Skip to content

CrowdStrike Onboarding

Follow these steps to connect your CrowdStrike environment with SailPoint Entro.

Prerequisites

  • CrowdStrike administrator access

  • Access to Support and Resources > API Clients and Keys

  • Generated Client ID and Client Secret

Step‑by‑Step Configuration

  1. Log in to CrowdStrike Falcon Console

    Log in as an administrator.

  2. Open API Clients and Keys

    Go to Support and Resources → API Clients and Keys.

  3. Create API Client

    Select Create API Client in the top‑right corner.

  4. Name the Client

    Under Client Name, enter Entro Security Integration.

  5. Assign Scopes

    Assign the following scopes:

    • Hosts – Read (All Features)

    • Real-Time Response – Read (AI Agents)

    • NGSIEM - Read & Write (AI Agents)

    • Identity Protection (GraphQL) – Write (Active Directory NHIs)

    • Identity Protection Entities – Read (Active Directory NHIs)

    • Identity Protection Detections – Read (Active Directory NHIs)

    • Identity Protection Timeline – Read (Active Directory NHIs)

  6. Create and copy credentials

    Select Create and copy both Client ID and Client Secret values.

  7. Add CrowdStrike account in SailPoint Entro

    In SailPoint Entro, go to Management > Accounts & Integrations > Add New Account > CrowdStrike.

  8. Enter credentials in SailPoint Entro

    Paste the credentials into the onboarding form fields:

    • Nickname: Name of this integration instance

    • Client ID: From previous step

    • Client Secret: From previous step

    • Worker Group (Connector): Select appropriate group

  9. Connect and verify

    Select Connect. The status should display Verified once validated.