Integrations/CrowdStrike Falcon/Setup Guide
Setup Guide

CrowdStrike Falcon Setup Guide

Follow the steps below to connect, authorize, verify, and schedule collection. If you want help mapping exports to your environment, book a walkthrough.

At a Glance
ConnectionDirect connection
CategoryEndpoint security
Guide3 steps
Need help?
We will map modules and reviewer-ready exports to your process.

Steps

Use these as a starting point, then verify collection inside Aurora.

  1. 1
    Create Falcon API client with read scopes for hosts and detections.
  2. 2
    Validate by listing a sample of hosts.
  3. 3
    Enable incremental sync.

Credentials

The inputs Aurora needs to authorize and collect proof.

client_idclient_secret

Permissions

Aurora requests only the minimum access needed for collection and checks.

Permissions depend on the selected collection mode and configured scope.