CrowdStrike

This guide explains how to integrate CrowdStrike Falcon with RedCarbon.

Overview

The CrowdStrike integration allows RedCarbon to ingest Detections, Incidents, and IOCs from the Falcon platform.

• Vendor Documentation: CrowdStrike Falcon API Documentation

Configuration

To configure the integration, you need to create an API Client in the CrowdStrike Falcon console.

Step 1: Create an API Client

1. Log in to the CrowdStrike Falcon console.
2. Navigate to Support and Resources > API Clients and Keys.
3. Click the Add new API client button in the top right corner.

Step 2: Set Permissions

Configure the API client with the following permissions:

• Detections: Read
• Incidents: Read
• IOCs (Indicators of Compromise): Read
• Alerts: Read & Write (if you want to update alert status)

Step 3: Get Credentials

After creating the client, copy the following credentials:

• Client ID
• Client Secret
• Base URL (e.g., https://api.crowdstrike.com)

Step 4: Configure RedCarbon

1. Log in to the RedCarbon Dashboard.
2. Navigate to the customer's Integrations page.
3. Select CrowdStrike.
4. Paste the Client ID, Client Secret, and Base URL.
5. Click Save and then Test to verify the connection.