> For the complete documentation index, see [llms.txt](https://docs.cybaops.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybaops.com/getting-started/onboarding/connectors/crowdstrike.md).
# CrowdStrike
The CrowdStrike connector works by syncronising data from your CrowdStrike account to your MDR module in your CybaOps account.
It is one-way, and only takes information from CrowdStrike to CybaOps. It does not push data from CybaOps to CrowdStike.
## Guide
This guide will help you collect:
* **Client ID**
* **Client Secret**
* **Customer ID (CID)**
And ensure the correct permissions are enabled:
* **Cases**
* **Alerts**
* **Detections**
* **API Integrations**
### Step 1: Log into CrowdStrike
Go to the CrowdStrike Falcon Console:
[https://falcon.crowdstrike.com](https://falcon.crowdstrike.com/)
Log in with an account that has **administrator permissions**.
### Step 2: Get Your Customer ID (CID)
1. In the Falcon console
2. Look in the top right corner click on your company name:
* This will give you a drop down with your CID it will look something like this
Copy your **Customer ID (CID)** and paste it into the relevant field in CybaOps.
This is usually a string of characters (sometimes includes a region suffix like -eu).
### Step 3: Create API Client (Client ID & Secret)
1. Go to:
* Support → **API Clients and Keys**
2. Click:
* **Create API Client**
3. Name it:
* CybaOps Connector
4. Set permissions (covered in Step 4)
5. Click **Create**
Copy **Client ID** and **Client Secret** to the relevant fields in CybaOps.
### Step 4: Assign Required Permissions (Detailed)
This is the key step to ensure data flows into CybaOps correctly.
When creating the API client, you’ll be presented with permission scopes. You need to enable the following:
#### Required Permissions
**Alerts (Read)**
Allows CybaOps to:
* Retrieve alert data
* Monitor triggered security events
**Detections (Read)**
Allows CybaOps to:
* Pull detection data from endpoints
* Track malicious activity and behaviours
**Cases (Read)**
Allows CybaOps to:
* Access incident/case data
* Correlate investigations and response activity
**API Integrations**
Allows CybaOps to:
* Interact with CrowdStrike APIs
* Ensure stable integration and data ingestion
#### How to Apply Permissions
When selecting scopes during API client creation:
* Search for and enable:
* Alerts: Read
* Detections: Read
* Cases: Read
* API Integrations: Read
Only **Read access** is required. \
You do not need write or admin permissions.
This ensures CybaOps has full visibility across your environment.
Once confirming, you will see a Client ID, Secret and base URL. Copy the **Client ID** and **Secret** and paste into the relevant fields in CybaOps.
#### Data Syncronisation
The data is pulled every 5 minutes. The same **5 minute cadence** is used for normal operation and routine health checks. If there is **an authentication or authorisation error** (for example, an expired client secret), the connector backs off and **retries every 30 minutes**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.cybaops.com/getting-started/onboarding/connectors/crowdstrike.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.