowdStrike API Client ID, from the API client you created above. Leaving it empty shows “This field is required”.

Enter your Client Secret (required)

Your CrowdStrike API Client Secret (a password field). Leaving it empty shows “This field is required”.

Save the connection

Submit the form, then run the health checks below to confirm everything works.

The API Domain dropdown defaults to US-2 (api.us-2.crowdstrike.com) - not US-1. Verify your region before saving; a wrong region breaks authentication entirely.

When editing an existing connection, the Client Secret displays obfuscated (bullets plus its last 4 characters). Leaving it blank or unmodified keeps the stored secret - you only need to fill in the fields you are rotating.

Verifying the connection

The CrowdStrike integration ships four health checks:

Test CrowdStrike Connection - verifies Serval can authenticate with your tenant by performing a lightweight read of the sensor installer catalog, which requires the Sensor download: Read console scope. Success: “Successfully authenticated with CrowdStrike Falcon”. Failure: “Unable to connect to CrowdStrike Falcon. Please verify your Client ID and Client Secret are valid and have the necessary API scopes.”
List CrowdStrike Hosts - confirms the connection can list a small sample of hosts (up to 10). Success: “Successfully listed hosts from CrowdStrike Falcon (sample size: [number])”. Failure: “Unable to list hosts from CrowdStrike Falcon. Please verify the API credentials have the ‘devices:read’ scope.”
List CrowdStrike Alerts - confirms the connection can list a small sample of alerts (up to 10) via the current Alerts API. Success: “Successfully listed alerts from CrowdStrike Falcon (sample size: [number])”. Failure: “Unable to list alerts from CrowdStrike Falcon. Please verify the API credentials have the ‘alerts:read’ scope.”
List CrowdStrike Users - confirms the connection can list the users in your tenant. Success: “Successfully listed users from CrowdStrike Falcon (sample size: [number])”. Failure: “Unable to list users from CrowdStrike Falcon. Please verify the API credentials have the ‘users:read’ scope.”

All four checks can pass while a workflow still fails with a permission error. The checks only exercise reads under four console scopes (Sensor download, Hosts, Alerts, User management) - if a workflow calls any other Falcon area (real-time response, custom IOCs, policy changes, incidents), grant the matching scopes to the API client in the Falcon console.

Gotchas and troubleshooting

Region defaults to US-2, and a wrong region breaks authentication

The API Domain dropdown defaults to US-2 (api.us-2.crowdstrike.com), not US-1. Serval requests its access token from the cloud region you select, so the wrong region points authentication at the wrong host and every request fails. Check your Falcon console URL to confirm: falcon.crowdstrike.com is US-1, falcon.us-2.crowdstrike.com is US-2, falcon.eu-1.crowdstrike.com is EU-1, and falcon.laggar.gcw.crowdstrike.com is US-GOV-1. US-3 (api.us-3.crowdstrike.com) and US-GOV-2 (api.us-gov-2.crowdstrike.mil) are also available; pick the one that matches your tenant’s region.

The connect form has no scopes field - defaults always apply

Connections created through the Serval UI always record the 4 default scopes: sensor-update-policies:read, hosts:read, alerts:read, users:read. These are the integration’s own spellings for the same scopes the reference table and health checks name as devices:read (the Hosts console scope) and usermgmt:read (the User management console scope) - hosts:read and devices:read refer to one scope, as do users:read and usermgmt:read. Effective permissions are whatever scopes are assigned to the API client in the Falcon console - grant scopes there for any additional areas your workflows call, such as Real Time Response, custom IOCs, policies, or incidents.

Scope names in error messages differ from Falcon console labels

Health-check failures name scopes by API identifier, which does not always match the console label: ‘devices:read’ corresponds to the console scope Hosts: Read, and ‘users:read’ corresponds to User management: Read. The “Test CrowdStrike Connection” check needs Sensor download: Read, even though that scope is not named in its error message. When a check fails, grant the matching console scope from the reference table above rather than searching the console for the literal identifier in the error.

Scope changes can take a few minutes to apply

After creating an API client or changing its scopes in the Falcon console, allow a few minutes for the change to propagate before re-running Serval’s health checks. If a check still fails after granting the right scope, wait briefly and retry before rotating credentials.

Instance Name is part of the connection's identity

The connection is uniquely identified by its API domain plus its Instance Name. Two tenants in the same cloud region need distinct Instance Names - reconnecting with the same name and region is treated as an update of the existing connection, not a new one. Use names like “Production” vs “Corporate”.

Client Secret is shown only once in the Falcon console

CrowdStrike displays the Client Secret a single time when the API client is created, and it cannot be retrieved later. If you lose it, generate a new secret (or a new client) in the Falcon console and update the Serval connection.

Credential updates keep existing values on blank fields

When editing the connection, the Client Secret is displayed obfuscated (bullets plus the last 4 characters). Submitting the form with blank or unmodified obfuscated values keeps the existing stored credentials - you only need to fill in the fields you are rotating.

Falcon is query-then-fetch - queries return IDs, not full records

Falcon’s list and query operations return lists of resource IDs, not full records; you resolve details by sending those IDs to the matching “entities” operation. Responses come wrapped in a standard envelope containing the resources plus paging metadata, and pagination is offset-based. Query operations filter with Falcon Query Language (FQL). Workflow authors building on the generic API action should expect this two-step pattern.

Rate limiting on heavy workflows

Like any Falcon API client, the connection is subject to CrowdStrike’s API rate limits - heavy polling or per-resource loops can hit them. Prefer the batch “entities” operations (which accept arrays of IDs) over one call per resource, and reduce polling frequency in scheduled workflows.

No shipped workflows or background sync

This integration ships no installable workflows and performs no entity ingestion. Everything runs on demand through the generic API request action against the live Falcon API.

Need help? Contact support@serval.com for assistance with your CrowdStrike integration.

​About CrowdStrike

​What the CrowdStrike integration enables

​Get your credentials

​Falcon API scopes reference

​Connect in Serval

​Verifying the connection

​Gotchas and troubleshooting

About CrowdStrike

What the CrowdStrike integration enables

Get your credentials

Falcon API scopes reference

Connect in Serval

Verifying the connection

Gotchas and troubleshooting