CrowdStrike
Pulls every host CrowdStrike Falcon has an agent on, with the full host record — hardware, OS, network identity, agent state and grouping.
| Type name | crowdstrike_integration |
| Creates | Endpoints |
| Runs on | A sensor with outbound reach to the Falcon API |
| Presence flag | cs_exits |
| Field prefix | cs_ |
What it contributes
CrowdStrike is usually one of the strongest sources in the inventory, because an EDR agent reports from inside the host. Expect it to be authoritative for:
- Identity — hostname, machine domain, OU, site name, CrowdStrike device ID
- Network — local IP, external IP, MAC, connection IP and MAC, default gateway
- Platform — OS version, build, kernel version, product type, service pack
- Hardware — system manufacturer and product, BIOS manufacturer and version, serial number, chassis type, CPU vendor and signature
- Agent state — agent version, first and last seen, last reboot, RTR state, reduced functionality mode, provision status, host groups and tags
Alongside its own cs_* fields it writes the shared asset fields, so its hosts
correlate against every other source. See Exported fields for
the complete list.
Requirements
The integration is outbound-only: it is a scheduled API client, so nothing is installed on the CrowdStrike side, nothing runs on the endpoints themselves, and nothing has to reach into the deployment.
Network access
| From | To | Protocol | Port |
|---|---|---|---|
| The sensor running the integration | The Falcon API host for your region, e.g. api.us-2.crowdstrike.com | HTTPS over TCP | 443 |
Both the token request and every page of device records go to that same host, so one egress rule covers the whole integration. Open it for your region's host — see the region warning under Configuration — and if the sensor reaches the internet through a proxy, point Proxy settings at it rather than opening direct egress.
Access in CrowdStrike
| Need | Why |
|---|---|
| An account that can create API clients in the Falcon console | The credential is created under Support and resources → API clients and keys, which is admin-gated. See Creating the API client |
| The Hosts: Read scope on that client | The only scope the integration uses — it enumerates hosts and reads nothing else |
No Falcon console user is created or consumed at run time; the integration authenticates as the API client only.
In this deployment
| Need | Why |
|---|---|
| A registered, healthy sensor | The integration runs on a sensor, on the platform's schedule — see Sensors |
There are no special host requirements beyond a sensor that is checking in. The work is a handful of HTTPS calls per run, so it adds no meaningful load and needs no local storage.
Configuration
| Field | Required | Notes |
|---|---|---|
| Name | Yes | Label for this instance |
| API URL | Yes | The Base URL shown when the API client was created, e.g. https://api.us-2.crowdstrike.com |
| Client ID | Yes | The Client ID of the Falcon API client |
| Client secret | Yes | The Secret shown once at creation |
| Proxy settings | No | http://host:port if the sensor egresses through a proxy |
| Sensor | Yes | Sensor that will run the integration |
| Ignore SSL | No | Skips certificate validation — leave off against the real API |
api.crowdstrike.com, api.us-2.crowdstrike.com, api.eu-1.crowdstrike.com and
api.laggar.gcw.crowdstrike.com are different clouds. Credentials issued in one
region will not authenticate against another, and the failure looks like a bad
secret rather than a wrong host.
Creating the API client in CrowdStrike
In the Falcon console, go to Support and resources → API clients and keys and choose Create API client. Give it a name that identifies this integration, and grant it exactly one permission:
| Scope | Access |
|---|---|
| Hosts | Read |
Nothing else is needed — the integration only enumerates hosts.
On save, CrowdStrike shows three values. Copy all three; they are what you enter when creating the integration instance:
| Falcon shows | Enter it as | Example |
|---|---|---|
| Client ID | Client ID | 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d |
| Secret | Client secret | shown once, at creation |
| Base URL | API URL | https://api.us-2.crowdstrike.com |
CrowdStrike shows the secret exactly once, on this screen. If it is lost, reset it on the existing client rather than creating a second one — one credential per integration keeps the audit trail readable.
The Base URL on that screen is the cloud your tenant lives in — use it verbatim
as the API URL rather than assuming api.crowdstrike.com.
The integration then authenticates with the OAuth2 client-credentials flow against
/oauth2/token and pages /devices/combined/devices/v1.
Exported fields
Each host returned by /devices/combined/devices/v1 becomes one asset record. The
integration copies the Falcon device attributes into fields prefixed cs_, keeping
the CrowdStrike name so a value in the platform can always be traced back to the
device record it came from, and additionally writes the shared fields that make the
host correlate with other sources.
Two records are dropped before anything is written: a host with no agent_version,
and a host whose cs_last_seen is older than the Ignore if host is offline
window configured in the instance's advanced settings.
Identity
| Field | Type | Holds |
|---|---|---|
cs_exits | Boolean | Always true — the presence flag marking this asset as CrowdStrike-covered |
cs_device_id | Text | Falcon device ID (AID). The primary key used to match the host on later runs |
cs_cid | Text | Customer ID of the Falcon tenant the sensor is enrolled in |
cs_hostname | Text | Hostname as the sensor reports it |
cs_machine_domain | Text | Domain the machine is joined to |
cs_ou | Text | Organisational unit path — an array in the source record |
cs_site_name | Text | Active Directory site name |
cs_serial_number | Text | Chassis serial number |
Agent state
| Field | Type | Holds |
|---|---|---|
cs_agent_version | Text | Full sensor version |
cs_agent_version_major | Text | Derived — the first two components of the version, e.g. 7.14 from 7.14.18110. Use it to group an estate by sensor generation |
cs_agent_load_flags | Text | Sensor load flags |
cs_agent_local_time | Date/time | Host's local clock at the time the sensor last reported |
cs_status | Text | Host status, e.g. normal, containment_pending, contained |
cs_provision_status | Text | Provisioning state of the sensor |
cs_reduced_functionality_mode | Text | Whether the sensor is running degraded |
cs_rtr_state | Text | Real Time Response availability on the host |
cs_config_id_base | Text | Sensor configuration base ID |
cs_config_id_build | Text | Sensor configuration build ID |
cs_config_id_platform | Text | Sensor configuration platform ID |
Network
| Field | Type | Holds |
|---|---|---|
cs_local_ip | IP | Local address of the host |
cs_external_ip | IP | Address the host is seen from on the internet |
cs_connection_ip | IP | Address the sensor connected to Falcon from |
cs_default_gateway_ip | IP | Default gateway on the host's network |
cs_mac_address | Text | MAC of the host's primary adapter |
cs_connection_mac_address | Text | MAC of the adapter used for the Falcon connection |
Operating system
| Field | Type | Holds |
|---|---|---|
cs_platform_id | Text | Numeric platform code |
cs_platform_name | Text | Platform name — Windows, Mac, Linux |
cs_os_version | Text | OS version string |
cs_os_product_name | Text | OS product name |
cs_os_build | Text | OS build |
cs_build_number | Text | Build number |
cs_major_version | Text | Major OS version |
cs_minor_version | Text | Minor OS version |
cs_kernel_version | Text | Kernel version |
cs_service_pack_minor | Text | Service pack minor version |
cs_product_type | Text | Windows product type code — workstation, domain controller or server |
cs_product_type_desc | Text | The same product type, in words |
cs_pointer_size | Text | Pointer width — distinguishes 32-bit from 64-bit hosts |
Hardware
| Field | Type | Holds |
|---|---|---|
cs_system_manufacturer | Text | System manufacturer |
cs_system_product_name | Text | System model |
cs_bios_manufacturer | Text | BIOS manufacturer |
cs_bios_version | Text | BIOS version |
cs_cpu_vendor | Text | CPU vendor |
cs_cpu_signature | Text | CPU signature |
cs_chassis_type | Text | Chassis type code |
cs_chassis_type_desc | Text | Chassis type in words — often the quickest way to separate laptops from servers |
Grouping and tags
| Field | Type | Holds |
|---|---|---|
cs_groups | Text | Falcon host group IDs the host belongs to — an array in the source record |
cs_group_hash | Text | Hash of the host's group membership |
cs_tags | Text | Falcon sensor and grouping tags — an array in the source record |
Timestamps
| Field | Type | Holds |
|---|---|---|
cs_first_seen | Date/time | When the host first reported to Falcon |
cs_last_seen | Date/time | When the host last reported. Also drives the offline drop rule above |
cs_last_reboot | Date/time | Last reboot of the host |
cs_modified_timestamp | Date/time | Last change to the device record |
cs_slow_changing_modified_timestamp | Date/time | Last change to the rarely-changing part of the device record |
Shared fields it writes
These are the normalised, source-independent fields. They are what other integrations correlate against, so their values are cleaned up rather than copied verbatim:
| Shared field | Derived from |
|---|---|
names | cs_hostname |
private_ip | cs_local_ip — only written when the host reports one |
last_public_ip | cs_external_ip |
mac | cs_mac_address |
os | cs_os_version, normalised to a canonical name such as Windows 11 or Ubuntu 20.04 |
os_vendor | cs_platform_name, normalised to Windows, Linux or MacOS |
type | Inferred from the normalised os — Endpoint, Server, Hypervisor and similar |
hw_vendor | cs_system_manufacturer |
hw_product | cs_system_product_name |
updated_at | Time of the run that produced the record |
os is a normalised value and cs_os_version is what CrowdStrike literally
reported. When a host looks wrong in a report built on os, compare it against the
cs_* field to tell a normalisation gap from a genuine reporting difference.
Related integrations
- CrowdStrike asset owner — resolves who uses a host, from logon telemetry
- CrowdStrike process events — process execution history per host
All three can share one API client if you would rather manage a single credential, but each needs its own scopes.
See also
- Integrations overview — the shared configuration model
- Assets — inspecting which source asserted an attribute