Skip to main content

​
Overview

CrowdStrike Falcon is an endpoint detection and response (EDR) platform. The Tierity integration pulls detection and incident data from your Falcon environment so security teams can review endpoint activity alongside other findings without leaving the platform.

​
Prerequisites

  • A CrowdStrike Falcon account with API access
  • A Falcon API client ID and secret (with Detections and Incidents read scope)
  • Manage access (or higher) in Tierity

​
Setup

1

Create a Falcon API client

  1. In the Falcon console, go to Support & Resources → API Clients and Keys.
  2. Click Add new API client.
  3. Grant the following scopes (read only): Detections, Incidents, Hosts.
  4. Copy the Client ID and Client Secret.
2

Configure in Tierity

  1. Go to Config → Integrations → CrowdStrike.
  2. Enter your Client ID, Client Secret, and Cloud region (US-1, US-2, EU-1, etc.).
  3. Click Save & Test.

​
What’s available

​
Workbench card

The CrowdStrike Falcon workbench card shows endpoint count, open detection count, and incident summary at a glance.