Crowdstrike setup

Part 1: Crowdstrike Data Ingestion

Set up a CrowdStrike Falcon API client so ConfigView can pull your endpoint security and Falcon Cloud Security (Azure) data into the dashboard.

Step 1: Create an API Client

Log in to your CrowdStrike Falcon Console.
Navigate to Support and resources > API Clients and Keys.
Click Add new API client.

Give it a name (e.g. ConfigView) and grant the Read scopes below for the data sets you want to ingest:

Scope	Access	Powers
Hosts	Read	Device IDs, Host Details
Alerts	Read	Alerts (Detections)
Incidents	Read	Incidents
Host Groups	Read	Host Groups
Prevention Policies	Read	Prevention Policies
Sensor Update Policies	Read	Sensor Update Policies
Falcon Cloud Security (CSPM registration)	Read	Azure Accounts, Misconfigurations (IOM), Policies

Click Add and copy the Client ID and Client Secret — the secret is shown only once.

Cloud region: these scripts default to the US-1 cloud (https://api.crowdstrike.com). If your tenant is on US-2, EU-1, or GovCloud, update the BASE_URL constant at the top of each crowdstrike_get_*.py and the health check to the matching API host.

Step 2: Add the Credentials to ConfigView

Go to your ConfigView dashboard: https://{companyname}.configview.com/admin/integrations/Crowdstrike
Under Credentials, enter each value and click the save icon on its row:
- CROWDSTRIKE_CLIENT_ID
- CROWDSTRIKE_CLIENT_SECRET

Step 3: Enable the Crowdstrike App in ConfigView

Go to: https://{companyname}.configview.com/admin/integrations/Crowdstrike
Click Connect. ConfigView creates its tables and schedules every collector at your default run time.
Click Verify now to confirm the credentials work.

Step 4: Verify

Go to: https://{companyname}.configview.com/admin/status/
Run the Crowdstrike health check.
All checks should pass. The health check probes each read scope individually, so a failed check names the exact scope to grant on the API client.

If a check fails, verify that your secrets are saved correctly and the API client has the required Read scopes from Step 1.

Available Scripts

Script	Table	Description
Device IDs	`crowdstrike_ids`	Managed device IDs (run first)
Host Details	`crowdstrike_ids_details`	Sensor, OS, and host metadata per device
Alerts (Detections)	`crowdstrike_alerts`	EDR detections — severity, tactic/technique, host, status (last 90 days)
Incidents	`crowdstrike_incidents`	Correlated incidents — score, state, affected hosts
Host Groups	`crowdstrike_host_groups`	Static / dynamic host groups and assignment rules
Prevention Policies	`crowdstrike_prevention_policies`	Prevention policy config, enabled state, assigned groups
Sensor Update Policies	`crowdstrike_sensor_update_policies`	Sensor build targets and uninstall protection
Device Control Policies (USB)	`crowdstrike_device_control_policies`, `crowdstrike_device_control_classes`, `crowdstrike_device_control_exceptions`, `crowdstrike_device_control_policy_groups`	USB / Device Control policies, the per-class action (e.g. mass storage blocked), the exempted peripherals, and the host groups each policy is assigned to
Falcon Console Users	`crowdstrike_users`, `crowdstrike_user_roles`	Falcon console users with status, MFA factors and last login — plus every role granted to each, in `crowdstrike_user_roles`
Response Policies	`crowdstrike_response_policies`	Real Time Response policy config, enabled state and assigned host groups
Content Update Policies	`crowdstrike_content_update_policies`	Content update ring assignment and pinned content versions
IOA Rule Groups	`crowdstrike_ioa_rule_groups`	Custom IOA rule groups with platform, enabled state and rule count
IOA Rules	`crowdstrike_ioa_rules`	Individual custom IOA rules with pattern severity, action and match fields
Custom IOC Indicators	`crowdstrike_iocs`	Custom IOC indicators (hashes, domains, IPs) with action, severity and platforms
Sensor Build Versions	`crowdstrike_sensor_builds`	Every sensor build available per platform, with stage and LTS flag
Quarantined Files	`crowdstrike_quarantined_files`	Files quarantined by the sensor, with host, hash and state
Installation Tokens	`crowdstrike_installation_tokens`	Sensor installation tokens, their labels, status and expiry
Scheduled Reports	`crowdstrike_scheduled_reports`	Scheduled Falcon reports, their type, status and who they are shared with
Discover - Hosts	`crowdstrike_discover_hosts`	Every asset Falcon Discover sees — including hosts with no sensor installed, which is the EDR coverage gap
Discover - Accounts	`crowdstrike_discover_accounts`	Accounts Discover has observed, with admin privilege flags and last successful login
Discover - Logins	`crowdstrike_discover_logins`	Login events Discover has observed, with status, type, host and remote IP
Device Policy Assignment (per host)	`crowdstrike_device_policies`	Which policy of each type Falcon actually applied to each host — including hosts with no device control policy at all
Host Group Members	`crowdstrike_host_group_members`	Which devices are in each host group — resolved from the sensor’s own group list, so dynamic groups are included
Exclusions (Sensor Visibility / ML / IOA)	`crowdstrike_exclusions`	Sensor visibility, machine learning, and indicator-of-attack exclusions, with the groups each applies to
Cloud Security — Azure Accounts	`crowdstrike_cspm_azure_accounts`	Registered Azure subscriptions and CSPM status
Cloud Security — Azure Misconfigurations (IOM)	`crowdstrike_cspm_iom`	Indicators of Misconfiguration across Azure services
Cloud Security — Azure Policies	`crowdstrike_cspm_policies`	CSPM policy catalog for Azure with severity and state

Note: The Alerts script ingests the last 90 days of detections by default. Adjust the LOOKBACK_DAYS constant in crowdstrike_get_alerts.py to widen or narrow the window.

Data Tables

Once the scripts run, the corresponding Crowdstrike tables will be created in your database. All tables include a run_at column for historical tracking and a raw JSON column with the full CrowdStrike object for each record.

Platform

Integrations

Part 1: Crowdstrike Data Ingestion

Step 1: Create an API Client

Step 2: Add the Credentials to ConfigView

Step 3: Enable the Crowdstrike App in ConfigView

Step 4: Verify

Available Scripts

Data Tables

​Part 1: Crowdstrike Data Ingestion

​Step 1: Create an API Client

​Step 2: Add the Credentials to ConfigView

​Step 3: Enable the Crowdstrike App in ConfigView

​Step 4: Verify

​Available Scripts

​Data Tables

Part 1: Crowdstrike Data Ingestion

Step 1: Create an API Client

Step 2: Add the Credentials to ConfigView

Step 3: Enable the Crowdstrike App in ConfigView

Step 4: Verify

Available Scripts

Data Tables