# Connect CrowdStrike Falcon

> Create a read-only Falcon API client, connect it to Vigilbase OS, and optionally add a separate client for host containment.

Source: https://docs.vigilbase.com/os/integrations/crowdstrike

The CrowdStrike Falcon connector reads host inventory and alerts. With a separate write client it can propose containing a host and lifting containment. Every change still needs an approved plan.

> [!NOTE]
> This connector is **Alpha**: built and tested in isolation, not yet proven against a live account.

## Before you start

- In Falcon you need the Falcon Administrator role, or a custom role that can manage API clients.
- In Vigilbase OS you need the `integration.manage` and `credential.manage` permissions.

## Create a read-only API client

:::steps
1. **Open Client Management.** In the Falcon console, open **Support and resources › Client Management** (formerly API clients and keys), then the **API clients** tab.
2. **Choose Create API client.** Some consoles say **Add new API client**. Enter the client name `Vigilbase OS (read-only)` and the description `Read-only access for Vigilbase OS security monitoring`.
3. **Tick Read for the scopes.** Tick Read for **Hosts** and **Alerts**. Optionally tick Read for **Sensor download** so Vigilbase can fill in your Customer ID (CID). Leave every Write box unticked.
4. **Choose Create.** Copy the Client ID, Secret and Base URL. The secret is shown only once.
:::

## Connect it to Vigilbase OS

:::steps
1. **Open Integrations, choose Add connection and select CrowdStrike Falcon.**
2. **Paste what CrowdStrike shows after Create.** This fills **Client ID**, **Client secret** and **Falcon cloud**. Nothing you paste is shown again.
3. **Check the Falcon cloud.** The Base URL names it, for example `api.eu-1.crowdstrike.com` is EU-1. Choose it to keep your credentials in your region; if you leave it blank, Vigilbase detects it by asking CrowdStrike's US-1 address first. US-GOV-1 must be chosen. US-3 and US-GOV-2 are not supported yet.
4. **Finish the wizard.** Validate the connection, then choose datasets.
:::

Optional details:

- **Customer ID (CID)**: leave blank and Vigilbase reads it from Falcon. If you enter it, Vigilbase checks it matches the API client.
- **Flight Control child CID**: for MSSPs only, when the API client was created in the Flight Control parent.

## Add containment (optional)

Use a second API client just for response actions, kept separate from the read-only one.

:::steps
1. **In Client Management, create another API client.** Name it `Vigilbase OS (response actions)`.
2. **Tick Write for Hosts only.** Leave everything else unticked.
3. **Choose Create, then copy its Client ID and Secret.**
4. **In Vigilbase OS, open the connection and choose Add write access.** Paste the write client's details.
:::

Containing a host and lifting containment are reversible actions. Both are marked critical, so the person who proposes them can never approve them.

## What is not collected

- Incidents: CrowdStrike retired the Incidents API.
- Falcon Data Replicator telemetry.