CrowdStrike EDR Discovery

CrowdStrike EDR Discovery imports read-only Falcon endpoint evidence into AgentKeeper AI Discovery.

Required Falcon API Permissions

Create a Falcon API client with:

• Hosts: Read
• Real Time Response: Read

Use the smallest host scope that covers the endpoints you want AgentKeeper to review.

Required Values

In Settings -> Connectors -> Endpoint Discovery (EDR) choose CrowdStrike and enter:

• region: US-1, US-2, EU-1, or US-GOV-1;
• client ID;
• client secret;
• optional Falcon base URL override;
• optional Falcon host FQL filter.

Default API base URLs:

API Paths Used

AgentKeeper uses:

• POST /oauth2/token for OAuth client credentials.
• GET /devices/queries/devices/v1 to enumerate host IDs.
• GET /devices/entities/devices/v2 to load host details.
• GET /devices/combined/devices/v1 as a host detail fallback path.
• GET /discover/combined/applications/v1 when the tenant has application inventory available.

The connector also defines the read-only Real Time Response discovery path for deeper scan coverage:

• POST /real-time-response/combined/batch-init-session/v1
• POST /real-time-response/combined/batch-command/v1
• GET /real-time-response/entities/command/v1

V1 stores only normalized indicators from those paths. It does not store raw RTR output.

Host Filter

Use Falcon Query Language to scope the scan. Examples:

platform_name:'Mac'

tags:'ai-discovery'

Start without a filter during sandbox validation, confirm results, then add the filter.

Imported Evidence

CrowdStrike evidence can identify:

• installed desktop agents and IDEs;
• command-line packages such as Claude Code, Codex, and Gemini CLI;
• endpoint host context such as hostname, platform, last user, and last seen;
• version and application metadata when the tenant exposes application inventory.

Troubleshooting