Skip to main content
Oleria provides identity security and access management teams with visibility and intelligence into who has access to what, where they got that access, how they use it, and whether they should even have it. As part of that promise, we deeply integrate your CrowdStrike Falcon console into the Oleria platform. This document provides step-by-step guidance for integrating Falcon with your Oleria workspace. A single Oleria connection covers one Falcon tenant (CID) in one region - Oleria discovers every console user and role the connection can reach.

​
Prerequisites

  • A CrowdStrike Falcon console with administrative access.
  • An administrator who can create an API client under Support and resources -> API Clients and Keys.
  • Your Falcon tenant’s region - US-1, US-2, EU-1, or US-GOV-1. Falcon has no single global endpoint, so this must be selected explicitly.
Falcon console roles are scoped to the whole tenant (CID), not to individual devices - Oleria does not (and cannot) model per-host access grants, since Falcon’s console RBAC has no such concept.

​
What Oleria discovers

​
Set up the integration

Falcon authentication uses OAuth 2.0 client credentials - a Client ID and Client Secret issued to an API client you create in the console. Access is entirely determined by the scopes granted to that API client; nothing is requested at connection time.
1

Create an API client

In the Falcon console, go to Support and resources -> API Clients and Keys -> Add new API client.Give it a descriptive name (for example Oleria), and grant it these scopes:
  • user-management:read - list and retrieve users and roles.
  • sensor-download:read - read the CCID and sensor installer catalog. Required for every connection.
  • alerts:read - list and retrieve Falcon detections, used for the Activity sync.
  • user-management:write - create, update, delete users, and grant/revoke roles. Required only if you want Oleria to run remediation actions.
2

Copy the credentials

Save the API client. Copy the Client ID and Client Secret immediately - Falcon shows the secret only once.
If you lose the client secret, you must generate a new one from the same API client. The existing secret cannot be recovered.

​
Connect CrowdStrike Falcon to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select CrowdStrike Falcon.
2

Complete the connection form

3

Save the integration

Select Authenticate to validate and save the integration.

​
Verify the integration

Confirm CrowdStrike Falcon appears in your Oleria workspace connected integrations. After the first sync completes, you can review the discovered console users, roles, and detection activity in your Oleria workspace.

​
Supported remediation actions

​
Notes and limitations

  • No account disable. Falcon’s only lifecycle removal action is a hard delete - there is no reversible suspend state, so this action cannot be undone.
  • No group concept for a standard tenant - role grants are direct user-to-role assignments.
  • No per-device access. Endpoint and host inventory exist in Falcon, but hosts have no per-user access-grant surface in the console RBAC model, so they aren’t modeled as resources.
  • MSSP / Flight Control (parent-CID managing child CIDs) is out of scope - this connector targets a standard, standalone tenant.

​
Contact us

For questions about this integration, contact us at support@oleria.com.