> ## Documentation Index
> Fetch the complete documentation index at: https://docs.serval.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CrowdStrike

> CrowdStrike Falcon is a cloud-native endpoint protection (EDR/XDR) platform - Serval connects to your Falcon tenant with an API client so workflows can query hosts, alerts, and users and call the Falcon API on demand.

## About CrowdStrike

CrowdStrike Falcon is a cloud-native endpoint protection (EDR/XDR) platform. Serval connects to your Falcon tenant using an OAuth2 API client - a Client ID and Client Secret you create in the Falcon console - scoped to your CrowdStrike cloud region. Once connected, workflows read from and act on Falcon live: querying hosts, triaging detection alerts, looking up users, and reaching the rest of the Falcon API as needed.

**Authentication:** OAuth 2.0 client credentials (a Falcon API client). Serval exchanges your stored Client ID and Client Secret for short-lived access tokens automatically - there is no browser redirect or per-user sign-in, and the same machine credential is used for every workflow run.

**Data sync:** on demand only. There is no background sync and no entity ingestion - workflows call the Falcon API live in your selected cloud region when they run.

## What the CrowdStrike integration enables

| Capability                | Description                                                                                                                                                                                                                                                                                                                                                      |
| ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Query and resolve hosts   | List the device IDs in your tenant, then resolve them into full device details - the foundation for inventory, hygiene, and containment workflows.                                                                                                                                                                                                               |
| Read detection alerts     | Query alerts through the current Falcon Alerts API (the replacement for the deprecated Detects API) to drive triage and incident-response workflows.                                                                                                                                                                                                             |
| Look up Falcon users      | List the user accounts in your connected tenant, for access audits and user-management workflows.                                                                                                                                                                                                                                                                |
| Generic Falcon API access | Call any Falcon REST endpoint through Serval's CrowdStrike API request action - 906 typed endpoint paths spanning alerts, devices and hosts, incidents, real-time response, custom IOCs, prevention, response, and sensor-update policies, users, and more. Serval injects the access token automatically; your API client must hold the matching Falcon scopes. |

Anything defined in the [CrowdStrike API](https://developer.crowdstrike.com/) can be accessed through Serval.

## Get your credentials

Serval needs an **OAuth2 API client** created in the CrowdStrike Falcon console, with the API scopes your workflows will use. See CrowdStrike's [OAuth2-based APIs documentation](https://falcon.crowdstrike.com/documentation/page/a2a7fc0e/crowdstrike-oauth2-based-apis) for full details.

<Steps>
  <Step title="Log in to your Falcon console">
    Use the console for your cloud region: falcon.crowdstrike.com (US-1), falcon.us-2.crowdstrike.com (US-2), falcon.eu-1.crowdstrike.com (EU-1), or falcon.laggar.gcw\.crowdstrike.com (US-GOV-1). Note which one you use - you will select the matching region in Serval.
  </Step>

  <Step title="Open API clients and keys">
    Navigate to **Support and resources > API clients and keys** ([direct link](https://falcon.crowdstrike.com/api-clients-and-keys)).
  </Step>

  <Step title="Add a new API client">
    Click **Add new API client** and give it a descriptive name (for example, "Serval Integration") and description.
  </Step>

  <Step title="Assign API scopes">
    Start with read-only scopes. To pass all of Serval's connection health checks, the client needs at minimum **Hosts: Read**, **Alerts: Read**, **User management: Read**, and **Sensor download: Read**; also grant **Sensor update policies: Read**, which is part of the scope set the integration records by default. Add write scopes only as your workflows require them - see the scope reference below.
  </Step>

  <Step title="Create the client and copy its credentials">
    Click **Add**, then copy the **Client ID** and **Client Secret**.
  </Step>
</Steps>

<Warning>
  The Client Secret is displayed **only once**, at creation, and cannot be retrieved later. Copy it before closing the dialog - if you lose it, you will need to generate a new secret (or a new client) in the Falcon console.
</Warning>

<Note>
  The scopes assigned to this API client in the Falcon console are what actually govern the connection's permissions. If a workflow needs to reach additional Falcon areas later (real-time response, custom IOCs, policies, incidents), grant the matching scopes to this client there.
</Note>

## Falcon API scopes reference

Falcon scopes are granular. The console groups them under human-readable names; error messages and API documentation refer to them by identifier. The scopes most relevant to IT and security automation with Serval:

| Falcon console scope   | API scope identifiers                                                             | What it unlocks                                                                                                                          |
| ---------------------- | --------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| Hosts                  | devices:read, devices:write                                                       | Search and resolve hosts and their details (read); network-contain a host or lift containment (write).                                   |
| Host groups            | host-group:read, host-group:write                                                 | View host groups (read); create and modify group membership (write).                                                                     |
| Alerts                 | alerts:read, alerts:write                                                         | List and read detection alerts (read); update alert status, assignment, and comments (write).                                            |
| Incidents              | incidents:read, incidents:write                                                   | View incidents and scores (read); update incident status and ownership (write).                                                          |
| Prevention policies    | prevention-policies:read, prevention-policies:write                               | View prevention policy configuration and assignments (read); create, modify, and assign policies (write).                                |
| Response policies      | response-policies:read, response-policies:write                                   | View response policy configuration (read); create, modify, and assign policies (write).                                                  |
| Sensor update policies | sensor-update-policies:read, sensor-update-policies:write                         | Monitor sensor versions and update rings (read); manage rollout policies and schedules (write).                                          |
| Sensor download        | sensor-installers:read                                                            | Read the sensor installer catalog - this is the scope Serval's "Test CrowdStrike Connection" health check exercises.                     |
| Real time response     | real-time-response:read, real-time-response:write, real-time-response-admin:write | Start remote sessions and run diagnostic commands on endpoints; admin write adds elevated commands, script execution, and file transfer. |
| User management        | usermgmt:read, usermgmt:write                                                     | List Falcon users and their roles (read); create and modify users and role grants (write).                                               |
| IOC management         | ioc:read, ioc:write                                                               | Review custom indicators of compromise (read); create IOCs to block or monitor artifacts (write).                                        |

<Warning>
  **Host containment impact:** network containment cuts a host off from everything except the CrowdStrike cloud. Grant the Hosts write scope deliberately, use containment actions carefully in workflows, and keep a documented procedure for lifting containment.
</Warning>

## Connect in Serval

<Steps>
  <Step title="Open the CrowdStrike connect form">
    In Serval, open the CrowdStrike integration and start a new connection.
  </Step>

  <Step title="Enter an Instance Name (required)">
    A name to identify this CrowdStrike instance (e.g., 'Production', 'Corporate'). Required to distinguish between multiple CrowdStrike connections. Leaving it empty shows "This field is required"; a whitespace-only value is rejected with "Instance name is required".
  </Step>

  <Step title="Select your API Domain (required)">
    A dropdown to select your CrowdStrike cloud region: **US-1 (api.crowdstrike.com)**, **US-2 (api.us-2.crowdstrike.com)**, **EU-1 (api.eu-1.crowdstrike.com)**, or **US-GOV-1 (api.laggar.gcw\.crowdstrike.com)**. If missing, you will see "API domain is required".
  </Step>

  <Step title="Enter your Client ID (required)">
    Your CrowdStrike API Client ID, from the API client you created above. Leaving it empty shows "This field is required".
  </Step>

  <Step title="Enter your Client Secret (required)">
    Your CrowdStrike API Client Secret (a password field). Leaving it empty shows "This field is required".
  </Step>

  <Step title="Save the connection">
    Submit the form, then run the health checks below to confirm everything works.
  </Step>
</Steps>

<Warning>
  The API Domain dropdown defaults to **US-2 (api.us-2.crowdstrike.com)** - not US-1. Verify your region before saving; a wrong region breaks authentication entirely.
</Warning>

<Note>
  When editing an existing connection, the Client Secret displays obfuscated (bullets plus its last 4 characters). Leaving it blank or unmodified keeps the stored secret - you only need to fill in the fields you are rotating.
</Note>

## Verifying the connection

The CrowdStrike integration ships four health checks:

* **Test CrowdStrike Connection** - verifies Serval can authenticate with your tenant by performing a lightweight read of the sensor installer catalog, which requires the **Sensor download: Read** console scope. Success: "Successfully authenticated with CrowdStrike Falcon". Failure: "Unable to connect to CrowdStrike Falcon. Please verify your Client ID and Client Secret are valid and have the necessary API scopes."
* **List CrowdStrike Hosts** - confirms the connection can list a small sample of hosts (up to 10). Success: "Successfully listed hosts from CrowdStrike Falcon (sample size: \[number])". Failure: "Unable to list hosts from CrowdStrike Falcon. Please verify the API credentials have the 'devices:read' scope."
* **List CrowdStrike Alerts** - confirms the connection can list a small sample of alerts (up to 10) via the current Alerts API. Success: "Successfully listed alerts from CrowdStrike Falcon (sample size: \[number])". Failure: "Unable to list alerts from CrowdStrike Falcon. Please verify the API credentials have the 'alerts:read' scope."
* **List CrowdStrike Users** - confirms the connection can list the users in your tenant. Success: "Successfully listed users from CrowdStrike Falcon (sample size: \[number])". Failure: "Unable to list users from CrowdStrike Falcon. Please verify the API credentials have the 'users:read' scope."

<Tip>
  All four checks can pass while a workflow still fails with a permission error. The checks only exercise reads under four console scopes (Sensor download, Hosts, Alerts, User management) - if a workflow calls any other Falcon area (real-time response, custom IOCs, policy changes, incidents), grant the matching scopes to the API client in the Falcon console.
</Tip>

## Gotchas and troubleshooting

<AccordionGroup>
  <Accordion title="Region defaults to US-2, and a wrong region breaks authentication">
    The API Domain dropdown defaults to US-2 (api.us-2.crowdstrike.com), not US-1. Serval requests its access token from the cloud region you select, so the wrong region points authentication at the wrong host and every request fails. Check your Falcon console URL to confirm: falcon.crowdstrike.com is US-1, falcon.us-2.crowdstrike.com is US-2, falcon.eu-1.crowdstrike.com is EU-1, and falcon.laggar.gcw\.crowdstrike.com is US-GOV-1.
  </Accordion>

  <Accordion title="The connect form has no scopes field - defaults always apply">
    Connections created through the Serval UI always record the 4 default scopes: sensor-update-policies:read, hosts:read, alerts:read, users:read. These are the integration's own spellings for the same scopes the reference table and health checks name as devices:read (the **Hosts** console scope) and usermgmt:read (the **User management** console scope) - hosts:read and devices:read refer to one scope, as do users:read and usermgmt:read. Effective permissions are whatever scopes are assigned to the API client in the Falcon console - grant scopes there for any additional areas your workflows call, such as [Real Time Response](https://falcon.crowdstrike.com/documentation/page/d5b78bc0/real-time-response), custom IOCs, policies, or incidents.
  </Accordion>

  <Accordion title="Scope names in error messages differ from Falcon console labels">
    Health-check failures name scopes by API identifier, which does not always match the console label: 'devices:read' corresponds to the console scope **Hosts: Read**, and 'users:read' corresponds to **User management: Read**. The "Test CrowdStrike Connection" check needs **Sensor download: Read**, even though that scope is not named in its error message. When a check fails, grant the matching console scope from the reference table above rather than searching the console for the literal identifier in the error.
  </Accordion>

  <Accordion title="Scope changes can take a few minutes to apply">
    After creating an API client or changing its scopes in the Falcon console, allow a few minutes for the change to propagate before re-running Serval's health checks. If a check still fails after granting the right scope, wait briefly and retry before rotating credentials.
  </Accordion>

  <Accordion title="Instance Name is part of the connection's identity">
    The connection is uniquely identified by its API domain plus its Instance Name. Two tenants in the same cloud region need distinct Instance Names - reconnecting with the same name and region is treated as an update of the existing connection, not a new one. Use names like "Production" vs "Corporate".
  </Accordion>

  <Accordion title="Client Secret is shown only once in the Falcon console">
    CrowdStrike displays the Client Secret a single time when the API client is created, and it cannot be retrieved later. If you lose it, generate a new secret (or a new client) in the Falcon console and update the Serval connection.
  </Accordion>

  <Accordion title="Credential updates keep existing values on blank fields">
    When editing the connection, the Client Secret is displayed obfuscated (bullets plus the last 4 characters). Submitting the form with blank or unmodified obfuscated values keeps the existing stored credentials - you only need to fill in the fields you are rotating.
  </Accordion>

  <Accordion title="Falcon is query-then-fetch - queries return IDs, not full records">
    Falcon's list and query operations return lists of resource IDs, not full records; you resolve details by sending those IDs to the matching "entities" operation. Responses come wrapped in a standard envelope containing the resources plus paging metadata, and pagination is offset-based. Query operations filter with [Falcon Query Language (FQL)](https://falcon.crowdstrike.com/documentation/45/falcon-query-language-fql). Workflow authors building on the generic API action should expect this two-step pattern.
  </Accordion>

  <Accordion title="Rate limiting on heavy workflows">
    Like any Falcon API client, the connection is subject to CrowdStrike's API rate limits - heavy polling or per-resource loops can hit them. Prefer the batch "entities" operations (which accept arrays of IDs) over one call per resource, and reduce polling frequency in scheduled workflows.
  </Accordion>

  <Accordion title="No shipped workflows or background sync">
    This integration ships no installable workflows and performs no entity ingestion. Everything runs on demand through the generic API request action against the live Falcon API.
  </Accordion>
</AccordionGroup>

***

Need help? Contact **[support@serval.com](mailto:support@serval.com)** for assistance with your CrowdStrike integration.