})
}){kind=logo}
| [Couchbase](https://www.couchbase.com/) | Apps:}){kind=logo}
| [Cribl](https://cribl.io/) | Automation integration: [Cribl](/docs/platform-services/automation-service/app-central/integrations/cribl/) })
| [Criminal IP](https://www.criminalip.io/) | Automation integration: [Criminal IP](/docs/platform-services/automation-service/app-central/integrations/criminal-ip) |
-| })
| [CrowdStrike](https://www.crowdstrike.com/) | Apps: | [CrowdStrike](https://www.crowdstrike.com/) | Apps: })
| [Cuckoo](https://cuckoo.readthedocs.io/en/latest/#) | Automation integration: [Cuckoo](/docs/platform-services/automation-service/app-central/integrations/cuckoo/) |
| | [CyberArk](https://www.cyberark.com/) | Automation integrations: })
| [CyberInt](https://cyberint.com/) | Automation integration: [Cyberint](/docs/platform-services/automation-service/app-central/integrations/cyberint) |
diff --git a/docs/platform-services/threat-intelligence-indicators.md b/docs/platform-services/threat-intelligence-indicators.md
index d90e1f94e5..7eecafeb08 100644
--- a/docs/platform-services/threat-intelligence-indicators.md
+++ b/docs/platform-services/threat-intelligence-indicators.md
@@ -40,6 +40,7 @@ You do not need to be assigned these role capabilities to [find threats with log
To search logs that contain correlations to threat intelligence indicators, you must first ingest the indicators. You can ingest indicators using:
* **The Threat Intelligence tab**. See [Add indicators in the Threat Intelligence tab](#add-indicators-in-the-threat-intelligence-tab).
* **A collector**. See:
+ * [CrowdStrike Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source)
* [Intel471 Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/intel471-threat-intel-source)
* [Mandiant Threat Intel Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/mandiant-threat-intel-source)
* [STIX/TAXII 1 Client Source](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/stix-taxii-1-client-source)
diff --git a/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source.md b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source.md
new file mode 100644
index 0000000000..3819a855aa
--- /dev/null
+++ b/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/crowdstrike-threat-intel-source.md
@@ -0,0 +1,134 @@
+---
+id: crowdstrike-threat-intel-source
+title: CrowdStrike Threat Intel Source
+sidebar_label: CrowdStrike Threat Intel
+tags:
+ - cloud-to-cloud
+ - crowdstrike-threat-intel
+description: Learn how to collect combined endpoint vulnerabilities data from the CrowdStrike platform.
+---
+
+
+
+
+
+
+
+import CodeBlock from '@theme/CodeBlock';
+import ExampleJSON from '/files/c2c/crowdstrike-threat-intel/example.json';
+import MyComponentSource from '!!raw-loader!/files/c2c/crowdstrike-threat-intel/example.json';
+import TerraformExample from '!!raw-loader!/files/c2c/crowdstrike-threat-intel/example.tf';
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+
+
+CrowdStrike is the leader in next-generation endpoint protection, threat intelligence, and response services. CrowdStrike’s core technology, the Falcon platform, stops breaches by preventing and responding to all types of attacks — both malware and malware-free. The CrowdStrike Threat Intel integration ingests the indicator data from CrowdStrike Combined API and sends it to Sumo Logic as normalized threat indicator information.
+
+:::important
+The CrowdStrike API documentation is not public and can only be accessed by partners or customers.
+:::
+
+## Data collected
+
+| Polling Interval | Data |
+| :--- | :--- |
+| 1 hour | Indicator data |
+
+## Setup
+
+### Vendor configuration
+
+**Prerequisites**
+
+To collect vulnerability data from the CrowdStrike platform, you must have an authorized CrowdStrike account. CrowdStrike APIs use an OAuth 2.0 authorization token to make authorized API calls. CrowdStrike API Client is required to get the OAuth 2.0 authorization token. To define a CrowdStrike API client, you must be designated as a `CrowdStrike Falcon Administrator` role.
+
+In this configuration, you will set up the CrowdStrike Threat Intel and configure it to be authorized and authenticated to use indicator information from CrowdStrike Threat Intel API. To obtain the auth token, you will need the following parameters.
+
+#### API Client and API Secret
+
+The **API security token** is used to authenticate with CrowdStrike Threat Intel API. After successfully creating the API client, you will get the **Client Id**, **Client Secret**, and **Base URL**.
+
+To get the **CrowdStrike API Client**, follow the steps below:
+
+1. Sign in to [CrowdStrike Platform](https://falcon.crowdstrike.com/login/).
+1. Sign in using your email address and password. After you've completed the two-factor authentication, you'll be directed to the application dashboard.})
+1. From the CrowdStrike console, select the **Support and resources** option from the menu.})
+1. In the **Resources and tools** section, select the **API clients and keys** option. You can then view existing clients or add new API clients from there.})
+1. Click **Add new API client**. You will be prompted to give a descriptive name and select the appropriate API scopes.})
+1. Provide a proper name and description and select the **indicators(Falcon Intelligence):read scope** scope. Click on `ADD` to complete the process.
+1. After you click on `ADD` a dialogue box will appear with the **Client ID**, **Client Secret**, and **Base URL**. Copy and save the Client Id, Client Secret, and Base URL to a folder location because you will need them for the [source configuration](#source-configuration).})
+
+#### Region
+
+Identify your **Region** based on your **Base URL**. The region can be selected from the list below.
+
+ | Region | Base URL |
+ | :------ | :-------------------------- |
+ | US-1 | https://api.crowdstrike.com |
+ | US-2 | https://api.us-2.crowdstrike.com |
+ | EU-1 | https://api.eu-1.crowdstrike.com |
+ | US-GOV-1 | https://api.laggar.gcw.crowdstrike.com |
+
+### Source configuration
+
+When you create a CrowdStrike Threat Intel Source, you add it to a Hosted Collector. Before creating the Source, identify the Hosted Collector you want to use or create a new Hosted Collector. For instructions, see [Configure a Hosted Collector](/docs/send-data/hosted-collectors/configure-hosted-collector).
+
+To configure the CrowdStrike Threat Intel Source:
+1. [**Classic UI**](/docs/get-started/sumo-logic-ui-classic). In the main Sumo Logic menu, select **Manage Data > Collection > Collection**. Learn how to collect combined endpoint vulnerabilities data from the CrowdStrike Spotlight platform.
+