This guide walks you through creating a CrowdStrike OAuth client, and gathering the configuration needed to create a CrowdStrike Identity integration.
Before you begin, ensure that you have:
- Access to the CrowdStrike Falcon Console
- Administrative privileges to create an API client
- Falcon Identity Protection enabled on your tenant
Log in to your CrowdStrike Console instance.
Open the main menu and navigate to the Support and resources > API Clients and Keys. Click the 'Create API client' button.
In the pop up give the client a name and select the following scopes:
| Scope | Read | Write | Purpose |
|---|---|---|---|
| Alerts | ✅ | ❌ | Retrieve identity protection alerts about risky activity |
| Identity Protection Entities | ✅ | ❌ | Retrieve data about users and their identity risk |
| Identity Protection GraphQL | ❌ | ✅ | Required even though this integration only reads data. CrowdStrike treats GraphQL as Write because requests are sent as HTTP POST |
After selecting the scopes, click the Create button. The pop up will present you with your new Client ID, Client Secret and Base URL. Copy these values down to a safe location. If you need to adjust the scopes later, you can click the three dots to the right of the client listing on the main API clients and keys page.
Create your integration by supplying all of the required values.
| Integration Parameter | Description |
|---|---|
| Base URL | This is the Base URL of your Falcon instance gathered in step 2. |
| Client Id | This is the Client Id gathered in step 2. |
| Client Secret | This is the Client Secret gathered in step 2. |