Crowdstrike

CrowdStrike is a cloud-delivered, next-generation services for endpoint protection, threat intelligence and response. It helps stop breaches and secures businesses of all shapes and sizes.

In order to integrate CrowdStrike with Relyance AI you will need a Base URL, Client ID, and Client Secret.

In CrowdStrike:

1. From the homepage dashboard, after logging in there should be a dark menu bar across the top of the screen, at the left of that bar select the menu drop-down icon (Three dots stacked vertically next to the crowdstrike icon).
2. This will bring you to the menu page and will present options for you. Select 'API Clients and Keys' from the support section.
3. From here we will be able to generate an API key for the relyance application. To do this, select 'Add new API client' near the top right of the screen.
4. Here you will be asked to give the API client a name and description. For name you can put 'Relyance' and for description 'Property Scan'.
5. Next we will select the scopes for the API client. The scopes that you are going to want to add ' READ ' access to are:
   • Alerts
   • Assets
   • CustomIOARules
   • Detections
   • DeviceControlPolicy
   • FalconDiscover
   • FileVantage
   • FirewallManagement
   • Hosts
   • Incidents
   • IOCManagement
   • PreventionPolicy
   • RealTimeResponseAudit
   • Reports (Falcon Intelligence)
   • Scheduled Reports
   • SensorUpdatePolicy
   • UserManagment
6. After you have selected the appropriate scopes, select ADD and you will be shown the Client ID, Client Secret, and Base URL. Copy these settings to be used in Relyance AI.

In the Relyance AI application:

1. Login to your Relyance AI account.
2. Navigate to the Settings (bottom-left corner).
3. Select Integrations.
4. Search and locate the Crowdstrike integration card and click on it.
5. Click on the Add Connection button on the top right.
6. Provide a meaningful name for the integration and click on the Add button.
7. In the Overview section, select the integration features you wish to enable for the integration, review the Scope and Permission, and Endpoint details and click on Continue. For more details, see Integration Features.
8. In the Connection section, provide the appropriate values and click on Continue,
   • Connection Name: This property allows you to update the integration specified in Step 6. If you have multiple integrations for the same vendor, you may want to assign distinct names to each. This helps streamline filtering by Discovery Source across the Inventory, Visual Maps, Assets, and Data Flow Analysis pages.
   • Rescan Frequency: This property allows you to configure how often Relyance executes scans against this Vendor connection.
   • Business Atlas Associations (required): the business entities or products that newly discovered third parties, services and assets from this integration are attributed to. Choose at least one from the Select Associations dropdown — the wizard will not advance past this step without one. For more details, see Business Atlas.
9. In the Authentication section, provide the following information retrieved from the In CrowdStrike section and click on Authenticate
   • Base URL
   • Client ID
   • Client Secret
10. This step applies only if the Data Inspection check box was enabled in Step 7. In the Data Inspection section, provide the appropriate values and click on Continue,
    • Minimum Confidence Level: This property adjusts the sensitivity of the Data Inspection feature. Lower likelihoods (e.g., unlikely) offer more coverage but may produce false positives, while higher sensitivity (e.g., very likely) provides greater accuracy but less coverage.
11. Review the configuration summary from the Completion section and click on Finish.
12. Confirm the integration Status reflects Connected

Verify the connection is really working

1. Base URL is region-specific. CrowdStrike runs separate clouds (us-1, us-2, eu-1, us-gov-1) and an API client is only valid in the one it was created in. The wrong Base URL fails authentication in a way that reads as bad credentials — check which cloud your Falcon console is on before anything else.
2. Scopes are ticked per API client, one at a time. The integration reads hosts, alerts, assets, policies, IOC management and user management. Each is a separate read scope on the API client, and a missing one removes that data from the results rather than failing the connection.
3. Maximum Concurrent API Calls defaults to 3 because CrowdStrike rate-limits aggressively. Raising it on a busy tenant produces 429s that surface as a partial scan.
4. Client secrets are shown once. If the secret was not captured at creation, regenerate it rather than guessing — and re-paste it here, since the stored value is not updated by a rotation in Falcon.

Authentication methods and fields

Pick one of these under Authentication Method on the connection wizard's Authentication step. This table is generated from the integration catalog, so it always matches what the form actually asks for.

Manage this integration with Terraform

Connections for this integration can be managed as code with the Relyance Terraform provider. Non-secret fields go in auth.params; secret fields go in auth.secrets_wo, which is write-only — never stored in Terraform state. Rotate secrets by bumping auth.secrets_wo_version.

resource "relyance_integration_connection" "crowdstrike" {
  vendor = "crowdstrike"
  name   = "<your connection name>"

  auth = {
    method = "oauth-client-credentials"
    params = {
      base_url = "<base_url>"
      client_id = "<client_id>"
      data_storage_location = "us"
    }
    # Secret fields are write-only: sent to Relyance, never stored in state.
    secrets_wo = {
      client_secret = var.crowdstrike_client_secret
    }
    secrets_wo_version = 1
  }

  scans = { "data-inspection" = { enabled = true } }
}