Remove CrowdStrike Falcon from Red Canary

Before you remove the Crowdstrike Falcon Identity Protection or CrowdStrike Falcon EDR integrations, please make sure the following requirements are met:

• You have contacted your CSM and informed them that you want to remove your CrowdStrike Falcon integration

• You have the Administrator role in Red Canary

• You have the Falcon Administrator role in the CrowdStrike Falcon console

If you have a CrowdStrike Falcon EDR integration that is associated with an active CrowdStrike Falcon Identity Protection integration, you must remove both integrations using the following steps.

1. From your Red Canary homepage, go to the Integrations page.

   

2. Search for and select the CrowdStrike integration you want to remove.
   

3. On the Red Canary configuration page, click the action.
   

4. Click Save to remove the integration.

Note

Refer to the CrowdStrike documentation (US-1 US-2, EU-1) for step-by-step instructions on how to remove CrowdStrike Falcon API clients. The Delete an API client steps are found in the Falcon Documentation > CrowdStrike APIs > CrowdStrike APIs - General Info > CrowdStrike OAuth2-Based APIs topic. To view these instructions you'll need to log in with your CrowdStrike account information for the appropriate region.

1. In your CrowdStrike Falcon console, navigate to the API clients and keys page.

2. Delete Red Canary’s API client.

Note

Refer to the CrowdStrike documentation (US-1 US-2, EU-1) for step-by-step instructions on how to remove CrowdStrike FDR feeds. The Delete a feed steps are found in the Falcon Documentation > Tools and Reference > Falcon Data Replicator topic. To view these instructions you'll need to log in with your CrowdStrike account information for the appropriate region.

If you are removing a CrowdStrike Falcon EDR integration, you must also remove the FDR feed.

1. In your CrowdStrike Falcon console, navigate to the Falcon Data Replicator page.

2. Delete Red Canary’s FDR feed.