---
title: "CrowdStrike"
slug: "crowdstrike"
updated: 2026-04-15T20:55:25Z
published: 2026-04-15T20:55:25Z
canonical: "docs.databee.buzz/crowdstrike"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# CrowdStrike

CrowdStrike’s security platform aims to stop breaches by offering advanced threat intelligence and real-time protection. CrowdStrike's solutions include endpoint protection, threat intelligence, and incident response services, all delivered through their cloud-based Falcon platform.

**Integration Method:** API **Tables**: Detection Finding (2004), Device Inventory Info (5001)

This integration supports the following events.

| **Event** | **Description** |
| --- | --- |
| Detections | Get detailed information about all detections. |
| Alerts | Get detailed information about all alerts. |
| Device | Get detailed information about all devices. |

This integration supports the following versions.

| CrowdStrike Sensor version | 7.15.18513.0 and 7.17.18604.0 |
| --- | --- |
| CrowdStrike API version | v1.0 |

## Prerequisites

- The user should ensure scopes are properly assigned to the API token for successful data retrieval.
- The user should have access to the DataBee console.

## Configuration Overview

1. Generate client credentials with the required scopes.
2. Add the [CrowdStrike data feed](/user-manual/docs/crowdstrike-security-integration#databee-configuration) in the DataBee console with the below parameters.

| **DataBee Parameter** | **CrowdStrike Parameter** |
| --- | --- |
| Client Id | Client Id |
| Client Secret | Secret |
| API Base URL | Base URL |

## CrowdStrike Configuration

Start by creating the API Client and get the necessary information for API authentication such as Client ID and Client Secret.

1. Log on to **CrowdStrike** Platform.
2. Navigate to the top-left Navigation menu > **Support and resources** > **API clients and keys**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/crowdstrike-image-pkdohi8u.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A00%3A12Z&se=2026-10-30T13%3A00%3A12Z&sr=c&sp=r&sig=UnCNYSidtXvDeOIZ%2B2WXyYgWw0e%2BaPsbtkdAevjbat0%3D)
3. Click on the **Create API client** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/crowdstrike-image-yd8bkeg0.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A00%3A12Z&se=2026-10-30T13%3A00%3A12Z&sr=c&sp=r&sig=UnCNYSidtXvDeOIZ%2B2WXyYgWw0e%2BaPsbtkdAevjbat0%3D)
4. Enter ‘Client Name’ to identify API clients. Also add ‘Description’ that describes the purpose for the API client, if desired. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/crowdstrike-image-trq9oonl.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A00%3A12Z&se=2026-10-30T13%3A00%3A12Z&sr=c&sp=r&sig=UnCNYSidtXvDeOIZ%2B2WXyYgWw0e%2BaPsbtkdAevjbat0%3D)
5. The following scope needs to be added for the endpoint to function properly:

| **Event** | **Permission** |
| --- | --- |
| Alerts | Alerts.Read |
| Detects | Detections.Read |
| Devices | Hosts.Read |
6. Select **Host-Read** scope to collect the device logs. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/crowdstrike-image-nlpi0tqi.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A00%3A12Z&se=2026-10-30T13%3A00%3A12Z&sr=c&sp=r&sig=UnCNYSidtXvDeOIZ%2B2WXyYgWw0e%2BaPsbtkdAevjbat0%3D)
7. Select **Alerts-Read** scope to collect alert logs.![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/crowdstrike-image-9ich2xf0.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A00%3A12Z&se=2026-10-30T13%3A00%3A12Z&sr=c&sp=r&sig=UnCNYSidtXvDeOIZ%2B2WXyYgWw0e%2BaPsbtkdAevjbat0%3D)
8. Select **Detection-Read** scope to collect detection logs. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/crowdstrike-image-xuzw8wta.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A00%3A12Z&se=2026-10-30T13%3A00%3A12Z&sr=c&sp=r&sig=UnCNYSidtXvDeOIZ%2B2WXyYgWw0e%2BaPsbtkdAevjbat0%3D)
9. Select **Incidents-Read** scope to collect incident logs.
10. Click on the **Create** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/crowdstrike-image-r8gxhcrk.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A00%3A12Z&se=2026-10-30T13%3A00%3A12Z&sr=c&sp=r&sig=UnCNYSidtXvDeOIZ%2B2WXyYgWw0e%2BaPsbtkdAevjbat0%3D)
11. Copy the **Base URL**, **Client ID**, and **Secret** for later use, then click **Done**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/crowdstrike-image-wfi046vs.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A00%3A12Z&se=2026-10-30T13%3A00%3A12Z&sr=c&sp=r&sig=UnCNYSidtXvDeOIZ%2B2WXyYgWw0e%2BaPsbtkdAevjbat0%3D)

> [!NOTE]
> Note:
> 
> You will not be able to view this again after you complete this step. Ensure that you copy it before closing the notification.

## DataBee Configuration

1. Login to the DataBee UI, navigate to **Data** **>** **Data Feeds** and click the **Add New Data Feed** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/crowdstrike-image-sfjeahoj.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A00%3A12Z&se=2026-10-30T13%3A00%3A12Z&sr=c&sp=r&sig=UnCNYSidtXvDeOIZ%2B2WXyYgWw0e%2BaPsbtkdAevjbat0%3D)
2. Search for **CrowdStrike** and click it as shown below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/crowdstrike-image-8dsqvi1d.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A00%3A12Z&se=2026-10-30T13%3A00%3A12Z&sr=c&sp=r&sig=UnCNYSidtXvDeOIZ%2B2WXyYgWw0e%2BaPsbtkdAevjbat0%3D)
3. Click on the **API Ingest** option for the collection method. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/crowdstrike-image-p6686f51.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A00%3A12Z&se=2026-10-30T13%3A00%3A12Z&sr=c&sp=r&sig=UnCNYSidtXvDeOIZ%2B2WXyYgWw0e%2BaPsbtkdAevjbat0%3D)
4. Enter feed contact information and click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/crowdstrike-image-q8ybfr0m.png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A00%3A12Z&se=2026-10-30T13%3A00%3A12Z&sr=c&sp=r&sig=UnCNYSidtXvDeOIZ%2B2WXyYgWw0e%2BaPsbtkdAevjbat0%3D)
5. In the next dialog, enter the following:
  - Authorization Method: OAuth2
  - API Base URL: paste the Base URL.
  - Client Key: paste the Client ID.
  - Client Secret: paste the Secret.
  - Token URL: replace the <region> with your tenant specific information obtained from the Base URL.
  - Event Types: preselected for all the event types that integration pulls.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/Screenshot 2026-04-15 at 1.51.19 PM(1).png?sv=2026-02-06&spr=https&st=2026-10-30T12%3A00%3A12Z&se=2026-10-30T13%3A00%3A12Z&sr=c&sp=r&sig=UnCNYSidtXvDeOIZ%2B2WXyYgWw0e%2BaPsbtkdAevjbat0%3D)

1. Click **Submit**.

## Troubleshooting Tips

- If you’re facing **invalid_client** or **unauthorized_client** issues this might be possibly due to incorrect credentials. Ensure the token is pasted correctly. Since you cannot view the token after the 1st time, re-create the token, paste it on a text editor to ensure no spaces or unexpected characters are included and reconfigure the DataBee feed.
- If you are facing **403** response code this might be possibly due to missing permissions. Check that CrowdStrike API credentials have the necessary scope. If needed, update the API credentials' scope using CrowdStrike platform, save the changes, and retry the integration.