Dataset Management
The CrowdStrike SaaS connector includes Dataset 2.0 datasets for the Entro integration. Both datasets are push datasets: Entro discovers the objects from CrowdStrike EDR endpoint telemetry and pushes them into SailPoint. The connector does not call CrowdStrike for these objects, so there is no aggregation schedule. All attributes are new.
Use Dataset Management to review the datasets and resources that Entro pushes into SailPoint.
For more information, refer to Dataset Management.
Important
The connector determines how resources are grouped into datasets. You can view the resources inside each dataset, but you cannot create, delete, or rearrange datasets, or move resources between datasets.
Resources
A Resource defines an object type that Entro pushes from CrowdStrike EDR endpoint telemetry. It specifies the kind of object, the attributes collected for that object, and how SailPoint identifies and displays each object.
For more information, refer to Managing Resources.
Datasets
A Dataset is a named group of one or more related resources. For these push datasets, Entro discovers the objects and pushes them into SailPoint. The connector does not aggregate these objects from CrowdStrike, so there is no aggregation schedule.
Note
Each resource belongs to exactly one dataset for that source. The source defines dataset membership. You can review associated resources, but you cannot create or delete datasets or move resources between them.
Supported Datasets
Go to Admin > Connections > Sources, open your CrowdStrike source, and select Dataset Management > Datasets to view the datasets that Entro pushes into SailPoint. Select a dataset to review its associated resources.
Note
These are push datasets. Entro discovers the objects from CrowdStrike EDR endpoint telemetry and pushes them into SailPoint. The connector does not call CrowdStrike for these objects, so there is no aggregation schedule.
| Dataset Name | Associated Resources | Dataset ID | Required Licenses | Schedule |
|---|---|---|---|---|
| CrowdStrike EDR Process Agent | CrowdStrike EDR Process Agent | endpoint:edr-process |
entro:base |
N/A - pushed by Entro |
| CrowdStrike EDR MCP Config Agent | CrowdStrike EDR MCP Config Agent | endpoint:edr-mcp |
entro:base |
N/A - pushed by Entro |
CrowdStrike EDR Process Agent
AI client processes discovered by Entro from CrowdStrike EDR endpoint telemetry.
CrowdStrike EDR MCP Config Agent
MCP server configurations discovered by Entro from CrowdStrike EDR endpoint telemetry.
Supported Resources
A resource represents an object type that Entro pushes from CrowdStrike EDR endpoint telemetry, such as AI client processes or MCP server configurations. Each resource defines the attributes collected for that object type and how SailPoint displays each object.
For more information, refer to Managing Resources.
Note
These resources belong to push datasets. Entro discovers the objects and pushes them into SailPoint. The connector does not call CrowdStrike for these objects, so there is no aggregation schedule.
On your CrowdStrike source, go to Dataset Management > Resources to view each object type. Select a resource to review its schema on the Schema tab.
| Resource Name | Resource Type | Resource ID |
|---|---|---|
| CrowdStrike EDR Process Agent | std:agent |
endpoint:edr-process |
| CrowdStrike EDR MCP Config Agent | std:agent |
endpoint:edr-mcp |
To inspect attribute names and descriptions after the source exists:
- Go to Admin > Connections > Sources.
- Open your CrowdStrike source.
- Select Dataset Management > Resources.
- Select a resource.
- Open the Schema tab. Attribute names, descriptions, and types are connector-defined and read-only on this page.
CrowdStrike EDR Process Agent Attributes
The following table lists schema properties for the CrowdStrike EDR Process Agent resource (endpoint:edr-process).
| Property | Value |
|---|---|
| Resource ID | endpoint:edr-process |
| Resource type | std:agent |
| Identity attribute | id |
| Display attribute | name |
Attributes
| Attribute | Type | Description |
|---|---|---|
id |
string | Stable agent identity from Entro (for example, <uuid>-Claude). |
name |
string | Normalized AI client name (for example, claude, gemini). |
rawName |
string | Original name from the source system (for example, Claude, GEMINI). |
agentType |
string | Endpoint agent discriminator from Entro (Endpoint Agent: Process). |
classification |
string | Classification enum (for example, Endpoint). |
detectionMethod |
string | Detection method used by Entro; might be null. |
riskBand |
string | Severity band (BENIGN, LOW, MEDIUM, HIGH, CRITICAL, UNKNOWN). |
sourceAccount |
string | Source account display name, typically the endpoint hostname. |
integrationType |
string | Integration type reported by Entro (for example, CROWDSTRIKE). |
sourceUrl |
string | Deep link to the source; might be null. |
environment |
string | Environment name from the source account. |
tags |
array | Tags from the source account. |
insights |
array | Insight descriptions from Entro policies. |
ownerEmail |
string | Flattened owner.email, used for identity correlation. |
owner.email |
string | Primary identity-correlation key. |
owner.name |
string | Owner display name. |
owner.title |
string | Owner job title; might be null. |
owner.department |
string | Owner department; might be null. |
owner.uid |
string | Entro owner uid; fallback correlation key when email is missing. |
lastSeen |
string | ISO-8601 timestamp of the most recent usage or update signal. |
device.hostname |
string | Endpoint hostname. |
device.computerName |
string | Computer name reported by the endpoint. |
device.lastLoginUser |
string | Last login user observed on the device. |
device.osVersion |
string | OS version (for example, Sequoia (15)). |
device.externalIp |
string | External IP observed for the device. |
firstSeen |
string | ISO-8601 timestamp when the agent activity was first observed. |
dnsHitCount |
number | DNS hits attributed to the agent. |
isKnownAiClient |
boolean | Whether Entro recognizes this as a known AI client. |
rollupCount |
number | Number of rolled-up activity events. |
firstRollup |
string | ISO-8601 timestamp of the first rolled-up event. |
lastRollup |
string | ISO-8601 timestamp of the most recent rolled-up event. |
contactedEndpoints[].name |
string | Canonical contacted endpoint name (for example, mcp.entro.security). |
contactedEndpoints[].rawName |
string | Raw contacted endpoint name from the source. |
CrowdStrike EDR MCP Config Agent Attributes
The following table lists schema properties for the CrowdStrike EDR MCP Config Agent resource (endpoint:edr-mcp).
| Property | Value |
|---|---|
| Resource ID | endpoint:edr-mcp |
| Resource type | std:agent |
| Identity attribute | id |
| Display attribute | name |
Attributes
| Attribute | Type | Description |
|---|---|---|
id |
string | Stable agent identity from Entro (for example, <uuid>-Claude). |
name |
string | Normalized AI client name (for example, claude, gemini). |
rawName |
string | Original name from the source system (for example, Claude, GEMINI). |
agentType |
string | Endpoint agent discriminator from Entro (Endpoint Agent: MCP Config). |
classification |
string | Classification enum (for example, Endpoint). |
detectionMethod |
string | Detection method used by Entro; might be null. |
riskBand |
string | Severity band (BENIGN, LOW, MEDIUM, HIGH, CRITICAL, UNKNOWN). |
sourceAccount |
string | Source account display name, typically the endpoint hostname. |
integrationType |
string | Integration type reported by Entro (for example, CROWDSTRIKE). |
sourceUrl |
string | Deep link to the source; might be null. |
environment |
string | Environment name from the source account. |
tags |
array | Tags from the source account. |
insights |
array | Insight descriptions from Entro policies. |
ownerEmail |
string | Flattened owner.email, used for identity correlation. |
owner.email |
string | Primary identity-correlation key. |
owner.name |
string | Owner display name. |
owner.title |
string | Owner job title; might be null. |
owner.department |
string | Owner department; might be null. |
owner.uid |
string | Entro owner uid; fallback correlation key when email is missing. |
lastSeen |
string | ISO-8601 timestamp of the most recent usage or update signal. |
device.hostname |
string | Endpoint hostname. |
device.computerName |
string | Computer name reported by the endpoint. |
device.lastLoginUser |
string | Last login user observed on the device. |
device.osVersion |
string | OS version (for example, Sequoia (15)). |
device.externalIp |
string | External IP observed for the device. |
filePath |
string | Path to the MCP configuration file. |
configuredServers[].name |
string | Canonical MCP server name (for example, github). |
configuredServers[].rawName |
string | Raw MCP server name from the source. |
configuredServers[].serverType |
string | MCP server type; might be null. |
configuredServers[].url |
string | MCP server URL; might be null. |
correlatedTokens[].tokenId |
string | Correlated token identifier; might be partially redacted. |
correlatedTokens[].username |
string | Username associated with the token; might be null. |
correlatedTokens[].accessMethod |
string | Access method for the token (for example, GITHUB_API_TOKEN). |
correlatedTokens[].isAdmin |
boolean | Whether the token holds administrative privileges. |
correlatedTokens[].isOriginToken |
boolean | Whether this token is the origin token. |
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.