About CrowdStrike
CrowdStrike Falcon is a cloud-native endpoint protection (EDR/XDR) platform. Serval connects to your Falcon tenant using an OAuth2 API client - a Client ID and Client Secret you create in the Falcon console - scoped to your CrowdStrike cloud region. Once connected, workflows read from and act on Falcon live: querying hosts, triaging detection alerts, looking up users, and reaching the rest of the Falcon API as needed. Authentication: OAuth 2.0 client credentials (a Falcon API client). Serval exchanges your stored Client ID and Client Secret for short-lived access tokens automatically - there is no browser redirect or per-user sign-in, and the same machine credential is used for every workflow run. Data sync: on demand only. There is no background sync and no entity ingestion - workflows call the Falcon API live in your selected cloud region when they run.What the CrowdStrike integration enables
| Capability | Description |
|---|---|
| Query and resolve hosts | List the device IDs in your tenant, then resolve them into full device details - the foundation for inventory, hygiene, and containment workflows. |
| Read detection alerts | Query alerts through the current Falcon Alerts API (the replacement for the deprecated Detects API) to drive triage and incident-response workflows. |
| Look up Falcon users | List the user accounts in your connected tenant, for access audits and user-management workflows. |
| Generic Falcon API access | Call any Falcon REST endpoint through Serval’s CrowdStrike API request action - 906 typed endpoint paths spanning alerts, devices and hosts, incidents, real-time response, custom IOCs, prevention, response, and sensor-update policies, users, and more. Serval injects the access token automatically; your API client must hold the matching Falcon scopes. |
Get your credentials
Serval needs an OAuth2 API client created in the CrowdStrike Falcon console, with the API scopes your workflows will use. See CrowdStrike’s OAuth2-based APIs documentation for full details.Log in to your Falcon console
Use the console for your cloud region: falcon.crowdstrike.com (US-1), falcon.us-2.crowdstrike.com (US-2), falcon.eu-1.crowdstrike.com (EU-1), or falcon.laggar.gcw.crowdstrike.com (US-GOV-1). Note which one you use - you will select the matching region in Serval.
Open API clients and keys
Navigate to Support and resources > API clients and keys (direct link).
Add a new API client
Click Add new API client and give it a descriptive name (for example, “Serval Integration”) and description.
Assign API scopes
Start with read-only scopes. To pass all of Serval’s connection health checks, the client needs at minimum Hosts: Read, Alerts: Read, User management: Read, and Sensor download: Read; also grant Sensor update policies: Read, which is part of the scope set the integration records by default. Add write scopes only as your workflows require them - see the scope reference below.
The scopes assigned to this API client in the Falcon console are what actually govern the connection’s permissions. If a workflow needs to reach additional Falcon areas later (real-time response, custom IOCs, policies, incidents), grant the matching scopes to this client there.
Falcon API scopes reference
Falcon scopes are granular. The console groups them under human-readable names; error messages and API documentation refer to them by identifier. The scopes most relevant to IT and security automation with Serval:| Falcon console scope | API scope identifiers | What it unlocks |
|---|---|---|
| Hosts | devices:read, devices:write | Search and resolve hosts and their details (read); network-contain a host or lift containment (write). |
| Host groups | host-group:read, host-group:write | View host groups (read); create and modify group membership (write). |
| Alerts | alerts:read, alerts:write | List and read detection alerts (read); update alert status, assignment, and comments (write). |
| Incidents | incidents:read, incidents:write | View incidents and scores (read); update incident status and ownership (write). |
| Prevention policies | prevention-policies:read, prevention-policies:write | View prevention policy configuration and assignments (read); create, modify, and assign policies (write). |
| Response policies | response-policies:read, response-policies:write | View response policy configuration (read); create, modify, and assign policies (write). |
| Sensor update policies | sensor-update-policies:read, sensor-update-policies:write | Monitor sensor versions and update rings (read); manage rollout policies and schedules (write). |
| Sensor download | sensor-installers:read | Read the sensor installer catalog - this is the scope Serval’s “Test CrowdStrike Connection” health check exercises. |
| Real time response | real-time-response:read, real-time-response:write, real-time-response-admin:write | Start remote sessions and run diagnostic commands on endpoints; admin write adds elevated commands, script execution, and file transfer. |
| User management | usermgmt:read, usermgmt:write | List Falcon users and their roles (read); create and modify users and role grants (write). |
| IOC management | ioc:read, ioc:write | Review custom indicators of compromise (read); create IOCs to block or monitor artifacts (write). |
Connect in Serval
Open the CrowdStrike connect form
In Serval, open the CrowdStrike integration and start a new connection.
Enter an Instance Name (required)
A name to identify this CrowdStrike instance (e.g., ‘Production’, ‘Corporate’). Required to distinguish between multiple CrowdStrike connections. Leaving it empty shows “This field is required”; a whitespace-only value is rejected with “Instance name is required”.
Select your API Domain (required)
A dropdown to select your CrowdStrike cloud region: US-1 (api.crowdstrike.com), US-2 (api.us-2.crowdstrike.com), EU-1 (api.eu-1.crowdstrike.com), or US-GOV-1 (api.laggar.gcw.crowdstrike.com). If missing, you will see “API domain is required”.
Enter your Client ID (required)
Your CrowdStrike API Client ID, from the API client you created above. Leaving it empty shows “This field is required”.
Enter your Client Secret (required)
Your CrowdStrike API Client Secret (a password field). Leaving it empty shows “This field is required”.
When editing an existing connection, the Client Secret displays obfuscated (bullets plus its last 4 characters). Leaving it blank or unmodified keeps the stored secret - you only need to fill in the fields you are rotating.
Verifying the connection
The CrowdStrike integration ships four health checks:- Test CrowdStrike Connection - verifies Serval can authenticate with your tenant by performing a lightweight read of the sensor installer catalog, which requires the Sensor download: Read console scope. Success: “Successfully authenticated with CrowdStrike Falcon”. Failure: “Unable to connect to CrowdStrike Falcon. Please verify your Client ID and Client Secret are valid and have the necessary API scopes.”
- List CrowdStrike Hosts - confirms the connection can list a small sample of hosts (up to 10). Success: “Successfully listed hosts from CrowdStrike Falcon (sample size: [number])”. Failure: “Unable to list hosts from CrowdStrike Falcon. Please verify the API credentials have the ‘devices:read’ scope.”
- List CrowdStrike Alerts - confirms the connection can list a small sample of alerts (up to 10) via the current Alerts API. Success: “Successfully listed alerts from CrowdStrike Falcon (sample size: [number])”. Failure: “Unable to list alerts from CrowdStrike Falcon. Please verify the API credentials have the ‘alerts:read’ scope.”
- List CrowdStrike Users - confirms the connection can list the users in your tenant. Success: “Successfully listed users from CrowdStrike Falcon (sample size: [number])”. Failure: “Unable to list users from CrowdStrike Falcon. Please verify the API credentials have the ‘users:read’ scope.”
Gotchas and troubleshooting
Region defaults to US-2, and a wrong region breaks authentication
Region defaults to US-2, and a wrong region breaks authentication
The API Domain dropdown defaults to US-2 (api.us-2.crowdstrike.com), not US-1. Serval requests its access token from the cloud region you select, so the wrong region points authentication at the wrong host and every request fails. Check your Falcon console URL to confirm: falcon.crowdstrike.com is US-1, falcon.us-2.crowdstrike.com is US-2, falcon.eu-1.crowdstrike.com is EU-1, and falcon.laggar.gcw.crowdstrike.com is US-GOV-1.
The connect form has no scopes field - defaults always apply
The connect form has no scopes field - defaults always apply
Connections created through the Serval UI always record the 4 default scopes: sensor-update-policies:read, hosts:read, alerts:read, users:read. These are the integration’s own spellings for the same scopes the reference table and health checks name as devices:read (the Hosts console scope) and usermgmt:read (the User management console scope) - hosts:read and devices:read refer to one scope, as do users:read and usermgmt:read. Effective permissions are whatever scopes are assigned to the API client in the Falcon console - grant scopes there for any additional areas your workflows call, such as Real Time Response, custom IOCs, policies, or incidents.
Scope names in error messages differ from Falcon console labels
Scope names in error messages differ from Falcon console labels
Health-check failures name scopes by API identifier, which does not always match the console label: ‘devices:read’ corresponds to the console scope Hosts: Read, and ‘users:read’ corresponds to User management: Read. The “Test CrowdStrike Connection” check needs Sensor download: Read, even though that scope is not named in its error message. When a check fails, grant the matching console scope from the reference table above rather than searching the console for the literal identifier in the error.
Scope changes can take a few minutes to apply
Scope changes can take a few minutes to apply
After creating an API client or changing its scopes in the Falcon console, allow a few minutes for the change to propagate before re-running Serval’s health checks. If a check still fails after granting the right scope, wait briefly and retry before rotating credentials.
Instance Name is part of the connection's identity
Instance Name is part of the connection's identity
The connection is uniquely identified by its API domain plus its Instance Name. Two tenants in the same cloud region need distinct Instance Names - reconnecting with the same name and region is treated as an update of the existing connection, not a new one. Use names like “Production” vs “Corporate”.
Client Secret is shown only once in the Falcon console
Client Secret is shown only once in the Falcon console
CrowdStrike displays the Client Secret a single time when the API client is created, and it cannot be retrieved later. If you lose it, generate a new secret (or a new client) in the Falcon console and update the Serval connection.
Credential updates keep existing values on blank fields
Credential updates keep existing values on blank fields
When editing the connection, the Client Secret is displayed obfuscated (bullets plus the last 4 characters). Submitting the form with blank or unmodified obfuscated values keeps the existing stored credentials - you only need to fill in the fields you are rotating.
Falcon is query-then-fetch - queries return IDs, not full records
Falcon is query-then-fetch - queries return IDs, not full records
Falcon’s list and query operations return lists of resource IDs, not full records; you resolve details by sending those IDs to the matching “entities” operation. Responses come wrapped in a standard envelope containing the resources plus paging metadata, and pagination is offset-based. Query operations filter with Falcon Query Language (FQL). Workflow authors building on the generic API action should expect this two-step pattern.
Rate limiting on heavy workflows
Rate limiting on heavy workflows
Like any Falcon API client, the connection is subject to CrowdStrike’s API rate limits - heavy polling or per-resource loops can hit them. Prefer the batch “entities” operations (which accept arrays of IDs) over one call per resource, and reduce polling frequency in scheduled workflows.
No shipped workflows or background sync
No shipped workflows or background sync
This integration ships no installable workflows and performs no entity ingestion. Everything runs on demand through the generic API request action against the live Falcon API.
Need help? Contact support@serval.com for assistance with your CrowdStrike integration.