CrowdStrike process events (WIP)

Collects process execution events per endpoint from the CrowdStrike Falcon LogScale (Humio) API and stores them against the asset. It is a behavioural record — what ran on this host, and how often — rather than an inventory source.

Type name	crowdstrike_process_events
Creates	Nothing — enriches endpoints that already exist
Runs on	A sensor with outbound reach to the Falcon API
Field prefix	None; events are stored as event data, not asset fields

This integration writes no asset fields

It defines no default fields and skips the identification stage entirely — it is an event store. Assets are not created, updated or deleted by it, so its action settings have no effect. Use CrowdStrike for inventory.

What it contributes

For every endpoint already known by its cs_device_id, the integration runs a query job against the Falcon investigate_view repository and collects the process execution events it returns, grouped per host.

That gives you, per asset, which binaries executed and how often — useful for spotting execution of things that have no business being on a host, and for understanding what a machine actually does before you decide how to treat it.

Requirements

The integration is outbound-only: it is a scheduled query client, so nothing is installed on the CrowdStrike side, nothing runs on the endpoints themselves, and nothing has to reach into the deployment.

Network access

From	To	Protocol	Port
The sensor running the integration	The Falcon API host for your region, e.g. api.us-2.crowdstrike.com	HTTPS over TCP	443

The token request and every query job go to that same host — the /humio path in the API URL is a route on it, not a separate service — so one egress rule covers the whole integration. Open it for your region's host, and if the sensor reaches the internet through a proxy, point Proxy settings at it rather than opening direct egress.

Access in CrowdStrike

Need	Why
An account that can create API clients in the Falcon console	The credential is created under Support and resources → API clients and keys, which is admin-gated
Hosts: Read plus query access to the LogScale repository	Two scopes, because the run enumerates hosts and then queries per host — see Permissions in CrowdStrike
A LogScale entitlement that permits query jobs	The events come from investigate_view via query jobs; whether that is available depends on the Falcon subscription

In this deployment

Need	Why
A registered, healthy sensor	The integration runs on a sensor, on the platform's schedule — see Sensors
Endpoints already discovered by CrowdStrike	One query job runs per known cs_device_id; with no CrowdStrike hosts in the inventory there is nothing to query for

Run duration scales with the estate, not the sensor

Because it issues one query job per endpoint, this is the longest-running integration in the catalogue on a large estate. Give it a sensor that stays up rather than the smallest one available, and read the cost warning under Configuration before widening the window.

Configuration

Field	Required	Notes
Name	Yes	Label for this instance
API URL	Yes	Falcon API / Humio base, e.g. https://api.us-2.crowdstrike.com/humio
Client ID	Yes	Falcon API client ID
Client secret	Yes	Falcon API client secret
Proxy settings	No	http://host:port
Sensor	Yes	Sensor that will run the integration
Ignore SSL	No	Skips certificate validation

Unlike other integrations, its advanced settings are specific rather than generic:

Setting	Default	What it does
Start window	7d	How far back to look for events
Query timeout (sec)	120	Maximum wait for a single query job
Poll interval (sec)	2	Delay between polls of a query job
Max lines / host	1000	Cap on events collected per host

Cost scales with hosts × window × lines

One query job runs per endpoint. A wide start window across a large estate is a lot of LogScale work and a long run. Start at the defaults and widen only if the seven-day view is genuinely insufficient.

Permissions in CrowdStrike

The API client needs read access to the event search / LogScale repository the queries target (investigate_view), in addition to the Hosts read scope used to enumerate devices.

TODO

Confirm the exact Falcon API scope name that grants query-job access to the investigate_view repository for the current Falcon console, and document whether an on-demand LogScale subscription is a prerequisite.

See also

• CrowdStrike — the inventory source this depends on
• Integrations overview — the shared configuration model