CrowdStrike Permissions Reference

This page lists all required API scopes and access levels for the CrowdStrike integration.

Required API Scopes

Scope	Permission	Purpose	API	Features
Hosts	Read	List devices for scanning	`/devices/queries/devices-scroll/v1 /devices/queries/devices-scroll/v1`	All
Real Time Response	Read	Create RTR sessions and read agents, secrets on devices AI MCP File lookup and Secrets Scanning	`/real-time-response/entities/command/v1/real-time-response/entities/sessions/v1`	Shadow Agentic AI Secrets Scanning
NGSIEM	Read/Write	EDR Telemetry to classify AI Agents, MCPs on endpoints and their activity Write is required to create queries, there's no modification of data whatsoever.	-	Shadow Agentic AI
Identity Protection GraphQL	Write	List identities (human, programmatic, groups)	`/identity-protection/combined/graphql/v1`	Active Directory Identities
Identity Protection Entities	Read	Retrieve identity entity details	`/identity-protection/entities/*`	Active Directory Identities
Identity Protection Detections	Read	Retrieve identity-based threat detections	`/identity-protection/detections/*`	Active Directory Identities
Identity Protection Timeline	Read	Access identity activity timeline	`/identity-protection/timeline/*`	Active Directory Identities

Warning

Write permissions are restricted and only granted for: