> ## Documentation Index
> Fetch the complete documentation index at: https://airmdr-docs-crowdstrike-skills-catalog.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.
# CrowdStrike
> CrowdStrike is a cloud-delivered security solution that detects, investigates, and mitigates threats on endpoints in real-time.
### Pre-requisites
* User must **download and install the Falcon sensor** on each endpoint and will need the **Customer ID Checksum (CID)** to activate the sensor.
* Ensure that the endpoints can reach CrowdStrike's cloud through **specific URLs and ports**, including:
* **HTTPS (TCP Port 443)** to:
* `api.crowdstrike.com`
* `sensorapi.crowdstrike.com`
* Other regional subdomains depending on your tenant (e.g., `us-2.crowdstrike.com`, `eu-1.crowdstrike.com`)
### Generate CrowdStrike API Client ID & Secret
1. Login to the [Falcon Console](https://falcon.crowdstrike.com).
2. Sign in using your **CrowdStrike Falcon credentials** (admin or user with API management permissions).
1. On the left-hand navigation panel, click **“Support and resources”**.
2. Select **Resources and tools** dropdown.
3. Click on **API clients and keys**.
1. Select the toggle tab "**OAuth2API clients**".
2. Click the **“Create API client”** button.
3. Fill out the form:
* **Client name**: Choose something descriptive (e.g., "AirMDR Integration").
* **Description**: Optional, but helpful for team context.
1. Provide the required **permissions (scopes)** for AirMDR use case as stated below:
Assign permissions based on the specific Skills you plan to use in AirMDR. Each Skill requires a defined set of actions, and only those permissions should be granted.
* `Alerts` → `Read` (To Fetch Crowdstrike Alerts)
* `Alerts` → `Write` (To Update Crowdstrike Alerts)
* `Detections` → `Read` (To Fetch Crowdstrike Detections)
* `Incidents` → `Read` (To Fetch Crowdstrike Incidents)
* `Incidents` → `Write` (To Update Crowdstrike Incidents)
* `Hosts` → `Read` (To Get Crowdstrike Device Details)
* `Hosts` → `Write` (To Perform Action on Host and Perform Device Action)
* `NGSIEM` → `Read and Write` (To Create Crowdstrike Query Job)
* `On-demand Scans (ODS)` → `Read and Write` (To Create ODS Scan)
You can assign multiple scopes depending on your needs.
* Edit API client
* Use the option to update the assigned Scopes
* Delete API client
* The **Client ID and Secret are permanently revoked**
* All **integrations, scripts, or tools using that API client will stop working**
* This action **cannot be undone**
* Reset secret (Reset the client secret immediately if you suspect credentials compromise)
* The **old secret becomes invalid** immediately after reset.
* All applications or scripts using the API must be updated with the **new secret**.
* If you want a different **Client Name or scopes**, you will need to **create a new client** — these can not be edited either
* Open details panel
* To view the details of the client id and scopes assigned.
1. Click **“Create”**.
2. The system will generate:
* **Client ID**
* **Client Secret**
**Copy and save these credentials immediately** – **the** **Client secret is shown only once**.
3. To view the Base URL
You can always view your Crowdstrike Base URL under the **API clients and keys** page.
Your **API base URL** depends on your Falcon tenant region: To know the Region-specific endpoint for all API calls refer to the below table:
| Region | Base URL |
| :------------- | :--------------------------------------- |
| US-1 | `https://api.crowdstrike.com` |
| US-2 | `https://api.us-2.crowdstrike.com` |
| EU-1 (Germany) | `https://api.eu-1.crowdstrike.com` |
| EU-2 (Ireland) | `https://api.eu-2.crowdstrike.com` |
| US GovCloud | `https://api.laggar.gcw.crowdstrike.com` |
Done! now you have the required credentials
* **Client ID** → For API authentication
* **Client Secret** → Used only once to get an access token
* **Base URL** → Region-specific endpoint for all API calls
Share the **Client ID, Client Secret** and **Base URL** securely to AirMDR.\
(or) \
Self [Configure](https://docs.airmdr.com/Integrations/Crowdstrike#configure-crowdstrike-api-in-airmdr-integrations-dashboard) Crowdstrike API in the AirMDR Integrations Dashboard.
### Skills Provided by this Integration
#### Alerts, Detections and Incidents
| **Skill ID** | **Purpose** |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Fetch CrowdStrike Alerts** | Fetch alerts from CrowdStrike, including detailed summaries for analysis or monitoring. |
| **Fetch CrowdStrike Detections** | Fetch detections from CrowdStrike, including detailed summaries for analysis or monitoring. |
| **Fetch CrowdStrike IOM Detections** | Fetch detections from CrowdStrike, including detailed summaries for analysis or monitoring. |
| **Get CrowdStrike Device Details** | Given an IP address, fetch device details including host name and user logon details. Given a hostname, fetch device details including IP address and user logon details. |
| **Fetch CrowdStrike Incidents** | Fetch Incidents from CrowdStrike, including detailed information for analysis or monitoring. |
| **Fetch CrowdStrike IOA Detections** | Fetch detections from CrowdStrike, including detailed summaries for analysis or monitoring. |
| **Fetch CrowdStrike Container Alerts** | Fetch container security alerts from Falcon Container Security, covering runtime behavioral threats in containerized workloads. |
| **Update CrowdStrike Alerts** | Triage, assign, tag, comment on, or close one or more Falcon alerts. |
| **Update Crowdstrike Incidents** | Update one or more Falcon incidents, supporting the full incident lifecycle including status transitions and assignment. |
| **Update Crowdstrike Iom Status** | Update the remediation status of one or more Falcon Cloud Security IOM findings. |
| **Get Crowdstrike Crowdscore** | Retrieve CrowdScore time-series data, CrowdStrike's organization-level measure of current threat activity. |
#### Hosts and Response Actions
| **Skill ID** | **Purpose** |
| ---------------------------------------- | --------------------------------------------------------------------------------------------------- |
| **Perform Action on Host** | Run a host-level action on a Falcon-managed device, resolving the target by hostname or IP address. |
| **Perform Device Action** | Run a device-level action on one or more Falcon-managed hosts identified by device ID (AID). |
| **Execute Crowdstrike RTR Command** | Run a Real-Time Response read-only or active command on a managed endpoint and return its output. |
| **List Crowdstrike Host Groups** | List the static and dynamic host groups configured in Falcon Device Management. |
| **Get Crowdstrike Host Vulnerabilities** | Retrieve Falcon Spotlight vulnerability findings, mapping CVEs to specific managed endpoints. |
| **Create ODS Scan V1** | Create and start an On-Demand Scan job on one or more Falcon-managed endpoints. |
| **ODS Aggregate Scan Hosts** | Retrieve bucketed summaries of On-Demand Scan host states across one or more scans. |
#### Threat Intelligence and IOCs
| **Skill ID** | **Purpose** |
| --------------------------------------- | ------------------------------------------------------------------------------------- |
| **Create Crowdstrike Custom Ioc** | Create a custom IOC (IP address, domain, URL, or file hash) in Falcon IOC management. |
| **List Crowdstrike Custom Iocs** | List the custom IOCs currently defined in Falcon IOC management. |
| **Search Crowdstrike Intel Indicators** | Search CrowdStrike-curated Falcon Intelligence threat indicator records. |
#### Query Building and LogScale
| **Skill ID** | **Purpose** |
| ------------------------------------------ | -------------------------------------------------------------------------------------------- |
| **Build Crowdstrike Fql Query** | Construct a valid Falcon Query Language (FQL) filter string from structured parameters. |
| **List Crowdstrike Fql Fields** | List the filterable FQL fields and their valid values for a given CrowdStrike resource type. |
| **Create CrowdStrike Query Job** | Run a LogScale (formerly Humio) query job against a Falcon telemetry repository. |
| **List Crowdstrike Logscale Repositories** | List the LogScale repositories available in the Falcon environment. |
| **List Crowdstrike Logscale Fields** | List the event field names and metadata available in a given LogScale repository. |
#### Users
| **Skill ID** | **Purpose** |
| -------------------------------- | ---------------------------------------------------------------- |
| **Get CrowdStrike User Details** | Retrieve Falcon platform user accounts and their assigned roles. |
To view the details of Input Parameters and Output for the respective skills
* Go to [AirMDR → Crowdstrike](https://app.airmdr.com/integrations?search=crowds\&provider=1f07ba14-afe0-4685-921f-187d1de61686) Integration page.
* Select the **Skills** tab and click on the required listed skills.
### Configure Crowdstrike API in AirMDR Integrations Dashboard
1. Navigate to [AirMDR](https://app.airmdr.com/auth/login), provide the credentials and click **Login**.
2. Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select **Integrations**.
3. Use the search option, enter the keyword "**Crowdstrike**", select the **Connections** tab, and click **Add New Connection**.
4. Enter an unique name to the **Instance** (e.g., `your org name-Crowdstrike`) and brief **Description** to easily identify the user connection by AirMDR.
5. Enter the generated **client\_id, client\_secret,** **base\_url** and Expiry (optional) in the Authentication Details field params, and click **Save.**
### Evaluate Crowdstrike API
Open **cURL** and run the following command to check if your API Key is working:
**Request**
```
curl --location '/oauth2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=' \
--data-urlencode 'client_secret=' \
--data-urlencode 'grant_type=client_credentials'
```
**Response**
```
{
"access_token": "",
"expires_in": 1799,
"token_type": "bearer"
}
```