About CrowdStrike
CrowdStrike is a global cybersecurity leader and pioneer of cloud-native endpoint protection, widely regarded as one of the most trusted names in threat intelligence, endpoint detection and response, and adversary-focused security operations. With its AI-powered platform and elite Falcon Intelligence capabilities, CrowdStrike is a foundational security partner for enterprises defending against nation-state actors and sophisticated cybercriminal groups. Teams looking to integrate with CrowdStrike or build a CrowdStrike integration can use Synqly to access normalized endpoint detection, threat intelligence, and incident data through a standardized security connector.
To learn more about this integration, check out the CrowdStrike technical docs.
About the CrowdStrike Falcon® Insight EDR Integration
CrowdStrike Falcon® Insight EDR is CrowdStrike’s cloud-native endpoint detection and response solution, combining real-time threat prevention, behavioral AI, and automated response across enterprise endpoints. As Synqly’s Sink provider, Falcon Insight EDR enables security platforms to stream security event data and telemetry from Synqly-connected tools into CrowdStrike’s Falcon platform for unified threat analysis. Integrate with CrowdStrike Falcon Insight EDR to route security events from your connected tools into the Falcon ecosystem, enabling correlation with endpoint telemetry and enriched threat investigation.
Integration Use Cases
Create IOCs
Creates a list of iocs that match the stix input for the EDR source.
Create Threat Note
Creates a note for a threat.
Delete IOCs
Deletes a list of iocs that match the input of ids in the query param
Execute Command
Runs a provider-backed command on the endpoint identified by `{uid}` and returns normalized stdout and stderr without exposing provider session details.
Get Endpoint
Gets a single endpoint assets matching the UID from the token-linked EDR source.
Get Threat Notes
Returns a list of notes for a threat.
Quarantine Endpoints
Connect or disconnect one or more endpoints assets to the network, allowing or disallowing connections.
Query Alerts
Returns a list of alerts that match the query from the token-linked EDR source.
Query Applications
Returns a list of applications matching the query from the token-linked EDR source.
Query EDR Events
Returns a list of EDR events that match the query from the token-linked EDR source.
Query Endpoints
Returns a list of endpoint assets matching the query from the token-linked EDR source.
Query IOCs
Returns a list of iocs that match the query from the token-linked EDR source.
Query Posture Score
Returns the posture score of the endpoint assets that match the query from the token-linked EDR source.
Query Threat Events
Returns a list of threats that match the query from the token-linked EDR source.
Retrieve File
Retrieves a file from the endpoint identified by `{uid}` and returns the provider artifact as a binary file response.