> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# CrowdStrike Falcon

> Connect CrowdStrike Falcon to Myrmex — create an OAuth2 API client and add the integration for real-time detection and response.

import { Note, Steps, Step, CardGroup, Card, Tip } from '@mintlify/components';

Connect **CrowdStrike Falcon** so Myrmex can read detections and incidents, your host inventory, manage custom indicators, and — with approval — run response actions. Myrmex queries the Falcon REST API in real time using an OAuth2 API client, through a [Collector](/documentation/agent-endpoint-security/collector-mode).

<Note>
  Myrmex connects on demand and reads (and acts) in real time — nothing from Falcon is stored on the Myrmex side.
</Note>

## What Myrmex Can Do

<CardGroup cols={2}>
  <Card title="Detections & incidents" icon="bell">
    Read Falcon alerts and incidents live and triage them in [Alerts](/documentation/detection-response/alerts).
  </Card>

  <Card title="Hosts & containment" icon="laptop">
    Read the host inventory and, on approval, contain or release endpoints.
  </Card>

  <Card title="Real Time Response" icon="bolt">
    Run RTR actions and manage custom IOCs/IOAs and policies with [Hydra](/documentation/multi-agent-system/integration-specialist-agent).
  </Card>

  <Card title="Vulnerabilities & sandbox" icon="shield-halved">
    Pull Spotlight vulnerabilities and Falcon sandbox context to enrich investigations.
  </Card>
</CardGroup>

## Before You Start

* A Falcon account with permission to create API clients (Falcon Administrator).
* Your Falcon **cloud region** / base URL.
* A [Collector](/documentation/agent-endpoint-security/collector-mode) that can reach the Falcon API over outbound HTTPS.

## Step 1 — Create the Credential in CrowdStrike Falcon

<Steps>
  <Step title="Open API clients and keys">
    In the Falcon console, go to **Support and resources → Resources and tools → API clients and keys**.
  </Step>

  <Step title="Create an API client">
    Click **Add new API client**. Give it a name and grant the **API scopes** Myrmex needs — **Read** scopes to query detections, incidents, hosts, Spotlight, and IOCs, and **Write** scopes for response (Real Time Response, host containment, IOC management, policies).
  </Step>

  <Step title="Copy the credentials">
    Copy the **Client ID** and **Client Secret** now — the secret is shown only once. Note your Falcon base URL.
  </Step>
</Steps>

<Tip>
  Start with read-only scopes for analysis, and add write scopes only when you want the agents to take action.
</Tip>

## Step 2 — Add the Integration in Myrmex

From the **Directory**, choose **Add Integration → CrowdStrike Falcon**, then fill in:

| Field               | Description                                                                                                                                                                               |
| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Name**            | A unique name for this Falcon instance.                                                                                                                                                   |
| **Description**     | Optional note to identify the tenant.                                                                                                                                                     |
| **Collector**       | The [Collector](/documentation/agent-endpoint-security/collector-mode) that connects to the Falcon API.                                                                                   |
| **Client ID**       | The OAuth2 client ID from your Falcon API client.                                                                                                                                         |
| **Client Secret**   | The client secret paired with the Client ID.                                                                                                                                              |
| **Falcon API Host** | Base host of your Falcon cloud — e.g. `api.crowdstrike.com` (US-1), `api.us-2.crowdstrike.com` (US-2), `api.eu-1.crowdstrike.com` (EU-1), `api.laggar.gcw.crowdstrike.com` (US-GovCloud). |
| **Port**            | API port (default `443`).                                                                                                                                                                 |

## Connect

Click **Connect** to validate the OAuth2 client. Falcon then appears under **Environment → Integrations**, and you can triage its detections — queried live — in [Alerts](/documentation/detection-response/alerts).