Create API credentials to integrate your existing CrowdStrike Falcon Complete environment with Red Canary

Red Canary needs your API credentials to finish integrating your environments. In addition, a text file containing the API credentials must be saved and shared with Red Canary’s Support team.

1. On your workstation, create a new text file.

2. Insert the following template into the text file:

   CrowdStrike Falcon Complete Integration Credentials Name: Organization Name: Falcon CID:  Falcon Data Replicator SQS URL: Falcon Data Replicator AWS Access Key ID: Falcon Data Replicator AWS Secret Access Key/Secret: Falcon Oauth2 Client ID: Falcon Oauth2 Secret:

3. We recommend leaving the text file open to easily copy and then paste the created API credentials into the text file.
   

   

Red Canary requires the use of FDR SQS Credentials to integrate properly. Create and then save these credentials.

1. From your CrowdStrike CID homepage, click Open menu. 

2. Click Support and resources.

3. Click Falcon Data Replicator.

4. From the FDR feeds section, click Create feed.

   

5. Enter the feed name.

6. Toggle the Feed Status to On.

7. Select Create your FDR feed with default settings.

   

8. Copy and then save the new Falcon Data Replicator (FDR) URL, Client ID (Access Key ID), and Secret.

9. Click Next.

10. Click Create Feed.

    Note: Do not lose the Secret as this is the only time you can view it.

11. Paste the FDR credentials into the correct fields of the text file from Step 1.2.

12. Close the FDR credential window.

Create the CrowdStrike Oauth2 Client ID and Secret from the CrowdStrike platform. At the end of this step, your text file should have all the credentials required to integrate properly with Red Canary.

1. From your CrowdStrike CID homepage, click Open menu.

2. Click Support and resources.

3. Click API clients and keys.

4. Ensure the OAuth2 API clients tab is selected, then click Create API client.

   

5. For the Client Name Field, enter Red Canary.

6. From the API SCOPES section, select the following permissions:

   1. Alerts (Read and Write)

   2. Detections (Read and Write)

   3. Hosts (Read and Write)

   4. Host Groups (Read)

   5. Real time response (admin) (Write)

   6. Real time response (Read and Write)

   7. Threatgraph (Read)

7. Click Create.

8. Copy and then save the API Client ID and Secret that appears.

   

9. Paste the Falcon Oauth2 Client ID and Secret into the correct field of the text file from Step 1.2.

10. Close the credential window.

Red Canary requires the API credentials you created above to complete the integration process. You’ll upload the newly created text file to our Support team. 

Note: Your Technical Implementation Manager or Sales Engineer should have already invited you to your Red Canary portal via email.

1. Locate the text file containing the needed API credentials.

2. To share the text file with Red Canary Support, follow the steps in Share Files Securely with Red Canary.

3. Red Canary will confirm they have received the file and finish integrating your environments.

4. Permanently delete the text file.