Skip to main content
The CrowdStrike Falcon connector is available in every edition, and is currently in beta.
BOW reads the Falcon REST API with an OAuth2 API client, so a SOC analyst can ask questions like “open alerts by MITRE tactic for the last 7 days” or “which open incidents have the highest score?” and get answers from live Falcon data. The connector is read-only by construction: it never calls containment, Real Time Response, action or update endpoints.

​
What the catalog looks like

Falcon has no SQL surface, so BOW exposes a fixed catalog of tables. Queries are JSON specs, and filters are written in FQL (Falcon Query Language) — the API’s native filter — and passed through as-is.

​
Before you start

1

Create an API client in Falcon

In the Falcon console, open Support and resources → API clients and keys and add a new API client.
2

Grant read-only scopes

Give it Read on: Hosts, Host groups, Alerts, Incidents, Vulnerabilities, Prevention policies and IOC Management. Scopes you leave out simply hide the matching tables.
3

Copy the client ID and secret

The secret is shown only once. Paste both into the connect form and click Test connection.

​
Fields

​
Authentication

API Client (OAuth) — api_client (scopes: system and user) Because the mode is also available at user scope, each user can bring an API client scoped to what they may see — per-user credentials on a database-style connection require an Enterprise license. See Authentication and access.

​
Troubleshooting

The client ID or secret is wrong, or the API client was deleted. Create a new secret in the Falcon console and paste it again.
The API client lacks the read scope for those tables. The test result lists the missing scopes — add them to the API client and re-index the connection.
Set region explicitly instead of auto, or set base_url if you reach Falcon through a proxy.