Crowdstrike setup

​

Part 1: Crowdstrike Data Ingestion

Set up a CrowdStrike Falcon API client so ConfigView can pull your endpoint security and Falcon Cloud Security (Azure) data into the dashboard.

---

​

Step 1: Create an API Client

1. Log in to your CrowdStrike Falcon Console.
2. Navigate to Support and resources > API Clients and Keys.
3. Click Add new API client.
4. Give it a name (e.g. ConfigView) and grant the Read scopes below for the data sets you want to ingest:

   Scope	Access	Powers
   Hosts	Read	Device IDs, Host Details
   Alerts	Read	Alerts (Detections)
   Incidents	Read	Incidents
   Host Groups	Read	Host Groups
   Prevention Policies	Read	Prevention Policies
   Sensor Update Policies	Read	Sensor Update Policies
   Falcon Cloud Security (CSPM registration)	Read	Azure Accounts, Misconfigurations (IOM), Policies

5. Click Add and copy the Client ID and Client Secret — the secret is shown only once.

Cloud region: these scripts default to the US-1 cloud (https://api.crowdstrike.com). If your tenant is on US-2, EU-1, or GovCloud, update the BASE_URL constant at the top of each crowdstrike_get_*.py and the health check to the matching API host.

---

​

Step 2: Add the Credentials to ConfigView

1. Go to your ConfigView dashboard: https://{companyname}.configview.com/admin/secret/
2. Click Add Secret
3. Create the following secrets:
   • CROWDSTRIKE_CLIENT_ID
   • CROWDSTRIKE_CLIENT_SECRET
4. Click Save

---

​

Step 3: Enable the Crowdstrike App in ConfigView

1. Go to: https://{companyname}.configview.com/admin/cron/
2. You should see Crowdstrike in the list of available apps
3. Select the scripts you want to run.
4. Click Save

---

​

Step 4: Verify

1. Go to: https://{companyname}.configview.com/admin/status/
2. Run the Crowdstrike health check.
3. All checks should pass. The health check probes each read scope individually, so a failed check names the exact scope to grant on the API client.

If a check fails, verify that your secrets are saved correctly and the API client has the required Read scopes from Step 1.

---

​

Available Scripts

Note: The Alerts script ingests the last 90 days of detections by default. Adjust the LOOKBACK_DAYS constant in crowdstrike_get_alerts.py to widen or narrow the window.

---

​

Data Tables

Once the scripts run, the corresponding Crowdstrike tables will be created in your database. All tables include a run_at column for historical tracking and a raw JSON column with the full CrowdStrike object for each record.