Falcon data source

Falcon (by CrowdStrike) is an endpoint detection and response (EDR) platform that monitors devices for malicious activity and helps respond to threats.

The Falcon data source uses an API connection to bring Falcon data into Data Manager.

How to connect Falcon to Data Manager

1. Gather all of the Data Manager type information, including the data source name, short display name, and the data source type.

2. Gather the Falcon fields – this may require consultation with the Falcon subject matter expert (SME).

3. In Data Manager, add a new data source by selecting the tool you which to connect and configure with all the gathered information.

Each time this data source is fetched the data becomes raw data.

Data Manager fields

You need to specify the following information from Data Manager:

• Data source name – the name of the data source used to run, transform, map, cleanse, and import the data.

• Short display name – a unique name as a data source label.

• Data source type – what type of data the tool is providing. For example, Assets, CMDB, user location.

Falcon fields

• API URL – base API URL for your CrowdStrike instance.

• Client ID – created when the API client is set up.

• Client secret – secret string created with the API client.

• API limit – sets the page size of API results (number of records per call).

  • Default: 5000

  • Recommended: 1000 for heavily populated sources

  • Range: 1–5000

Authentication and authorization

1. Create API clients to grant API access.

2. From API Clients and Keys, select Add new API client.

3. Provide:

   • Client name (required)

   • Description (optional)

   • API scopes

4. Click Add to generate Client ID and secret.

API calls

1. Retrieve device IDs:

   • API: {api-url}/devices/queries/devices-scroll/v1?limit={apiLimit}

   • Method: GET

   • Response:

     • meta (query_time, pagination, powered_by, trace_id)

     • resources (list of IDs)

     • errors

2. Retrieve device details for those IDs:

   • API: {api-url}/devices/entities/devices/v2

   • Method: POST

   • Response: fields below.

The following fields are retrieved: