Skip to main content

How to integrate CrowdStrike Falcon account?

Overview​

To authenticate with CrowdStrike Falcon, you will need to provide the following information:

  • Client ID
  • Client Secret
  • Domain

Step 1: Login to CrowdStrike Falcon Console​

  1. Sign in to your CrowdStrike Falcon Console
  2. Ensure you have an account with API Client Administrator permissions or equivalent role

Step 2: Navigate to API Clients & Keys​

  1. In the Falcon console, click the hamburger menu (☰) in the top-left corner
  2. Navigate to Support and resources
  3. Select API Clients and Keys

Step 3: Create a New API Client​

  1. Click Add new API client

  2. Fill in the following details:

    • Client name: Enter a descriptive name (e.g., "Unizo Integration")
    • Description (optional): Add details about the integration purpose
CrowdStrike API Client Creation

  1. Select API Scopes - Choose the minimum required permissions for your use case:

    Essential Scopes for EDR/XDR Integration:

ScopeReadWritePurpose
Alerts✅❌Query alert data and threat/EDR events
Hosts✅✅Query endpoint information and quarantine endpoints from network. Excluding the write permissions disables the quarantine feature.
Assets✅❌Query application data
Zero Trust Assessment✅❌Query Security posture scores
  1. Click Create

Step 4: Copy Client ID, Client Secret and Base URL​

After creating the API client, a dialog will display your credentials:

  1. Client ID: Copy and save this value

  2. Client Secret: Copy immediately - this is shown only once

  3. Domain:Your cFalcon domain is the unique part of the URL you use to access Crowdstrike. For example: