CrowdStrike
CrowdStrike Falcon connects your EDR-covered device inventory and vulnerability findings (via Falcon Spotlight) into Navigator.
At a glance
| Data provided | Devices, Users, Vulnerabilities |
| Authentication | OAuth2 client credentials (Falcon API client) |
| Where to configure | Connectors → Add a Connector → CrowdStrike |
Required permissions
Create a Falcon API client with these scopes:
| Scope | Why it’s needed |
|---|---|
| Hosts: Read | Read device (host) inventory |
| Spotlight Vulnerabilities: Read | Read vulnerability findings |
No separate Users scope
CrowdStrike’s core product has no standalone user-directory API. User data is derived from each host’s own last-logged-in-user field, so no separate Users scope is required.
Setup
- In the Falcon console, go to Support and resources → API Clients and Keys and create a new API client with the scopes listed above.
- Note the Client ID and Client Secret.
- If your tenant is on a CrowdStrike cloud region other than the default (
us-1), also note your API Base URL. - In Navigator, go to Connectors → Add a Connector → CrowdStrike.
- Enter the Client ID, Client Secret, and (if applicable) your region’s Base URL.
- Save. Navigator validates the credentials and enqueues a first sync immediately.
Vendor documentation
The API Clients and Keys page is documented inside CrowdStrike’s own Falcon console help (Support and resources → Documentation → CrowdStrike OAuth2-Based APIs), which requires a logged-in Falcon session to view, so there’s no public link to it. CrowdStrike’s public API reference is available at the CrowdStrike Developer Center.
What data this connector provides
- Devices: including native internal/external IP address separation.
- Users: derived from each host’s last-logged-in-user field, not a standalone directory (see the note above).
- Vulnerabilities: via Falcon Spotlight, scoped by default to open findings.
Every CrowdStrike-covered device is treated as having agent-based EDR coverage.
Known limitations
- CrowdStrike reports macOS as
"Mac", a fourth distinct spelling alongside how Entra, Intune/Defender, and Okta each report the same platform. This is a known, cosmetic inconsistency across connectors, not a matching error. - CrowdStrike’s OS version fields don’t reliably distinguish Windows 10 vs. 11 (both report the same major version with no build number available), so that specific breakdown isn’t available from this connector.
- CrowdStrike’s “Identity Protection” module (a separate, separately-licensed identity directory with its own API) is not currently integrated. The Users data above comes only from host records.