> ## Documentation Index > Fetch the complete documentation index at: https://docs.rad.security/llms.txt > Use this file to discover all available pages before exploring further. # CrowdStrike Falcon Insight > Configure CrowdStrike Falcon Insight EDR integration with RAD Security for advanced endpoint detection and response. # CrowdStrike Falcon Insight Integration Setup This guide walks you through integrating CrowdStrike Falcon Insight EDR with RAD Security for advanced endpoint detection and response capabilities, enabling you to correlate endpoint security events with container and cloud runtime activity. CrowdStrike Falcon Insight provides real-time endpoint detection and response (EDR), threat intelligence, and automated response actions for comprehensive endpoint security. ## Prerequisites Before you begin, ensure you have: * Access to CrowdStrike Falcon Console * **Administrator privileges** in CrowdStrike Console * Access to RAD Security workspace with integration permissions **Administrative Privileges Required:** You must have administrative privileges in CrowdStrike Console to create API clients and manage scopes in the API Clients and Keys section. *** ## Understanding CrowdStrike API Scopes This integration requires specific API scopes to access endpoint data, detections, incidents, and threat intelligence: The following scopes require **Read** permissions: * **Alerts** - Access to security alerts * **Apps** - Application inventory data * **Custom IOA rules** - Indicator of Attack rules * **Detections** - Threat detections * **Device control policy** - Device control configurations * **Hosts** - Endpoint inventory and status * **Assets** - Asset management data * **Indicators** - Threat indicators * **Incidents** - Security incidents * **IOC Management** - Indicator of Compromise management * **IOCs (Indicators of Compromise)** - IOC data * **Zero Trust Assessment** - Zero trust posture data The following scope requires **Write** permissions: * **Hosts** - Required to perform response actions on endpoints **Both Read and Write permissions on Hosts:** The Hosts scope requires both Read (included in the 11 read scopes above) and Write permissions for full integration functionality. *** ## Step 1: Access CrowdStrike Falcon Console Log in to your CrowdStrike Falcon Console with administrative privileges Open the main menu and go to: **Support and resources > Resources and tools > API clients and keys** *** ## Step 2: Create API Client Click the **Create API client** button In the modal dialog: 1. **Client name:** Enter a descriptive name (e.g., "RAD Security EDR Integration") 2. **Description:** (Optional) Add details about this integration Select **Read** permissions for the following scopes: * ☑️ **Alerts** * ☑️ **Apps** * ☑️ **Custom IOA rules** * ☑️ **Detections** * ☑️ **Device control policy** * ☑️ **Hosts** * ☑️ **Assets** * ☑️ **Indicators** * ☑️ **Incidents** * ☑️ **IOC Management** * ☑️ **IOCs (Indicators of Compromise)** * ☑️ **Zero Trust Assessment** All 11 read scopes are required. Missing any scope will result in incomplete data synchronization or integration errors. Select **Write** permissions for: * ☑️ **Hosts** Write permission on Hosts enables RAD Security to perform response actions on endpoints when needed, such as containment or isolation. Click the **Create** button to generate the API client The modal will display your new credentials. **Copy these immediately:** * **Client ID** * **Client Secret** * **Base URL** **Save these values now!** You will not be able to view the Client Secret again. Store them securely in a password manager or secrets vault. **Adjusting Scopes Later:** If you need to modify scopes after creation, click the three dots (⋮) to the right of the client listing on the API clients and keys page and select Edit. *** ## Step 3: Determine Regional Base URL CrowdStrike Falcon uses different base URLs depending on your data center region. The Base URL is provided when you create the API client. ### Common Regional URLs | Region | Base URL | | -------- | ---------------------------------------- | | US-1 | `https://api.crowdstrike.com` | | US-2 | `https://api.us-2.crowdstrike.com` | | EU-1 | `https://api.eu-1.crowdstrike.com` | | US-GOV-1 | `https://api.laggar.gcw.crowdstrike.com` | The Base URL is automatically displayed when you create the API client in Step 2. Use the exact URL provided by CrowdStrike. For a complete list of regional endpoints, see [CrowdStrike's Base URLs documentation](https://falcon.us-2.crowdstrike.com/documentation/page/a2a7fc0e/crowdstrike-oauth2-based-apis#k9578c40). *** ## Step 4: Configure in RAD Security Navigate to your RAD Security workspace and configure the CrowdStrike Falcon Insight integration with the following parameters: ### Required Parameters | Parameter | Description | Example | | ----------------- | ------------------------- | ---------------------------------- | | **Base URL** | Base URL from Step 2 | `https://api.us-2.crowdstrike.com` | | **Client ID** | Client ID from Step 2 | `abc123def456...` | | **Client Secret** | Client Secret from Step 2 | `xyz789abc123...` | **Do NOT configure token\_url:** The integration automatically handles OAuth2.0 token management. You do not need to set or configure the token\_url parameter. *** ## Verify Integration After completing the setup, verify your integration is working: 1. Navigate to **Data Sources > Integrations > EDR** in RAD Security 2. Locate your CrowdStrike Falcon Insight integration 3. Check the connection status shows as **Connected** 4. Verify endpoint data and detections are being synced Your CrowdStrike Falcon Insight integration is now configured! RAD Security can now correlate endpoint detections with container and cloud runtime events. ## What Data is Synced Once configured, RAD Security will sync the following data from CrowdStrike Falcon Insight: * Endpoint inventory and status * Operating system details * CrowdStrike agent version * Host configuration * Last seen timestamps * Asset information * Real-time threat detections * Security alerts * Detection severity and classification * Malware and exploit detections * Behavioral indicators * Detection timelines * Security incidents * Incident severity and status * Related detections * Incident timelines * Investigation data * Remediation actions * Indicators of Compromise (IOCs) * Indicators of Attack (IOAs) * Custom IOA rules * Threat indicators * File hashes, IPs, domains * Indicator metadata * Application inventory * Device control policies * Policy compliance status * Application execution data * Blocked applications * Zero trust posture scores * Security assessments * Compliance status * Risk indicators * Security recommendations ## Use Cases Correlate CrowdStrike endpoint detections with RAD Security's container runtime activity to detect cross-platform attacks. Leverage CrowdStrike's threat intelligence with RAD Security's runtime context for enhanced detection accuracy. Execute coordinated response actions across endpoints and containerized infrastructure from a single platform. Integrate CrowdStrike's Zero Trust Assessment with RAD Security for comprehensive security posture management. ## Troubleshooting **Possible causes:** * Client ID or Client Secret incorrect * API client was deleted or disabled * Wrong regional Base URL * OAuth token issues **Solution:** * Verify Client ID and Secret are copied correctly (no extra spaces) * Check the API client still exists in CrowdStrike Console * Ensure you're using the correct regional Base URL * Do NOT set token\_url parameter * Create a new API client if needed **Possible causes:** * Not all 11 read scopes selected * Hosts write scope not selected * Scopes were modified after creation **Solution:** * Verify all required read scopes are enabled * Ensure Hosts has both Read and Write permissions * Edit the API client to add missing scopes * Review the complete list of required scopes in Step 2 **Possible causes:** * Missing specific scopes for data types * Insufficient permissions * API rate limits **Solution:** * Check which scopes correspond to missing data types * Verify all 12 scopes (11 read + 1 write) are enabled * Review integration logs for specific API errors * Monitor API usage to ensure you're within rate limits **Possible causes:** * Missing Hosts write scope * Write permission removed after creation * Endpoint isolation policy restrictions **Solution:** * Verify Hosts scope has Write permission enabled * Check API client permissions in CrowdStrike Console * Ensure endpoint policies allow remote actions * Review CrowdStrike response action settings **Possible causes:** * Using incorrect regional endpoint * Typo in Base URL * Using old URL format **Solution:** * Use the exact Base URL provided during API client creation * Verify your CrowdStrike region (US-1, US-2, EU-1, etc.) * Check [CrowdStrike's regional endpoints documentation](https://falcon.us-2.crowdstrike.com/documentation/page/a2a7fc0e/crowdstrike-oauth2-based-apis#k9578c40) * Ensure URL includes `https://` and correct format **Possible causes:** * token\_url parameter was manually configured * Incorrect OAuth configuration **Solution:** * Do NOT set the token\_url parameter * Remove any token\_url configuration if present * The integration automatically handles OAuth2.0 token management * Use only URL, ClientId, and ClientSecret parameters ## Security Best Practices Periodically create new API clients and delete old ones to maintain security hygiene. Only grant the required scopes. Avoid adding unnecessary additional scopes to the API client. Store Client ID and Secret in a secure password manager or secrets vault. Never commit to version control. Regularly review API client activity in CrowdStrike Console to detect anomalous behavior. Periodically review all API clients and ensure unused clients are removed. Monitor and audit response actions performed through the integration for compliance. ## API Client Management To manage your CrowdStrike API clients: Navigate to **Support and resources > Resources and tools > API clients and keys** to view all active API clients Click the three dots (⋮) next to a client and select **Edit** to modify scopes 1. Create a new API client with the same scopes 2. Update RAD Security with the new Client ID and Secret 3. Verify the integration works 4. Delete the old API client If credentials are compromised, immediately delete the API client in CrowdStrike Console and create a new one ## Additional Resources Official CrowdStrike OAuth2-based APIs documentation Complete list of regional base URLs Configure CrowdStrike for vulnerability management Integrate CrowdStrike NextGen SIEM for unified threat analysis ## Next Steps Explore other EDR integration options Learn about RAD's container runtime security Configure correlated alerts and incident management Understand how threats are detected across platforms