CrowdStrike connector setup
Polls detection, audit, and incident events from the CrowdStrike Falcon Event Streams API.
What you need first
| Requirement | Details |
|---|---|
| CrowdStrike Falcon | Administrator access to create API clients |
| Event Streams API | Enabled for your tenant (contact CrowdStrike support if unavailable) |
| Cloud region | Know which Falcon cloud hosts your tenant (us-1, us-2, eu-1, us-gov-1, us-gov-2) |
1. Create an API client
- Sign in to the Falcon console.
- Go to Support and resources → API clients and keys.
- Under OAuth2 API clients, click Create API client (or Add new API client).
- Enter a Client name and Description (e.g.
Perpetual Event Streams). - Under API scopes, enable Read for Event streams.
- Click Create / Add.
- Copy the Client ID and Client secret from the confirmation dialog. The secret is shown only once.
TODO ‼️
Screenshot from source not yet imported: the Falcon console's Create API client dialog, showing the Event streams scope with the Read checkbox selected.
Note the Base URL shown with your credentials — it indicates which cloud environment to select in Perpetual.
2. Perpetual credential
- Log in to Perpetual. Open Settings from the user/org control at the bottom left of the sidebar (click your name → Settings), then go to Credentials → New Credential.
- Choose OAuth 2.0 Client Credentials.
- Fill in:
| Field | Value |
|---|---|
| Name | Unique identifier using letters, digits, and underscores only (e.g. crowdstrike). |
| Allowed URL patterns | *.crowdstrike.com, *.crowdstrike.mil |
| Token URL | Match your Falcon cloud (see table below) |
| Client ID | Client ID from step 1 |
| Client Secret | Client secret from step 1 |
Token URL by cloud:
| Cloud | Token URL |
|---|---|
| US-1 | https://api.crowdstrike.com/oauth2/token |
| US-2 | https://api.us-2.crowdstrike.com/oauth2/token |
| EU-1 | https://api.eu-1.crowdstrike.com/oauth2/token |
| US Gov-1 | https://api.laggar.gcw.crowdstrike.com/oauth2/token |
| US Gov-2 | https://api.us-gov-2.crowdstrike.mil/oauth2/token |
- Save the credential. Perpetual refreshes tokens automatically (30-minute lifetime).
3. Create the CrowdStrike connector
- Go to Datasets → Connectors → Create Connector.
- Select CrowdStrike.
- Connector name: unique identifier (letters, numbers, underscores).
- Configure:
- CrowdStrike API: select the credential from step 2.
- Poll interval (minutes): default
5. Event stream reads run each poll until the deadline. - Cloud environment: match your Falcon tenant (
us1,us2,eu1,usGov1,usGov2).
- Optionally check Deploy, then save.
The connector discovers all available event stream partitions, reads new events since the last offset, and commits partition offsets after each successful emit.
Operational notes
- Dedicated client: Use a dedicated API client for this connector; do not share credentials with unrelated integrations.
- MSSP / multi-CID: If your API client spans multiple CIDs, configure member CID scoping in the credential if your environment supports it.