CrowdStrike
The guides in this sections are designed to help you connect your environment to Falcon and build powerful automated workflows.
To get started, follow these core tracks:
The Foundation. Learn how to generate OAuth2 credentials (Client ID and Secret) and define the specific API scopes required for your automation to interact with the Falcon cloud securely.
Real-Time Response. Move beyond polling. This guide explains how to set up real-time notifications via Falcon Fusion or the Event Stream, allowing Falcon to push alerts directly to your platform.
Data Precision. Master the filtering syntax used by the Falcon API. Learn to use logical operators and property filters to retrieve only the specific hosts, detections, or vulnerabilities relevant to your task.
Real-Time Response (RTR) provides a direct, interactive interface to remote hosts for live investigation, forensic collection, and immediate threat remediation. This guide covers how to automate session lifecycles, execute custom scripts, and audit remote actions to maintain complete control over your environment.
Prerequisites
Section titled “Prerequisites”- Administrative Access: Required to manage API clients and webhooks in the Falcon Console.
- Cloud Region: Identify your base URL (e.g.,
api.crowdstrike.comvsapi.us-2.crowdstrike.com).