Skip to content

Commit 6949e90

Browse files
DebLangerDebLanger
committed
Align CrowdStrike article structure with SentinelOne format
- Updated title to match SentinelOne format - Restructured sections to follow consistent pattern - Added note callouts for better user guidance - Enhanced troubleshooting section with validation tips - Improved step formatting and connection instructions
1 parent bf7f505 commit 6949e90

File tree

1 file changed

+34
-60
lines changed

1 file changed

+34
-60
lines changed

‎exposure-management/crowdstrike-data-connector.md‎

Lines changed: 34 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -1,85 +1,60 @@
11
---
2-
title: CrowdStrike Falcon data connector for Microsoft Security Exposure Management
3-
description: Learn how to set up and configure the CrowdStrike Falcon data connector in Microsoft Security Exposure Management.
4-
ms.service: exposure-management
2+
title: Integrate CrowdStrike Falcon data connector in Microsoft Security Exposure Management
3+
description: Learn how to integrate the CrowdStrike Falcon data connector in Microsoft Security Exposure Management.
54
ms.author: dlanger
65
author: DebLanger
76
manager: ornat-spodek
8-
ms.topic: how-to
7+
ms.topic: overview
8+
ms.service: exposure-management
99
ms.date: 09/01/2025
1010
---
1111

1212
# CrowdStrike Falcon data connector
1313

14-
This article describes how to configure the CrowdStrike Falcon data connector for Microsoft Security Exposure Management. The CrowdStrike Falcon data connector enables you to integrate your CrowdStrike Falcon data insights with your extended security posture management, enhancing your visibility and control over your IT assets and risks.
15-
16-
## Prerequisites
17-
18-
Before you configure the CrowdStrike data connector, ensure you have:
19-
20-
### CrowdStrike Requirements
14+
The CrowdStrike Falcon data connector allows you to integrate CrowdStrike Falcon data with Microsoft Security Exposure Management. To integrate with CrowdStrike Falcon, you need to provide an authentication endpoint API URL, Client ID, and Client Secret generated using the CrowdStrike portal.
2115

22-
- A CrowdStrike Falcon environment
23-
- CrowdStrike Falcon administrator role to create API clients
24-
- Authentication endpoint API URL, Client ID, and Client Secret from CrowdStrike
16+
> [!Note]
17+
> We recommend creating a dedicated API client for use with data connectors in Exposure Management.
2518
26-
## Supported data types
19+
## CrowdStrike Falcon configuration
2720

28-
The CrowdStrike data connector imports the following data types:
21+
First, you need to create an API client with the required permissions to get the authentication endpoint URL, Client ID, and Client Secret.
2922

30-
- **Assets**: Information about devices and endpoints monitored by CrowdStrike
31-
- **Vulnerabilities**: Vulnerability data detected by CrowdStrike Falcon
23+
> [!Note]
24+
> To create an API client, you must be logged in as a CrowdStrike user with sufficient permissions to generate API clients.
3225
33-
## Create CrowdStrike API Client
34-
35-
Before configuring the connector in Microsoft Security Exposure Management, you need to create an API client in CrowdStrike:
26+
### Create the CrowdStrike API Client
3627

3728
1. From your CrowdStrike CID homepage, click **Open menu**.
38-
39-
2. Click **Support and resources**.
40-
41-
3. Click **API clients and keys**.
42-
43-
4. Ensure the **OAuth2 API clients** tab is selected, then click **Create API client**.
44-
45-
5. Choose a **Client Name**.
46-
47-
6. From the **API SCOPES** section, select the following permissions:
29+
1. Click **Support and resources**.
30+
1. Click **API clients and keys**.
31+
1. Ensure the **OAuth2 API clients** tab is selected, then click **Create API client**.
32+
1. Choose a **Client Name**.
33+
1. From the **API SCOPES** section, select the following permissions:
4834
- **Assets (Read)**
4935
- **Vulnerabilities (Read)**
36+
1. Click **Create**.
37+
1. Copy and save the **Base URL**, **API Client ID**, and **Secret** that appears.
38+
1. Store the credentials in a secure file.
5039

51-
7. Click **Create**.
52-
53-
8. Copy and save the **Base URL**, **API Client ID**, and **Secret** that appears.
54-
55-
9. Close the credential window.
56-
57-
## Configure the CrowdStrike data connector
58-
59-
After creating the API client in CrowdStrike:
60-
61-
1. Open the **Exposure Management Connectors** page.
62-
63-
2. Click **Connect** in the **CrowdStrike** tile.
64-
65-
3. Enter your CrowdStrike API URL and authentication credentials:
66-
- **API Base URL**: The Base URL from your CrowdStrike API client
67-
- **Client ID**: Your CrowdStrike API Client ID
68-
- **Client Secret**: Your CrowdStrike API Client Secret
40+
> [!Note]
41+
> Your API client options will now include the ability to regenerate or revoke the client.
6942
70-
4. Click **Connect**.
43+
1. Exit the credential window.
7144

72-
## Verify the connection
45+
> [!CAUTION]
46+
> Be sure to copy the API credentials before you close the API Client window. After you close this window, you cannot retrieve the secret from CrowdStrike.
7347
74-
After configuring the data connector:
48+
### Getting the Authentication Endpoint URL
7549

76-
1. Monitor the connection status in the **Data connectors** page.
50+
The authentication endpoint URL is your CrowdStrike API Base URL endpoint. This is provided when you create your API client in CrowdStrike.
7751

78-
2. Check the **Last sync** timestamp to ensure data is being imported.
52+
## Establish CrowdStrike Falcon connection in Exposure Management
7953

80-
3. Review any error messages if the connection fails.
54+
To establish a connection with CrowdStrike Falcon in Exposure Management, follow these steps:
8155

82-
4. Verify that CrowdStrike data is integrated by checking the scenarios described in [Getting value from your data connectors](value-data-connectors.md).
56+
1. Open the [Data Connectors](https://security.microsoft.com/exposure-data-connectors) from the Exposure Management navigation and select **Connect** in the CrowdStrike tile.
57+
1. Enter your CrowdStrike API Base URL, Client ID, and Client Secret credentials and select **Connect**.
8358

8459
## Retrieved data
8560

@@ -91,17 +66,16 @@ Only devices that were active in the last 90 days are retrieved, based on the la
9166
|-------------------------|--------------------------------------------------------------------------------|
9267
| **Assets/devices** | - Device information<br>- Operating system details<br>- Network interfaces<br>- Agent status<br>- Device classification<br>- CrowdStrike criticality data |
9368
| **Vulnerability findings** | CrowdStrike retrieves CVE findings on the assets that it ingests. |
94-
| **Configuration data** | - Agent configurations<br>- Policy assignments<br>- Protection status<br>- Threat detection data |
9569

9670
## Troubleshooting the CrowdStrike data connector
9771

9872
Here are some common issues that might arise when configuring the CrowdStrike Connector, and suggestions for how to resolve them.
9973

10074
| **Error Type** | **Troubleshooting Action** |
10175
| ------------------------------------------------------------ | ------------------------------------------------------------ |
102-
| **Error code 401**: Authorization failure | An authorization failure indicates that credentials might not be correct, or there might not be sufficient permissions to access the CrowdStrike data. Check your credentials and make sure they're correct and valid. Also check that your API client has the required permissions. See the CrowdStrike [configuration section](#create-crowdstrike-api-client) for details on how to generate the appropriate API client with correct scopes. |
103-
| **Error code 403:** Access forbidden error | This error indicates that the provided credentials lack the necessary permissions to run the requested APIs. Update your credentials with the proper permissions as described in the [configuration section](#create-crowdstrike-api-client), and make sure your API client has the **Assets (Read)** and **Vulnerabilities (Read)** permissions. |
104-
| **Error code 404:** Not found error | This error indicates that the requested endpoint wasn't found to be reachable. Verify that your CrowdStrike API Base URL is correct, see the [configuration section](#create-crowdstrike-api-client) for details. |
76+
| **Error code 401**: Authorization failure | An authorization failure indicates that credentials might not be correct, or there might not be sufficient permissions to access the CrowdStrike data. Check your credentials and make sure they're correct and valid. Also check that your API client has the required permissions. See the CrowdStrike [configuration section](#crowdstrike-falcon-configuration) for details on how to generate the appropriate API client with correct scopes. <br>You can validate your credentials by testing the authentication endpoint with your API client credentials. |
77+
| **Error code 403:** Access forbidden error | This error indicates that the provided credentials lack the necessary permissions to run the requested APIs. Update your credentials with the proper permissions as described in the [configuration section](#crowdstrike-falcon-configuration), and make sure your API client has the **Assets (Read)** and **Vulnerabilities (Read)** permissions. |
78+
| **Error code 404:** Not found error | This error indicates that the requested endpoint wasn't found to be reachable. Verify that your CrowdStrike API Base URL is correct, see the [configuration section](#crowdstrike-falcon-configuration) for details. |
10579
| **Error code 429** 'Too many requests" | The system periodically pulls data from the configured external providers, which might have a limit on the number of concurrent requests. We recommend creating a dedicated API client for the connector to avoid reaching this limit. |
10680
| 'Temporary disconnected' or 'Temporary failure' error message | In the case where this error message appears without any additional information, verify the connector configuration (API Base URL and credentials). If these are valid and the issue doesn't resolve on its own, contact Support. |
10781
| Not seeing my assets or the vulnerabilities reported by CrowdStrike in the ingested data | See [Retrieved data](#retrieved-data) for a description of the data expected to be retrieved by the CrowdStrike connector. If there's still missing data, contact Support. |

0 commit comments

Comments
 (0)