Create the API client
An API client is a Client ID and Client Secret pair with only the scopes you pick.
Sign in to Falcon
Sign in to your Falcon console as a user with the Falcon Administrator role.
- Navigate to Support and resources > Resources and tools > API clients and keys, or search the console for API clients and keys.
Start a new API client
Click Create API client.
- Some consoles show Add new API client instead.
- Client name:
StackOne Integration - Description: optional, for your records
Choose the API scopes
In the scope list, select Read and leave Write cleared on each scope below.
- User management: lists users, roles and role grants. This is the only scope needed for users and roles.
- Flight Control: also select Read only if you want user groups or the list of child accounts. Both exist only in Flight Control accounts. Without this scope, those requests fail with a 403 from CrowdStrike, and users and roles still work.
- Do not select any Write box, and do not add other scopes.
Copy the Client ID and Client Secret
Click Create. Copy the Client ID and the Secret and store them securely for use later.
- Some consoles show Add instead.
- The secret is shown once. If you lose it, reset the secret on the API client and use the new value, because everything that used the old one stops working.
- Paste the Client ID into the Client ID field in StackOne Hub.
- Paste the Client Secret into the Client Secret field in StackOne Hub.
- The same dialog shows the Base URL. Keep it for the Falcon Cloud field.
- If your Falcon account limits API access by IP address (Host setup and management > Falcon users > IP Allowlist Management, an IP group with access type API), add StackOne’s IP addresses to it. Otherwise CrowdStrike refuses the token request. A change can take 30 minutes to apply.
Find your Falcon Cloud
The Falcon Cloud is the CrowdStrike cloud that hosts your Falcon account. It decides which API address StackOne calls.
- Read the Base URL in the dialog that shows the new secret, or on the API clients and keys page. In StackOne Hub, pick the Falcon Cloud option that matches it.
- US-1:
api.crowdstrike.com - US-2:
api.us-2.crowdstrike.com - US-3:
api.us-3.crowdstrike.com - EU-1:
api.eu-1.crowdstrike.com - US-GOV-1:
api.laggar.gcw.crowdstrike.com - US-GOV-2:
api.us-gov-2.crowdstrike.mil - A wrong choice makes authentication fail even with correct credentials.
Choose a Flight Control child account
The Child CID field is optional. Fill it in only if your Falcon account is a Flight Control parent and this connection should read one child account.
- Create the API client in the parent account. Then view the child account in the Falcon console and open its sensor downloads page. The CID with its checksum is shown on the right side of that page.
- Paste that CID into the Child CID field in StackOne Hub.
- Format: 32 hexadecimal characters in either case, with or without a
-XXchecksum ending - Example:
12345678901234567890123456789012-34 - Every request then acts in that child account. To read another child, add a second connection.
- Leave it empty to read the account the API client belongs to.
Revoke access
To stop StackOne from reading your Falcon account, remove the API client.
- Navigate to Support and resources > Resources and tools > API clients and keys, or search the console for API clients and keys.
- Delete the API client you created for StackOne, or reset its secret.
- The connection then fails until you create a new API client or enter the new secret in StackOne Hub.
Linking the Account from the Hub
Navigate to the Hub
Fill out the fields
- Falcon Cloud
- Client ID
- Client Secret
- Child CID (Optional)
Connect
- Click Connect
- If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
- Once authorization is successful, you will see a confirmation popup
If the account linking is successful, you will see the newly linked account on your Accounts page.