Connecting CrowdStrike to Neo

You connect CrowdStrike once at the MSP level. With Falcon Flight Control, one API client in your parent CID covers every child CID under it.

1. Create the API client

Only a Falcon Administrator can create an API client.

Open API clients and keys

Sign in to the Falcon console and open Support and resources > API clients and keys. With Flight Control, do this in your parent CID.

Add the client

Click Create API client, name it Neo, and choose the scopes. For the maintenance and audit jobs give Read on Hosts, Host groups and Sensor update policies, and Write on Host groups and Sensor update policies if Neo should move a computer onto a current sensor. For alert work add Alerts (Read and Write), and Hosts: Write to contain hosts; for Real Time Response add the Real time response scopes. With Flight Control, add Flight Control: Read so Neo can map your child CIDs. Give Neo only the scopes you want it to use: a call outside them is refused by Falcon.

Copy the ID and secret

Copy the Client ID and the Secret. Falcon shows the secret only once.

Do not delete the API client or reset its secret after you connect it. Neo loses access until you save the new secret here.

2. Add the client in Neo

Open Integrations

In the Neo Dashboard, open Integrations and find the CrowdStrike card, under Security.

Pick your Falcon cloud

Choose the cloud your console runs on. The console’s address shows it: falcon.crowdstrike.com is US-1, falcon.us-2.crowdstrike.com is US-2, falcon.eu-1.crowdstrike.com is EU-1.

Pick the connection

One CID if all your customers’ computers are in one Falcon CID. Flight Control if each customer has its own child CID under your parent CID: Neo checks the API client can read your child CIDs before it saves, and maps each one to its company.

Save the client

Paste the Client ID and the Secret and click Save. Neo gets a token from Falcon before saving, so a wrong secret is rejected straight away, and a client from another cloud is rejected with the cloud it belongs to.

3. Turn CrowdStrike on per agent

Open the agent, go to the Integrations section, and pick an access profile for the CrowdStrike block, or set each area yourself. Every area offers Disabled, Read Only and Read / Write.

Area	Covers
Hosts and Host Groups	Hosts, host groups, asset inventory, containment
Sensor Versions, Installers and Update Policies	Sensor builds and installers, sensor update policies, installation tokens
Alerts, Incidents and Detections	Alerts, incidents, quarantine, on-demand scans, cases, Falcon Complete
Real Time Response	RTR sessions and commands on hosts
Prevention, Device Control, Firewall and Other Policies	Prevention, device control, firewall, response, content update, data protection and FileVantage policies
Exclusions, IOCs and Custom IOA Rules	Exclusions, IOCs, custom IOA rules, containment allowlists, detection suppression
Spotlight Vulnerabilities and Exposure Management	Vulnerabilities, configuration assessment, external exposure, network scans
Event Search, Threat Hunting and NG-SIEM	Event search, NG-SIEM, ThreatGraph, hunting guides, correlation rules, audit logs
Threat Intelligence and Sandbox	Intelligence, the Falcon sandbox, MalQuery, Recon
Identity Protection	Identity sensors, policy rules, the Identity Protection GraphQL API
Cloud, Container, SaaS and Browser Security	Cloud security posture, containers and Kubernetes, application security, SaaS security, the enterprise browser
Fusion SOAR Workflows, IT Automation and Foundry	Workflows, IT Automation tasks, Foundry functions and collections
Users, Roles, API Clients and Flight Control	Console users and roles, API clients, child CIDs and CID groups

Profile	What runs on its own	What asks a technician
Read Only	Every read	No write is allowed
Helpdesk	Every read, and every change in the Alerts, Incidents and Detections group: alerts and incidents, quarantined file release or delete, on-demand scans and cases	Host changes (containment, host groups) and sensor update changes; no other write is allowed
IT Admin	Every read and write outside the three groups on the right and Safety Controls	Exclusion, IOC, policy and access changes, and the changes in Safety Controls
Full Automation	Every read and write outside Safety Controls	The changes in Safety Controls

See CrowdStrike API for what the agent can read and change.

Getting started

Core

Triggered & Scheduled Agents

Chat Agents

Integrations

Product

Workflows

Customizing Neo

Connecting CrowdStrike to Neo

1. Create the API client

2. Add the client in Neo

3. Turn CrowdStrike on per agent

​1. Create the API client

​2. Add the client in Neo

​3. Turn CrowdStrike on per agent

1. Create the API client

2. Add the client in Neo

3. Turn CrowdStrike on per agent