Configure the CrowdStrike Falcon Host API Service Service

Configure the CrowdStrike Falcon Host OAuth2-based API as a service to get entity and artifact reputations, search hosts, and run other CrowdStrike Falcon actions.

Note the client ID and client secret of the API client you created.
Ensure you assign specific scopes to the API client:
- Detections
- Hosts
- Sandbox
- Host Groups
- IOC Manager
- IOCs
- Prevention Policies
- Real Time Response (Admin)
- Real Time Response
- Sample Uploads
- Sensor Update Policies
- User Management
Note the API IP address or domain of your CrowdStrike Falcon endpoint.
If you use a proxy, ensure that you whitelist the API IP address or domain.

In the sidebar, click SETTINGS, then select Core.
Under SERVICE INTEGRATIONS, select Services.
Select a service:
- To configure a specific service, hover over a service, then click CONFIGURE. Use the search by vendor or filter by action to find a service.
- To manually provide the relevant information for a service, click Configure a new service.
- To view all actions for a service, hover over a service, then click the information icon .
Enter information about the service:
- Service Name – Enter a unique name for the service. By default, the service name is CrowdstrikeFalconV2.
- (Optional) Description – Describe the service.
- (Optional) Owner – Enter the email address of the person or group responsible for the service.
- Client ID – Enter the client ID of your CrowdStrike Falcon API client.
- Client Secret – Enter the client secret of your CrowdStrike Falcon API.
- API Host – Enter the IP address or domain of your CrowdStrike Falcon endpoint.
To validate the source, select TEST CONNECTIVITY.
Select CREATE SERVICE.

Cloud-delivered Incident ResponderIncident Responder Documentation

Table of ContentsTable of Contents

Configure the CrowdStrike Falcon Host API Service Service