---
title: "Remove CrowdStrike Falcon from Red Canary"
slug: "clone-process"
updated: 2026-09-09T16:09:29Z
published: 2026-09-09T16:09:29Z
canonical: "docs.redcanary.com/clone-process"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Remove CrowdStrike Falcon from Zscaler MDR

To fully remove a CrowdStrike Falcon integration from Zscaler MDR, you must perform steps in both Zscaler MDR and CrowdStrike.

**CrowdStrike Falcon Identity Protection**

- Delete the integration from Zscaler MDR.
- Delete the corresponding API client in CrowdStrike.

**CrowdStrike Falcon EDR**

- Delete the integration from Zscaler MDR.
- Delete the corresponding API client in CrowdStrike.
- Delete the FDR feed in CrowdStrike.
- Wait for Zscaler MDR to remove the backend data service.

> [!WARNING]
> Important
> 
> Please contact your Customer Success Manager (CSM) to inform them that you would like to remove an integration.

## Prerequisites

Before you remove the [**Crowdstrike Falcon Identity Protection**](/doc/docs/integrate-crowdstrike-falcon-identity-protection-with-red-canary) or CrowdStrike Falcon EDR integrations, please make sure the following requirements are met:

- You have contacted your CSM and informed them that you want to remove your CrowdStrike Falcon integration
- You have the Administrator role in Zscaler MDR
- You have the Falcon Administrator role in the CrowdStrike Falcon console

## 1 Zscaler MDR | Remove the Integration

If you have a CrowdStrike Falcon EDR integration that is associated with an active CrowdStrike Falcon Identity Protection integration, you must remove both integrations using the following steps.

1. In the Zscaler MDR portal, go to the **Integrations** page.

![Integrations menu option highlighted in Red Canary.](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/removecrowdstrike1_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A15Z&se=2026-11-04T16%3A12%3A15Z&sr=c&sp=r&sig=BRUyImIxicKA7NvrdOxF1PgXwklFk6jt2EscIHSBGmE%3D)
2. Search for and select the CrowdStrike integration you want to remove. ![CrowdStrike integration highlighted in integrations list.](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/removecrowdstrike1_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A15Z&se=2026-11-04T16%3A12%3A15Z&sr=c&sp=r&sig=BRUyImIxicKA7NvrdOxF1PgXwklFk6jt2EscIHSBGmE%3D)
3. On the **Zscaler MDR configuration** page, click the ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integration-delete-button.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A15Z&se=2026-11-04T16%3A12%3A15Z&sr=c&sp=r&sig=BRUyImIxicKA7NvrdOxF1PgXwklFk6jt2EscIHSBGmE%3D) action. ![Delete option highlighted on integration page.](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/removecrowdstrike1_03.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A12%3A15Z&se=2026-11-04T16%3A12%3A15Z&sr=c&sp=r&sig=BRUyImIxicKA7NvrdOxF1PgXwklFk6jt2EscIHSBGmE%3D)
4. Click **Save** to remove the integration.

## 2 CrowdStrike Falcon | Revoke API Access

> [!NOTE]
> Note
> 
> Refer to the CrowdStrike documentation ([US-1](https://falcon.crowdstrike.com/documentation/page/a2a7fc0e/crowdstrike-oauth2-based-apis#va186f1a) [US-2](https://falcon.us-2.crowdstrike.com/documentation/page/a2a7fc0e/crowdstrike-oauth2-based-apis#va186f1a), [EU-1](https://falcon.eu-1.crowdstrike.com/documentation/page/a2a7fc0e/crowdstrike-oauth2-based-apis#va186f1a)) for step-by-step instructions on how to remove CrowdStrike Falcon API clients. The **Delete an API client** steps are found in the **Falcon Documentation > CrowdStrike APIs > CrowdStrike APIs - General Info > CrowdStrike OAuth2-Based APIs** topic. To view these instructions you'll need to log in with your CrowdStrike account information for the appropriate region.

1. In your **CrowdStrike Falcon** console, navigate to the **API clients and keys** page.
2. Delete the Zscaler MDR API client.

## 3 CrowdStrike Falcon | Remove FDR Feed

> [!NOTE]
> Note
> 
> Refer to the CrowdStrike documentation ([US-1](https://falcon.crowdstrike.com/documentation/page/fa572b1c/falcon-data-replicator#jc4c604d) [US-2](https://falcon.us-2.crowdstrike.com/documentation/page/fa572b1c/falcon-data-replicator#jc4c604d), [EU-1](https://falcon.eu-1.crowdstrike.com/documentation/page/fa572b1c/falcon-data-replicator#jc4c604d)) for step-by-step instructions on how to remove CrowdStrike FDR feeds. The **Delete a feed** steps are found in the **Falcon Documentation > Tools and Reference > Falcon Data Replicator** topic. To view these instructions you'll need to log in with your CrowdStrike account information for the appropriate region.

If you are removing a CrowdStrike Falcon EDR integration, you must also remove the FDR feed.

1. In your **CrowdStrike Falcon** console, navigate to the **Falcon Data Replicator** page.
2. Delete the Zscaler MDR FDR feed.