CrowdStrike Falcon
Bring CrowdStrike Falcon alerts into the security signal inbox for review.
At a glance
| Direction | Into Aegis. |
|---|---|
| What it brings in | New Falcon alerts. |
| Where it lands |
The security signal inbox (/incidents/signals); a sync
never creates an incident (see
Incidents).
|
| Credentials and permissions |
A Falcon API client (client ID and secret) with the scope
Alerts: Read, and the cloud region of your Falcon
tenant (US_1, US_2, EU_1 or
GOV_1). Server to server: no browser sign-in.
|
| Owner of imported records | A signal has no owner; the incident created on acceptance belongs to the reviewer. |
| When it runs |
On demand, or on a schedule under Sync Settings (see
Connectors).
|
| Set it up |
/connectors/crowdstrike, by people allowed to configure
connectors, on a plan that includes the connector.
|
Good to know
- Alerts already in the inbox or already imported as incidents are skipped.
- A new or changed configuration stays disconnected until a connection test or sync succeeds.
Where this connects
Signals are reviewed in Incidents.