> For the complete documentation index, see [llms.txt](https://docs.fusion.vectra.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fusion.vectra.ai/enrich-traffic-with-context/configure-context-integrations/crowdstrike-falcon-discover.md).

# CrowdStrike Falcon Discover

{% hint style="warning" %}
**The CrowdStrike Falcon Discover module is required for this integration.**
{% endhint %}

This document provides instructions for configuring CrowdStrike in order for the Vectra context integration to have the correct access to pull label contexts.

## Prerequisites <a href="#prerequisites" id="prerequisites"></a>

Before configuring the CrowdStrike Falcon Discover context integration in Vectra, you will need to have an API user created in CrowdStrike.

### Configure an API Client <a href="#configure-an-api-client" id="configure-an-api-client"></a>

* On the left hand menu expand the "Support and resources" submenu.
* Then click on API clients and keys.\
  ![](/files/1SgxARFCyZrlizB9L0Uz)
* Click on the "add new API client" button in the top right\
  ![](/files/l7rEOyBPEqx1KyPDEGVq)
* Fill out the client name.
* Give the key a description.
* In the API Scopes table select Read permission for "Hosts" and "Assets.
* Click Create at the bottom to create this api client.\
  ![](/files/Nak06yRohyyv1mujydxM)
* After clicking "Create" you will be presented with a screen that shows the credentials like below. Make note of the `CLIENT ID`, `SECRET` and subdomain from the `BASE URL`.
  * Note: The Subdomain of the base URL is what to select for Cloud abbreviation.

    <mark style="color:$info;">**📘 If the BASE URL is api.crowdstrike.com then your cloud is US-1.**</mark><br>

    ![](/files/T9sQpad1lrbkcC1YxotG)

## Vectra portal steps <a href="#vectra-portal-steps" id="vectra-portal-steps"></a>

Navigate to Integrations (make sure you are on the Context tab) and click "Add Integration", then select `CrowdStrike Falcon Discover`

![](/files/u5LU8pz3shBo4AEGatgh)

### Configuration <a href="#configuration" id="configuration"></a>

The following fields are specific to the CrowdStrike Falcon Discover integration.

| Field                | Required | Description                                                                      | Example                                                |
| -------------------- | -------- | -------------------------------------------------------------------------------- | ------------------------------------------------------ |
| `Cloud Abbreviation` | yes      | The falcon cloud to query. Found as the subdomain from the CrowdStrike`BASE URL` | US 2                                                   |
| `Filter`             |          | An optional FQL string to be used when filtering results.                        | entity\_type:'managed'+last\_seen\_timestamp:<'now-3d' |
| `Sort`               |          | An optional FQL sort string.                                                     | last\_seen\_timestamp.desc                             |

### Authentication <a href="#authentication" id="authentication"></a>

The following fields are necessary for the integration to authenticate with CrowdStrike.

| Field           | Required | Description                 |
| --------------- | -------- | --------------------------- |
| `Client ID`     | yes      | The CrowdStrike `CLIENT ID` |
| `Client Secret` | yes      | The CrowdStrike `SECRET`    |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.fusion.vectra.ai/enrich-traffic-with-context/configure-context-integrations/crowdstrike-falcon-discover.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.