CrowdStrike Falcon Setup Guide

Follow the steps below to connect (where supported) or set up an export-based workflow. Either way, Aurora tracks source, timestamps, ownership, and freshness so evidence stays reusable between reviews.

At a Glance

ConnectionDirect connection

CategoryEndpoint security

Guide3 steps

Need help?

We'll confirm what can be automated, what stays export-based, and how to keep evidence current between review cycles.

Steps

Use these as a starting point, then verify collection inside Aurora.

1
Create Falcon API client with read scopes for hosts and detections.
2
Validate by listing a sample of hosts.
3
Enable incremental sync.

Credentials

The inputs Aurora needs to authorize and collect proof.

client_idclient_secret

Permissions

Aurora requests only the minimum access needed for collection and checks.

Permissions depend on the selected collection mode and configured scope.