> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CrowdStrike Falcon

Oleria provides identity security and access management teams with visibility and intelligence into who has access to what, where they got that access, how they use it, and whether they should even have it. As part of that promise, we deeply integrate your CrowdStrike Falcon console into the Oleria platform. This document provides step-by-step guidance for integrating Falcon with your Oleria workspace.

A single Oleria connection covers **one Falcon tenant (CID)** in one region - Oleria discovers every console user and role the connection can reach.

## Prerequisites

* A **CrowdStrike Falcon console** with administrative access.
* An administrator who can create an **API client** under **Support and resources** -> **API Clients and Keys**.
* Your Falcon tenant's **region** - US-1, US-2, EU-1, or US-GOV-1. Falcon has no single global endpoint, so this must be selected explicitly.

<Note>Falcon console roles are scoped to the whole tenant (CID), not to individual devices - Oleria does not (and cannot) model per-host access grants, since Falcon's console RBAC has no such concept.</Note>

## What Oleria discovers

| Area         | Detail                                                                                                                                  |
| :----------- | :-------------------------------------------------------------------------------------------------------------------------------------- |
| **Users**    | Falcon console users as Accounts.                                                                                                       |
| **Roles**    | Console roles, with per-user role assignment. Falcon has no group concept for a standard tenant - role grants are direct, user-to-role. |
| **Activity** | Falcon detections (alerts), as activity events.                                                                                         |

## Set up the integration

Falcon authentication uses **OAuth 2.0 client credentials** - a Client ID and Client Secret issued to an API client you create in the console. Access is entirely determined by the scopes granted to that API client; nothing is requested at connection time.

<Steps>
  <Step title="Create an API client">
    In the Falcon console, go to **Support and resources** -> **API Clients and Keys** -> **Add new API client**.

    Give it a descriptive name (for example `Oleria`), and grant it these scopes:

    * `user-management:read` - list and retrieve users and roles.
    * `sensor-download:read` - read the CCID and sensor installer catalog. Required for every connection.
    * `alerts:read` - list and retrieve Falcon detections, used for the Activity sync.
    * `user-management:write` - create, update, delete users, and grant/revoke roles. Required only if you want Oleria to run remediation actions.
  </Step>

  <Step title="Copy the credentials">
    Save the API client. Copy the **Client ID** and **Client Secret** immediately - Falcon shows the secret only once.

    <Warning>If you lose the client secret, you must generate a new one from the same API client. The existing secret cannot be recovered.</Warning>
  </Step>
</Steps>

## Connect CrowdStrike Falcon to Oleria

<Steps>
  <Step title="Open the integration">
    Go to your Oleria workspace, select **Integrations** -> select **CrowdStrike Falcon**.
  </Step>

  <Step title="Complete the connection form">
    | Field             | Notes                                                                                                                           |
    | :---------------- | :------------------------------------------------------------------------------------------------------------------------------ |
    | **Region**        | Your Falcon tenant's region: `us-1`, `us-2`, `eu-1`, or `us-gov-1`. No default - pick the region your tenant is provisioned in. |
    | **Client ID**     | The API client's Client ID from Step 1.                                                                                         |
    | **Client Secret** | The API client's Client Secret from Step 1.                                                                                     |
  </Step>

  <Step title="Save the integration">
    Select **Authenticate** to validate and save the integration.
  </Step>
</Steps>

## Verify the integration

Confirm CrowdStrike Falcon appears in your Oleria workspace connected integrations. After the first sync completes, you can review the discovered console users, roles, and detection activity in your Oleria workspace.

## Supported remediation actions

| Action                         | Notes                                                                                                                                               |
| :----------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Create Falcon console user** | Creates a bare account only. Falcon's create and role-assignment APIs are fully decoupled - grant a role separately, or the new user has no access. |
| **Delete Falcon console user** | Falcon has no disable/suspend state - this is a permanent, irreversible deletion.                                                                   |
| **Grant / Revoke role**        | Assigns or removes the selected console role for the user.                                                                                          |

## Notes and limitations

* **No account disable.** Falcon's only lifecycle removal action is a hard delete - there is no reversible suspend state, so this action cannot be undone.
* **No group concept** for a standard tenant - role grants are direct user-to-role assignments.
* **No per-device access.** Endpoint and host inventory exist in Falcon, but hosts have no per-user access-grant surface in the console RBAC model, so they aren't modeled as resources.
* **MSSP / Flight Control** (parent-CID managing child CIDs) is out of scope - this connector targets a standard, standalone tenant.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).