> For the complete documentation index, see [llms.txt](https://docs.harmony.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.harmony.io/integrations/edr/crowdstrike.md).

# CrowdStrike

### About CrowdStrike

CrowdStrike Falcon is a cloud-native endpoint protection platform that provides advanced threat detection, prevention, and response capabilities. Connecting CrowdStrike to Harmony enables automated threat response, intelligent security monitoring, and AI-powered incident resolution for your endpoint security operations.

### What the CrowdStrike integration enables

| Capability        | Description                                                  |
| ----------------- | ------------------------------------------------------------ |
| Threat Detection  | Monitor and respond to security threats across all endpoints |
| Device Monitoring | Track CrowdStrike agent status and protection state          |
| Real-Time Alerts  | Receive and route security alerts to appropriate teams       |

### Prerequisites

* **CrowdStrike Falcon Subscription**: Active subscription with API access
* **Admin Credentials**: Falcon Administrator or API Client Manager role
* **Harmony Account**: Active Harmony workspace

### Connect CrowdStrike to Harmony

#### Step 1: Create OAuth2 API Client in CrowdStrike

1. Log in to CrowdStrike Falcon console
2. Navigate to **Support** > **API Clients and Keys**
3. Click **Add new API Client**
4. Configure client:
   * **Client Name**: "Harmony Integration"
   * **Description**: "Integration with Harmony IT operations platform"
5. Select **API Scopes**:
   * **Hosts**: Read
   * **Hosts Groups**: Read
   * **Sensor Update Policies**: Read
   * **Alerts**: Read
   * **Incidents**: Read
   * **Prevention Policies**: Read
   * **Response Policies**: Read
   * **Real Time Response**: Read
   * **Sensor Usage**: Read
   * **User Management**: Read
6. Click **Add** and copy the **Client ID**, **Client Secret**, and **Base URL**

#### Step 2: Navigate to Integrations

1. Log in to your Harmony dashboard
2. Go to **Settings** > **Integrations**
3. Find **CrowdStrike** under **EDR** and click **Connect**

![Navigate to CrowdStrike integration in Harmony dashboard](/files/FtxCzuuqVSDRaDLSTnUb)

#### Step 3: Enter API Credentials

1. Enter your **Base URL** (e.g., `https://api.crowdstrike.com`)
2. Enter your **Client ID**
3. Enter your **Client Secret**
4. Click **Connect**

![Enter CrowdStrike credentials to connect](/files/FGGMA2Pt1egFQ4QiCNwC)

### What Harmony Syncs

**From CrowdStrike:**

* Security detections with severity and details
* Security incidents and investigation data
* Device status and Falcon agent health
* Host information and network details
* Containment state of devices
* Prevention policies and compliance status
* Threat intelligence and IOCs
* Real-time security alerts

### Use Cases

<details>

<summary>Automated Threat Response</summary>

Immediate containment and response to critical security threats

</details>

<details>

<summary>Security Incident Management</summary>

Sync CrowdStrike detections with IT support tickets for tracking

</details>

<details>

<summary>Device Compliance Monitoring</summary>

Track Falcon agent health and automatically resolve common issues

</details>

<details>

<summary>User-Friendly Security Alerts</summary>

Translate technical security alerts into clear user communications

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.harmony.io/integrations/edr/crowdstrike.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.