CrowdStrike Insight (Direct)
Connect CrowdStrike Falcon Insight directly to RAD Security and query detections and alerts with CrowdStrike's own fields, MITRE ATT&CK mapping and host context.
RAD Security connects directly to the CrowdStrike Falcon API with an OAuth2 API client and imports Falcon detections and alerts into the crowdstrike_alerts data type, keeping CrowdStrike's own fields: the alert's id, status, severity and confidence scores, MITRE ATT&CK tactic and technique, the process, file and indicator behind it, and a snapshot of the host it fired on.
Read-only integration. RAD exchanges the API client's credentials for a short-lived token and only reads alerts. It never changes an alert's status, assigns it, or acts on a host. (Response actions are a separate feature — see CrowdStrike Falcon Response Actions.)
Direct, or through the CrowdStrike Falcon Insight card? This page covers the CrowdStrike Insight card, which connects to Falcon directly and keeps CrowdStrike's fields. The older CrowdStrike Falcon Insight card maps alerts into RAD's shared findings. Both can run side by side.
Prerequisites
- A CrowdStrike Falcon subscription with Insight XDR (Falcon EDR)
- Permission to create API clients in the Falcon console (Falcon Administrator)
- Your Falcon cloud region (US-1, US-2, US-3, EU-1, US-GOV-1 or US-GOV-2)
- A RAD Security workspace with integration permissions
What RAD stores
| Object | RAD data type | One row per |
|---|---|---|
| Detections and alerts | crowdstrike_alerts | alert (CrowdStrike composite id) |
Each row carries:
- Classification: name, display name, description, product, type, platform, objective and scenario, tags
- MITRE ATT&CK: tactic and technique (name and id), plus every pattern, tactic and technique id the alert maps to
- Triage:
status,is_open, resolution, assignee, severity and severity score, confidence score, time to triage and to resolve - Incident: incident id, score and time range
- Disposition: the pattern disposition (for example blocked or quarantined), quarantined files
- Forensics: file name and path, command line, MD5 / SHA-1 / SHA-256, process ids and times, user, the indicator of compromise (type, value, source)
- Host snapshot: hostname, platform, OS version, agent version, local and external IP, MAC, domain, site, cloud instance, Kubernetes pod and namespace, host groups and tags, a link to the host in Falcon
- Times: event, created, updated and crawled timestamps
The data type is queryable in the Evidence Room, dashboard widgets, the data API and radbot.
Step 1: Create an API client in Falcon
Open API clients and keys
Sign in to the Falcon console as a Falcon Administrator and open Support and resources > API clients and keys.
Create the client
Select Create API client and name it, for example RAD Security - Insight.
Grant one scope
Tick Read for Alerts (Alerts:read). Nothing else is needed.
Falcon issues a token for an API client that lacks the scope, and refuses only the first read. RAD's verification makes that first read, so a missing scope is reported when you save the integration.
Copy the Client ID and Secret
Falcon shows the Client Secret only once. Copy both values before you close the dialog. The console also shows the Base URL, which tells you the region.
Step 2: Configure in RAD Security
Open Data Sources > Integrations > EDR, add the CrowdStrike Insight integration and fill in the fields.
| Field | Required | Value |
|---|---|---|
| Client ID | Yes | The API client's Client ID |
| Client Secret | Yes | The API client's Client Secret |
| Falcon Cloud Region | Yes | Your Falcon cloud: us-1, us-2, us-3, eu-1, us-gov-1 or us-gov-2 |
| Member CID | No | Leave blank unless the API client belongs to a Flight Control (MSSP) parent CID |
Member CID is for Flight Control (MSSP) parents only. On a parent credential, enter the CID of the one child to import; every other child is then imported by nothing, with no error. Left blank on a parent credential, alerts from several children arrive together in this one RAD workspace. On an ordinary tenant, leave it blank.
One API client with both Alerts:read and Vulnerabilities:read can serve this integration and CrowdStrike Spotlight together; RAD shares its token between them.
Once the status shows Connected, the first pass walks the alert history Falcon retains and can take several sync cycles. After that each cycle reads only new and updated alerts.
Reading the data
Open is a column
An alert is open when is_open = 1: its status is new, in_progress or reopened. Filter is_open rather than reconstructing it from status.
An alert is an event
The row id is CrowdStrike's own composite id, unchanged. An alert is written when Falcon hands it over and rewritten when it changes (status, assignee, resolution). It is never removed because a later pass did not return it: unlike a vulnerability, an alert that stops being returned has aged out of Falcon's retention, not been fixed.
Host context is a snapshot
The host_* columns describe the host as it was when the alert was read. They do not change when the host is later renamed or moved to another group.
Sync cadence
Each sync cycle reads the alerts created or updated since the last one, in one-hour windows, bounded to about ten minutes per cycle so a large backlog is worked off over several cycles.