--- title: "CrowdStrike Falcon Connector Guide" slug: "crowdstrike-falcon-connector-guide" updated: 2026-07-23T06:38:55Z published: 2026-07-23T06:38:55Z canonical: "docs.safe.security/crowdstrike-falcon-connector-guide" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.safe.security/llms.txt > Use this file to discover all available pages before exploring further. # CrowdStrike Falcon Connector Guide CrowdStrike Falcon provides next-generation antivirus, endpoint detection and response (EDR), managed threat hunting, and threat intelligence. The **Balbix integration with CrowdStrike Falcon** ingests infrastructure assets, system information, and operational or business data configured by your IT and cybersecurity teams for assets managed by CrowdStrike Falcon. **How Balbix processes CrowdStrike Falcon data** Balbix uses AI to aggregate, normalize, and deduplicate the ingested data from CrowdStrike Falcon`, along with information from your existing IT and cybersecurity tools. This creates a unified view of your entire asset inventory, including vulnerabilities and their operational and business context. Balbix’s AI models analyze this data to deliver insights such as: - **Deployment gap analysis**: Identify areas lacking security coverage. - **Risk-based vulnerability prioritization**: Provide detailed ranking and scoring of vulnerabilities based on risk. - **Risk quantification**: Assess risk at the asset, group, or enterprise level. This comprehensive approach enables more informed and effective security decisions, allowing you to proactively manage risk across your organization. ## Integration Summary This table provides a summary of the Balbix integration for the CrowdStrike Falcon connector. | **Integration Type** | Fetch: An inbound API integration used to retrieve assets and their related metadata, such as tags. | | --- | --- | | **Types of Assets Fetched** | Host devices, including servers, virtual machines, desktops, and laptops. | | **Types of Data Fetched** | Asset names, hardware information, interface information (MAC address, IP address), OS information, BIOS information, system information, all relevant timestamps such as first observed and last observed, tags, and CrowdStrike Falcon Agent version. | #### Prerequisites To configure your Balbix connector, start by creating CrowdStrike Falcon API credentials with the necessary permissions. These credentials will be used during the connector setup process. Here are the steps you need to complete: 1. Generate a CrowdStrike API client ID and secret for their current set of APIs. OR 2. Generate a CrowdStrike API credentials for their legacy set of APIs. > [!NOTE] > **Note:** The CrowdStrike API is managed from the CrowdStrike Falcon® UI by the Falcon Administrator. To define a CrowdStrike API client, **you must be designated as a Falcon Administrator** role to view, create, or modify API clients or keys. #### Create Credentials Using Current API Authentication Follow the steps below to obtain credentials for the current APIs: 1. Log in to the Falcon Admin panel. 2. Go to **Support > API Client and Keys**. 3. Click **Add new API client**. You will be prompted to give a descriptive name and select the appropriate API scopes. 4. Select the **Read** checkbox for both **Hosts** and **User Management**. ![](https://cdn.document360.io/23dc20b8-a989-48c0-8653-f1d3e4abc734/Images/Documentation/Connector_CrowdStrikeFalcon_Add API Client Config.png) 5. Click **Add** to generate the Client ID and Client Secret. The system displays these credentials for your use. Important **Important note:** The Client Secret is displayed only once, so make sure to store it securely. If the Client Secret is lost, you’ll need to reset it, and any applications using it will require updates with the new credentials. #### Create Credentials using Legacy API Authentication Follow the steps below to obtain credentials for legacy APIs: 1. Verify that you have a valid account in the CrowdStrike Support Portal. Additionally, you need to create a GPG key pair prior to requesting the API key. Refer to the [CrowdStrike API Reference](https://falcon.crowdstrike.com/documentation/category/a3a706a8/crowdstrike-apis) for more information. 2. Contact CrowdStrike Support to **request an API key for the Query API**. Because this API key request is distinct from a standard API key (for CrowdStrike Falcon API), be explicit when explaining to the support agent that you need access to the Query API. 3. **Generate** a GPG key pair. 4. **Export** your public key in ASCII format. 5. Email [support@crowdstrike.com](mailto:support@crowdstrike.com) to request access to the Query API. Be sure to include your public key in the request. CrowdStrike Support will respond by sending your Query API credentials, securely encrypted with your public key. 6. **Decrypt** your Query API credentials using your private key and use your credentials to make requests with the Query APIs. #### Create and Configure the Connector Follow these steps to create and configure your Balbix connector for CrowdStrike Falcon. ##### Step 1: Select the Connector Start by selecting a connector using the steps outlined below: 1. Go to **Data Sources** from the left navigation bar. 2. In the Connectors table, click **+ Add Connector**. 3. Click **Select a Connector to Configure** to expand the window and view the list of available connectors. 4. Click the **+** icon on the **CrowdStrike Falcon** tile. 5. Choose **API** as the Integration Option, then click **Next** to configure the connector. ##### Step 2: Configure the Connector Configure the connector using the steps outlined below. 1. Fill in the required configuration fields. ![](https://cdn.document360.io/23dc20b8-a989-48c0-8653-f1d3e4abc734/Images/Documentation/image(472).png) | ![](https://cdn.document360.io/23dc20b8-a989-48c0-8653-f1d3e4abc734/Images/Documentation/image(339).png) | **Instance Name** | | | --- | --- | --- | | ![](https://cdn.document360.io/23dc20b8-a989-48c0-8653-f1d3e4abc734/Images/Documentation/image(340).png) | **CrowdStrike Base URL** | Enter the *base API URL* of the server where the information will be fetched (e.g., https://api.crowdstrike.com). Make sure the authorized user for this account has the necessary privileges to access the API. | | ![](https://cdn.document360.io/23dc20b8-a989-48c0-8653-f1d3e4abc734/Images/Documentation/image(341).png) | **Client ID** | Enter the *client ID* for the user account with the necessary permissions to fetch assets. (e.g., 3072c641c2be4677b1a3ydfgs6b4e25) | | ![](https://cdn.document360.io/23dc20b8-a989-48c0-8653-f1d3e4abc734/Images/Documentation/image(342).png) | **CrowdStrike Secret** | Enter the *CrowdStrike secret* for the user account with the necessary permissions to fetch assets | | ![](https://cdn.document360.io/23dc20b8-a989-48c0-8653-f1d3e4abc734/Images/Documentation/image(343).png) | **CrowdStrike API Filter** | Limit the data fetched by entering filter criteria. This field supports generic filtering and accepts fields compatible with the Falcon Device API. Use any valid Falcon Query Language (FQL) expressions. **Supported fields:** Refer to [CrowdStrike Falcon API—Device Filters](https://falcon.crowdstrike.com/documentation/page/c0b16f1b/host-and-host-group-management-apis#qadd6f8f) for the list of supported fields. **Filter Expression* Example:** filter=product_type_desc:'Workstation'+status:'normal' ***** Filter string must start with “filter=”. | | ![](https://cdn.document360.io/23dc20b8-a989-48c0-8653-f1d3e4abc734/Images/Documentation/image(358).png) | **Asset Last Seen Days Filter** | | 2. Click **Test Connection**. 3. ### Step 3: Schedule the Connector ### Step 4: Review Connector Details ## API References This section provides comprehensive references for the API, detailing endpoints and reference documentation to help you effectively integrate and utilize the API in your system. #### **API Endpoints** Balbix authenticates with the CrowdStrike Falcon API endpoints as shown below. | Type | Endpoint URL | Version | | --- | --- | --- | | Field name | /devices/queries/devices | v1 | | Field name | /devices/combined/devices/login-history | v1 | | Field name | /devices/entities/devices | v2 | #### **API Documentation** To learn more about the CrowdStrike Falcon API, see the references listed below: - [CrowdStrike API Reference](https://falcon.crowdstrike.com/documentation/category/a3a706a8/crowdstrike-apis) - [CrowdStrike Falcon API—Device Filters](https://falcon.crowdstrike.com/documentation/page/c0b16f1b/host-and-host-group-management-apis#qadd6f8f) - [Falcon APIs](https://falcon.crowdstrike.com/documentation/category/a3a706a8/crowdstrike-apis)