> For the complete documentation index, see [llms.txt](https://docs.scanner.dev/scanner/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/crowdstrike.md).

# CrowdStrike

Scanner supports two ways to ingest CrowdStrike logs:

* [Falcon Event Streams](#falcon-event-streams): Collect event and audit records directly from the CrowdStrike API, store the raw logs in S3, and index them for search and detection.
* [Falcon Data Replicator](#falcon-data-replicator): Index CrowdStrike telemetry exported to S3 through FDR.

## Falcon Event Streams

The **`crowdstrike:event_streams`** source collects the Falcon event and audit records available through your account's Event Streams API. Falcon Data Replicator is not required for this source.

### Prerequisites

Before you begin, make sure you have:

* A CrowdStrike Falcon account with Streaming API access enabled.
* A Falcon API client with **Event streams: Read** permission, or access to create one.
* Permission in Scanner to create integrations, Collect Rules, and Index Rules.
* An S3 bucket linked to Scanner, with permission for Scanner to write the collected logs.

CrowdStrike documents the required scope in its [Event Streams API reference](https://developer.crowdstrike.com/api-reference/collections/event-streams/).

### Create a Collect Rule

{% stepper %}
{% step %}

#### Create a New Source

In the Scanner UI, go to the **Collect** tab.

* From the Overview page, click the **+** icon in the upper-right corner.
* Select **Collect Rule**.
* On **Create a New Collect Rule**, choose **CrowdStrike**.
* On **Select a Log Type**, select **`crowdstrike:event_streams`**.
  {% endstep %}

{% step %}

#### Configure the Collect Rule Source

Give the rule a descriptive name, such as `my-org-crowdstrike-events`.
{% endstep %}

{% step %}

#### Connect a CrowdStrike Account

If you have already created a CrowdStrike connection, select it from the list. Otherwise, select **New CrowdStrike Connection** and enter:

* **Connection Name**: A recognizable name for this connection.
* **Cloud**: The CrowdStrike cloud where your Falcon account resides: **US-1**, **US-2**, **US-3**, **EU-1**, **US-GOV-1**, or **US-GOV-2**.
* **Client ID**: The ID of your Falcon API client.
* **Client Secret**: The secret for that API client. Scanner masks this value and does not display it after the connection is created.

To create the credentials in Falcon:

1. Sign in to the Falcon console with permission to manage API clients.
2. Open **API clients and keys** and add a new API client.
3. Give the client a name and enable **Read** for the **Event streams** API scope.
4. Create the client, then copy its client ID and secret into Scanner. Record the secret when Falcon displays it; it is shown only once.

See CrowdStrike's [Event Streams setup guide](https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf) for its API client creation steps.

Click **Connect**. Scanner authenticates and checks stream discovery before saving the connection. For an existing connection, use **Check Connection** to verify access. You can manage connections under **Settings > Integrations**.

Scanner discovers the feed URLs and tracks collection progress automatically; you do not need to supply feed URLs or configure individual partitions.
{% endstep %}

{% step %}

#### Logs Destination

* Choose the **S3 Bucket** where the raw CrowdStrike logs should be stored.
* Optionally, enter a **Bucket Prefix** to organize the data path in your bucket.
  {% endstep %}

{% step %}

#### Review and Create

Review the Collect Rule settings on the **Final Review** screen. Resolve any connection or permission errors before creating the rule.
{% endstep %}
{% endstepper %}

### Collection Behavior

Scanner schedules collection every **5 minutes** and resumes each stream from its saved position. The available history depends on CrowdStrike; this source does not expose a configurable historical start time.

Collection uses at-least-once delivery. If a batch is retried, some records can appear more than once.

### Create an Index Rule

Create an Index Rule from the Collect Rule to make the collected logs available for search and detections.

{% content-ref url="/pages/Gem9jwD4aqayN3OiChpN" %}
[Create an Index Rule](/scanner/using-scanner-complete-feature-reference/data-ingestion/create-an-index-rule.md)
{% endcontent-ref %}

Scanner pre-populates these defaults for **`crowdstrike:event_streams`**:

* **Transformations**: Add Metadata, Parse JSON Fields.
* **Timestamp Field**: `.metadata.eventCreationTime`.

### Troubleshooting

* **Authentication fails**: Check that the selected cloud matches the Falcon account, and verify the client ID and secret.
* **Stream discovery fails**: Confirm that the API client has **Event streams: Read** permission and that Streaming API access is enabled for the account.
* **The connection succeeds, but no logs appear**: A successful connection check confirms authentication and discovery. Confirm that the Collect Rule is enabled, the S3 destination is writable, and an Index Rule covers the destination. Allow a collection cycle and check for activity that produces Event Streams records in Falcon; a quiet stream may have no new events to deliver.

## Falcon Data Replicator

Scanner supports CrowdStrike log events that are exported by Falcon Data Replicator to S3. These logs contain information about endpoint, cloud workload, and identity data from the CrowdStrike product ecosystem. In order for Scanner to see these logs, you can configure CrowdStrike Falcon Data Replicator to publish them to an S3 bucket that Scanner is linked to.

### Step 1: Publish to S3

Within CrowdStrike Falcon, navigate to **Support and resources** and select **Falcon Data Replicator**. If this option is not available, you may need to talk with your CrowdStrike support team to enable Falcon Data Replicator.

First, you can configure Falcon Data Replicator to push logs to a new S3 bucket hosted in CrowdStrike's AWS account. Second, you can configure data to be replicated from CrowdStrike's S3 bucket to your own S3 bucket.

You can follow CrowdStrike's [documentation about Falcon Data Replicator](https://falcon.crowdstrike.com/documentation/9/falcon-data-replicator) to accomplish this. You may also want to use [CrowdStrike's FDR project on GitHub](https://github.com/CrowdStrike/FDR) to replicate the logs to your own S3 bucket.

### Step 2: Create an Index Rule in Scanner

Once CrowdStrike logs are landing in your S3 bucket, [Create an Index Rule](/scanner/using-scanner-complete-feature-reference/data-ingestion/create-an-index-rule.md) to ingest the logs via Scanner Collect for fast search and detections.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.scanner.dev/scanner/using-scanner-complete-feature-reference/data-ingestion/sources/crowdstrike.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.