CrowdStrike Integration

This document outlines the process for creating API credentials in CrowdStrike Falcon so the Event Streams API can be used to integrate with Unified Security Stack.

Requirements

Step 1: Navigate to API Clients and Keys

From the CrowdStrike Falcon main console:

1. Click the menu icon (top-left corner).

2. Select Support and resources.

3. Click API clients and keys.

Step 2: Create a New API Client

1. In the OAuth2 API clients section, click Create API client.

Step 3: Generate API Credentials

1. Provide a descriptive Client name (for example: SYNOTI_SIEM_Connector).

2. Select the required API scopes for Event Streams.

3. Click Create.

Step 4: Record API Credentials

After creating the client:

1. Copy and securely store the following information:

• Client ID

• Client Secret

• Base URL (region-specific)

Step 5: Enter the Configuration in Unified Security Stack

1. Go to the CrowdStrike integration module inside Unified Security Stack.

2. Fill in the following fields using the information generated in CrowdStrike:

   • Client ID: The Client ID produced by CrowdStrike.

• Client Secret: The Client Secret produced.

• Cloud Region URL: The regional Base URL (for example: https://api.eu-1.crowdstrike.com).

• App Name: A descriptive label for identifying the integration.

1. Click Save configuration to store the settings.

Step 6: Activate the Integration

1. Once the configuration has been saved, select the relevant button to enable the Unified Security Stack features associated with this integration.

2. If the integration is active, the button will display Disable integration, which indicates successful enablement.