Crowdstrike Falcon

CrowdStrike Falcon is a cloud-native endpoint detection and response (EDR) platform that provides advanced threat detection, prevention, and incident response capabilities across enterprise endpoints and hosts. As a comprehensive cybersecurity solution, Falcon deploys lightweight sensors on endpoints, workstations, servers, and other hosts to continuously monitor for malicious activity, security threats, and potential breaches in real-time.

Category	EDR
Direction	Query source
Sign-in	CrowdStrike Falcon API Credentials
Query languages	SQLite, STIX
Tables	8
Query templates	14

Before you start

Huntbase signs in to Crowdstrike Falcon with CrowdStrike Falcon API Credentials. Create the credential in Crowdstrike Falcon first, then keep it to hand for the Connect step.

1. In the Falcon console, go to Support › API Clients and Keys and click Add new API client.
2. Enter a client name and description.
3. Under API Scopes, grant Read on Alerts, Detections and Hosts, and nothing else.
4. Click Add and copy the Client ID and Secret from the confirmation window.

Permissions:

• Alerts: Read
• Detections: Read
• Hosts: Read

Watch out for

• The secret is shown only once, when you create the client. It cannot be retrieved later.

For the vendor's own instructions, see CrowdStrike API credentials guide.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Crowdstrike Falcon

1. Go to Connections and click New connection, or click New connection on the Crowdstrike Falcon product page.
2. On Product, pick Crowdstrike Falcon and choose the Owner.
3. On Details, give the connection a Name and, optionally, a Description.
4. On Connect, fill in the settings and credentials described below.
5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings

Where your Crowdstrike Falcon lives:

Field	Required	Notes
CrowdStrike Falcon Cloud	Yes	Your Falcon cloud: us-1, us-2, eu-1 or us-gov-1. One of us-1, us-2, eu-1, us-gov-1. Defaults to us-1.
Server Address	Yes	The API host for your cloud, such as api.crowdstrike.com (US-1), api.us-2.crowdstrike.com (US-2), api.eu-1.crowdstrike.com (EU-1) or api.laggar.gcw.crowdstrike.com (US-GOV-1).
Port	Yes	Set the port number that is associated with the hostname or IP address. Defaults to 443.

Advanced settings

These settings are under Advanced. You can usually leave them alone.

Field	Required	Notes
Max Results	No	Maximum number of results to return per query. Defaults to 1000.

Credentials

The only Method is CrowdStrike Falcon API Credentials. Enter a Credential label (for example Production), then fill in:

Field	Required	Notes
CrowdStrike Falcon Client ID	Yes	Secret — not shown again after you save it.
CrowdStrike Falcon Client Secret	Yes	Secret — not shown again after you save it.

Query it

Once connected, Crowdstrike Falcon can serve these languages in a query tab, and Scout can use it when you ask in Auto:

Language	Use it for
SQLite	SQL over the 8 tables listed below, alongside every other connected source.
STIX	STIX patterns for indicator sweeps, translated into the product's native search.

Example: SQLite

CrowdStrike host inventory — Endpoint baseline from Falcon - one row per enrolled host with its identifiers, addresses, operating system, sensor version and last-seen time.

select
  device_id,
  hostname,
  machine_domain,
  platform_name,
  os_version,
  product_type_desc,
  system_manufacturer,
  system_product_name,
  serial_number,
  local_ip,
  external_ip,
  mac_address,
  agent_version,
  status,
  reduced_functionality_mode,
  site_name,
  ou,
  email,
  first_seen,
  last_seen,
  last_login_timestamp
from
  crowdstrike_host
order by
  hostname;

Crowdstrike Falcon ships with 14 query templates. Find them in Library › Queries — see Query templates.

What syncs automatically

Crowdstrike Falcon comes with a content pack. These queries run on a schedule on each new connection so the entities they find appear in the Activity Feed without you asking. You can turn syncing off from the connection's Synchronisation Settings card.

Query	Finds
Sync endpoints	device, agent, ip, mac, user

Tables

Crowdstrike Falcon adds 8 tables. Browse their columns from Schema in the query bar's ⋯ menu.

All 8 tables

Table	Contains
crowdstrike_alert	Alerts are events identified by Falcon sensors on the hosts in your environment. This table uses the new Alerts API (replacing the deprecated Detects API).
crowdstrike_detection	[Deprecated] Detections are events identified by Falcon sensors on the hosts in your environment.
crowdstrike_host	Hosts are endpoints that run the Falcon sensor.
crowdstrike_intel_actor	A threat actor, also known as a malicious actor, is any person or organization that intentionally causes harm in the digital sphere.
crowdstrike_spotlight_vulnerability	Known CVE identified vulnerabilities in the environment.
crowdstrike_user	Users in the Falcon system.
crowdstrike_zta_assessment	Zero Trust Assessments.
crowdstrike_zta_compliance	Zero Trust Compliance.

Next steps

• Connections — health, credentials and settings after you connect
• Query languages — syntax, parameters and time ranges
• Chatting with Scout — ask questions without writing a query
• All integrations — the rest of the catalog