> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting CrowdStrike to Neo

> Create a CrowdStrike Falcon API client and save it in Neo

You connect CrowdStrike once at the MSP level. With Falcon Flight Control, one API client in your parent CID covers every child CID under it.

## 1. Create the API client

Only a Falcon Administrator can create an API client.

**1. Open API clients and keys**

Sign in to the Falcon console and open **Support and resources > API clients and keys**. With Flight Control, do this in your **parent** CID.

**2. Add the client**

Click **Create API client**, name it Neo, and choose the scopes. For the maintenance and audit jobs give **Read** on **Hosts**, **Host groups** and **Sensor update policies**, and **Write** on **Host groups** and **Sensor update policies** if Neo should move a computer onto a current sensor. For alert work add **Alerts** (Read and Write), and **Hosts: Write** to contain hosts; for Real Time Response add the **Real time response** scopes. With Flight Control, add **Flight Control: Read** so Neo can map your child CIDs. Give Neo only the scopes you want it to use: a call outside them is refused by Falcon.

**3. Copy the ID and secret**

Copy the **Client ID** and the **Secret**. Falcon shows the secret only once.

> [!WARNING]
>
> Do not delete the API client or reset its secret after you connect it. Neo loses access until you save the new secret here.

## 2. Add the client in Neo

**1. Open Integrations**

In the Neo Dashboard, open **Integrations** and find the CrowdStrike card, under Security.

**2. Pick your Falcon cloud**

Choose the cloud your console runs on. The console's address shows it: `falcon.crowdstrike.com` is US-1, `falcon.us-2.crowdstrike.com` is US-2, `falcon.eu-1.crowdstrike.com` is EU-1.

**3. Pick the connection**

**One CID** if all your customers' computers are in one Falcon CID. **Flight Control** if each customer has its own child CID under your parent CID: Neo checks the API client can read your child CIDs before it saves, and maps each one to its company.

**4. Save the client**

Paste the Client ID and the Secret and click **Save**. Neo gets a token from Falcon before saving, so a wrong secret is rejected straight away, and a client from another cloud is rejected with the cloud it belongs to.

## 3. Turn CrowdStrike on per agent

Open the agent, go to the Integrations section, and pick an access profile for the CrowdStrike block, or set each area yourself. Every area offers Disabled, Read Only and Read / Write.

| Area | Covers |
| - | - |
| **Hosts and Host Groups** | Hosts, host groups, asset inventory, containment |
| **Sensor Versions, Installers and Update Policies** | Sensor builds and installers, sensor update policies, installation tokens |
| **Alerts, Incidents and Detections** | Alerts, incidents, quarantine, on-demand scans, cases, Falcon Complete |
| **Real Time Response** | RTR sessions and commands on hosts |
| **Prevention, Device Control, Firewall and Other Policies** | Prevention, device control, firewall, response, content update, data protection and FileVantage policies |
| **Exclusions, IOCs and Custom IOA Rules** | Exclusions, IOCs, custom IOA rules, containment allowlists, detection suppression |
| **Spotlight Vulnerabilities and Exposure Management** | Vulnerabilities, configuration assessment, external exposure, network scans |
| **Event Search, Threat Hunting and NG-SIEM** | Event search, NG-SIEM, ThreatGraph, hunting guides, correlation rules, audit logs |
| **Threat Intelligence and Sandbox** | Intelligence, the Falcon sandbox, MalQuery, Recon |
| **Identity Protection** | Identity sensors, policy rules, the Identity Protection GraphQL API |
| **Cloud, Container, SaaS and Browser Security** | Cloud security posture, containers and Kubernetes, application security, SaaS security, the enterprise browser |
| **Fusion SOAR Workflows, IT Automation and Foundry** | Workflows, IT Automation tasks, Foundry functions and collections |
| **Users, Roles, API Clients and Flight Control** | Console users and roles, API clients, child CIDs and CID groups |

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Every read, and every change in the Alerts, Incidents and Detections group: alerts and incidents, quarantined file release or delete, on-demand scans and cases | Host changes (containment, host groups) and sensor update changes; no other write is allowed |
| **IT Admin** | Every read and write outside the three groups on the right and [Safety Controls](https://docs.neoagent.io/agents/tools/security/crowdstrike-api.md#safety-controls) | Exclusion, IOC, policy and access changes, and the changes in [Safety Controls](https://docs.neoagent.io/agents/tools/security/crowdstrike-api.md#safety-controls) |
| **Full Automation** | Every read and write outside [Safety Controls](https://docs.neoagent.io/agents/tools/security/crowdstrike-api.md#safety-controls) | The changes in [Safety Controls](https://docs.neoagent.io/agents/tools/security/crowdstrike-api.md#safety-controls) |

See [CrowdStrike API](https://docs.neoagent.io/agents/tools/security/crowdstrike-api.md) for what the agent can read and change.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.