CrowdStrike Falcon Insight
Configure CrowdStrike Falcon Insight EDR integration with RAD Security for advanced endpoint detection and response.
This guide walks you through integrating CrowdStrike Falcon Insight EDR with RAD Security for advanced endpoint detection and response capabilities, enabling you to correlate endpoint security events with container and cloud runtime activity.
CrowdStrike Falcon Insight provides real-time endpoint detection and response (EDR), threat intelligence, and automated response actions for comprehensive endpoint security.
Prerequisites
Before you begin, ensure you have:
- Access to CrowdStrike Falcon Console
- Administrator privileges in CrowdStrike Console
- Access to RAD Security workspace with integration permissions
Administrative Privileges Required: You must have administrative privileges in CrowdStrike Console to create API clients and manage scopes in the API Clients and Keys section.
Understanding CrowdStrike API Scopes
This integration requires specific API scopes to access endpoint data, detections, incidents, and threat intelligence:
Read-only integration: Data synchronization requires only the read scopes above — no write scopes. Response actions (such as host containment) are optional and need additional setup; see CrowdStrike Response Actions.
Step 1: Access CrowdStrike Falcon Console
Log in to CrowdStrike Console
Log in to your CrowdStrike Falcon Console with administrative privileges
Navigate to API Clients
Open the main menu and go to:
Support and resources > Resources and tools > API clients and keys
Step 2: Create API Client
Create New Client
Click the Create API client button
Configure Client Name
In the modal dialog:
- Client name: Enter a descriptive name (e.g., "RAD Security EDR Integration")
- Description: (Optional) Add details about this integration
Assign Read Scopes
Select Read permissions for the following scopes:
- ☑️ Alerts
- ☑️ Apps
- ☑️ Custom IOA rules
- ☑️ Detections
- ☑️ Device control policy
- ☑️ Hosts
- ☑️ Assets
- ☑️ Indicators
- ☑️ Incidents
- ☑️ IOC Management
- ☑️ IOCs (Indicators of Compromise)
- ☑️ Zero Trust Assessment
All 12 read scopes are required. Missing any scope will result in incomplete data synchronization or integration errors.
Create Client
Click the Create button to generate the API client
Copy Credentials
The modal will display your new credentials. Copy these immediately:
- Client ID
- Client Secret
- Base URL
Save these values now! You will not be able to view the Client Secret again. Store them securely in a password manager or secrets vault.
Adjusting Scopes Later: If you need to modify scopes after creation, click the three dots (⋮) to the right of the client listing on the API clients and keys page and select Edit.
Step 3: Determine Regional Base URL
CrowdStrike Falcon uses different base URLs depending on your data center region. The Base URL is provided when you create the API client.
Common Regional URLs
| Region | Base URL |
|---|---|
| US-1 | https://api.crowdstrike.com |
| US-2 | https://api.us-2.crowdstrike.com |
| EU-1 | https://api.eu-1.crowdstrike.com |
| US-GOV-1 | https://api.laggar.gcw.crowdstrike.com |
The Base URL is automatically displayed when you create the API client in Step 2. Use the exact URL provided by CrowdStrike.
For a complete list of regional endpoints, see CrowdStrike's Base URLs documentation.
Step 4: Configure in RAD Security
Navigate to your RAD Security workspace and configure the CrowdStrike Falcon Insight integration with the following parameters:
Required Parameters
| Parameter | Description | Example |
|---|---|---|
| Base URL | Base URL from Step 2 | https://api.us-2.crowdstrike.com |
| Client ID | Client ID from Step 2 | abc123def456... |
| Client Secret | Client Secret from Step 2 | xyz789abc123... |
Do NOT configure token_url: The integration automatically handles OAuth2.0 token management. You do not need to set or configure the token_url parameter.
Verify Integration
After completing the setup, verify your integration is working:
- Navigate to Data Sources > Integrations > EDR in RAD Security
- Locate your CrowdStrike Falcon Insight integration
- Check the connection status shows as Connected
- Verify endpoint data and detections are being synced
Your CrowdStrike Falcon Insight integration is now configured! RAD Security can now correlate endpoint detections with container and cloud runtime events.
What Data is Synced
Once configured, RAD Security will sync the following data from CrowdStrike Falcon Insight:
Use Cases
Endpoint-Container Correlation Correlate CrowdStrike endpoint detections with RAD Security's container runtime activity to detect cross-platform attacks.
Threat Intelligence Integration Leverage CrowdStrike's threat intelligence with RAD Security's runtime context for enhanced detection accuracy.
Coordinated Response Execute coordinated response actions across endpoints and containerized infrastructure from a single platform.
Zero Trust Enforcement Integrate CrowdStrike's Zero Trust Assessment with RAD Security for comprehensive security posture management.
Troubleshooting
Security Best Practices
Rotate Credentials Regularly Periodically create new API clients and delete old ones to maintain security hygiene.
Least Privilege Scopes Only grant the required scopes. Avoid adding unnecessary additional scopes to the API client.
Secure Credential Storage Store Client ID and Secret in a secure password manager or secrets vault. Never commit to version control.
Monitor API Usage Regularly review API client activity in CrowdStrike Console to detect anomalous behavior.
Audit Client Access Periodically review all API clients and ensure unused clients are removed.
API Client Management
To manage your CrowdStrike API clients:
View Existing Clients
Navigate to Support and resources > Resources and tools > API clients and keys to view all active API clients
Edit Client Scopes
Click the three dots (⋮) next to a client and select Edit to modify scopes
Rotate Credentials
- Create a new API client with the same scopes
- Update RAD Security with the new Client ID and Secret
- Verify the integration works
- Delete the old API client
Revoke Compromised Credentials
If credentials are compromised, immediately delete the API client in CrowdStrike Console and create a new one
Additional Resources
CrowdStrike OAuth2 APIs
Official CrowdStrike OAuth2-based APIs documentation
CrowdStrike Base URLs
Complete list of regional base URLs
CrowdStrike Falcon Spotlight
Configure CrowdStrike for vulnerability management
CrowdStrike NextGen SIEM
Integrate CrowdStrike NextGen SIEM for unified threat analysis