# Crowdstrike

![CS_Logos_2020_InlineBlack.png](https://assets.relyanceuat.xyz/images/docs/34832536461709/34832550492301.png)
CrowdStrike is a cloud-delivered, next-generation services for endpoint protection, threat intelligence and response. It helps stop breaches and secures businesses of all shapes and sizes.

In order to integrate CrowdStrike with Relyance AI you will need a **Base URL**, **Client ID**, and **Client Secret**.

**In CrowdStrike:**

1. From the homepage dashboard, after logging in there should be a dark menu bar across the top of the screen, at the left of that bar select the menu drop-down icon (Three dots stacked vertically next to the crowdstrike icon).
2. This will bring you to the menu page and will present options for you. Select '**API Clients and Keys**' from the support section.
3. From here we will be able to generate an API key for the relyance application. To do this, select '**Add new API client**' near the top right of the screen.
4. Here you will be asked to give the API client a name and description. For name you can put '**Relyance**' and for description '**Property Scan**'.
5. Next we will select the scopes for the API client. The scopes that you are going to want to add ' **READ** ' access to are:
    - Alerts
    - Assets
    - CustomIOARules
    - Detections
    - DeviceControlPolicy
    - FalconDiscover
    - FileVantage
    - FirewallManagement
    - Hosts
    - Incidents
    - IOCManagement
    - PreventionPolicy
    - RealTimeResponseAudit
    - Reports (Falcon Intelligence)
    - Scheduled Reports
    - SensorUpdatePolicy
    - UserManagment
6. After you have selected the appropriate scopes, select **ADD** and you will be shown the **Client ID**, **Client Secret**, and **Base URL**. Copy these settings to be used in Relyance AI.

![CrowdStrike-1.png](https://assets.relyanceuat.xyz/images/docs/34832536461709/34832550493069.png)

![CrowdStrike-3.png](https://assets.relyanceuat.xyz/images/docs/34832536461709/34832550493709.png)

![CrowdStrike-2.png](https://assets.relyanceuat.xyz/images/docs/34832536461709/34832550493965.png)

**In the Relyance AI application:**

1. Login to your Relyance AI account.
2. Navigate to the **Settings** (bottom-left corner).
3. Select **Integrations**.
4. Search and locate the **Crowdstrike** integration card and click on it.
5. Click on the **Add Connection** button on the top right.
6. Provide a meaningful name for the integration and click on the **Add** button.
7. In the **Overview** section, select the integration features you wish to enable for the integration, review the **Scope and Permission**, and **Endpoint** details and click on **Continue**. For more details, see [Integration Features](/docs/introduction-to-relyance-ai/integration-features/).
8. In the **Connection** section, provide the appropriate values and click on **Continue**,
    - **Connection Name**: This property allows you to update the integration specified in Step 6. If you have multiple integrations for the same vendor, you may want to assign distinct names to each. This helps streamline filtering by **Discovery Source** across the **Inventory**, **Visual** **Maps**, **Assets**, and **Data Flow Analysis** pages.
    - **Rescan Frequency**: This property allows you to configure how often Relyance executes scans against this Vendor connection.
    - **Business Atlas Associations** (required): the business entities or products that newly discovered third parties, services and assets from this integration are attributed to. Choose at least one from the **Select Associations** dropdown — the wizard will not advance past this step without one. For more details, see [Business Atlas](/docs/other-settings/business-atlas-overview/).
9. In the **Authentication** section, provide the following information retrieved from the **In CrowdStrike** section and click on **Authenticate**
    - **Base URL**
    - **Client ID**
    - **Client Secret**
10. This step applies only if the **Data Inspection** check box was enabled in Step 7. In the Data Inspection section, provide the appropriate values and click on **Continue**,
    - **Minimum Confidence Level:** This property adjusts the sensitivity of the Data Inspection feature. Lower likelihoods (e.g., unlikely) offer more coverage but may produce false positives, while higher sensitivity (e.g., very likely) provides greater accuracy but less coverage.
11. Review the configuration summary from the **Completion** section and click on **Finish.**
12. Confirm the integration Status reflects **Connected**

![CrowdStrike_overview_20250224_193044.png](https://assets.relyanceuat.xyz/images/docs/34832536461709/34832536446349.png)

![Screenshot 2025-11-04 141843.png](https://assets.relyanceuat.xyz/images/docs/34832536461709/40851691715341.png)

![CrowdStrike_connection_20250224_193056.png](https://assets.relyanceuat.xyz/images/docs/34832536461709/34832536446989.png)

![Screenshot 2025-11-04 084617.png](https://assets.relyanceuat.xyz/images/docs/34832536461709/40848976117901.png)

![CrowdStrike_data_inspection_20250224_193104.png](https://assets.relyanceuat.xyz/images/docs/34832536461709/34832550495757.png)

![CrowdStrike_completion_20250224_193100.png](https://assets.relyanceuat.xyz/images/docs/34832536461709/34832536448141.png)

### Verify the connection is really working

1. **Base URL is region-specific.** CrowdStrike runs separate clouds (`us-1`,
   `us-2`, `eu-1`, `us-gov-1`) and an API client is only valid in the one it was
   created in. The wrong **Base URL** fails authentication in a way that reads as
   bad credentials — check which cloud your Falcon console is on before anything
   else.
2. **Scopes are ticked per API client, one at a time.** The integration reads
   hosts, alerts, assets, policies, IOC management and user management. Each is a
   separate read scope on the API client, and a missing one removes that data from
   the results rather than failing the connection.
3. **Maximum Concurrent API Calls defaults to 3** because CrowdStrike rate-limits
   aggressively. Raising it on a busy tenant produces 429s that surface as a partial
   scan.
4. **Client secrets are shown once.** If the secret was not captured at creation,
   regenerate it rather than guessing — and re-paste it here, since the stored value
   is not updated by a rotation in Falcon.

<!-- auth-methods:begin (generated from the integration catalog; do not hand-edit) -->

## Authentication methods and fields

Pick one of these under **Authentication Method** on the connection wizard's **Authentication** step. This table is generated from the integration catalog, so it always matches what the form actually asks for.

| Method | Required | Optional |
| --- | --- | --- |
| **Two Legged Oauth2** | `Base URL`, `Client ID`, `Client Secret` (secret) | `Maximum Concurrent API Calls` |

<!-- auth-methods:end -->

<!-- terraform-examples:begin (generated from the integration catalog; do not hand-edit) -->

## Manage this integration with Terraform

Connections for this integration can be managed as code with the [Relyance Terraform provider](https://registry.terraform.io/providers/Relyance/relyance/latest). Non-secret fields go in `auth.params`; secret fields go in `auth.secrets_wo`, which is write-only — never stored in Terraform state. Rotate secrets by bumping `auth.secrets_wo_version`.

```hcl
resource "relyance_integration_connection" "crowdstrike" {
  vendor = "crowdstrike"
  name   = "<your connection name>"

  auth = {
    method = "oauth-client-credentials"
    params = {
      base_url = "<base_url>"
      client_id = "<client_id>"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      client_secret = var.crowdstrike_client_secret
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}
```

<!-- terraform-examples:end -->