---
title: "Create API Credentials to Integrate Your Existing CrowdStrike Falcon Environment with Red Canary"
slug: "create-api-credentials-to-integrate-your-existing-crowdstrike-falcon-environment-with-red-canary"
updated: 2026-09-09T16:09:29Z
published: 2026-09-09T16:09:29Z
canonical: "docs.redcanary.com/create-api-credentials-to-integrate-your-existing-crowdstrike-falcon-environment-with-red-canary"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create API Credentials to Integrate Your Existing CrowdStrike Falcon Environment with Zscaler MDR

To integrate CrowdStrike Falcon with Zscaler MDR, your Technical Implementation Manager (TIM) will generate API credentials in your CrowdStrike Falcon environment. If you’re a CrowdStrike Falcon Complete customer, your TIM will instruct you to follow this process to generate and then share the API credentials with Zscaler MDR. These credentials provide Zscaler MDR authorized access to your CrowdStrike data, enabling advanced threat detection and response capabilities.

## Prerequisites

Please make sure the following requirements are met:

- CrowdStrike Support has granted you the Falcon Administrator role to your CrowdStrike Falcon console.
- CrowdStrike Support has enabled the following features:
  - Falcon Data Replicator
  - Threat Graph scope
- If you’re a CrowdStrike Falcon Complete customer, your TIM has confirmed that your CrowdStrike Customer Identification (CID) is now a child CID under Zscaler MDR’s parent CID.

> [!NOTE]
> Note
> 
> To find your CID in Crowdstrike:
> 
> 1. In the top right corner, click the user icon, then your email address.
> 2. The CID details are displayed at the bottom of the page.

## 1 Workstation | Create a Text File

You’ll need to share your API credentials with Zscaler MDR using our secure file sharing process. Prior to creating the FDR feed and OAauth 2.0 API client, it’s recommended that you prepare the text file that you’ll share with Zscaler MDR.

1. Create a new text file on your workstation.
2. Copy and paste the following content into your text file:

```plaintext
CrowdStrike Falcon Integration Credentials
Name:
Organization Name:
Falcon CID (Customer ID):
Falcon Data Replicator Notification URL:
Falcon Data Replicator Client ID:
Falcon Data Replicator Secret:
Falcon Oauth2 Client ID:
Falcon Oauth2 Secret:
```
3. Save the file. Zscaler MDR recommends you leave the file open to easily copy and paste the necessary credentials into it.

## 2 CrowdStrike Falcon | Create an FDR Feed

Create an FDR feed and add the FDR SQS credentials to the text file. The FDR feed sends your CrowdStrike Falcon telemetry to an AWS S3 bucket; Zscaler MDR then connects to the AWS S3 bucket using the credentials you provide. When you create the FDR feed, you’ll create it with the default recommended settings. Changing the default settings could result in Zscaler MDR not having the necessary data to make proper threat analysis, limiting our ability to protect your environment.

You’ll need the following information to fill out the text file:

- Client ID
- Secret
- Notifications URL

> [!NOTE]
> Note
> 
> Refer to the CrowdStrike documentation ([US-1](https://falcon.crowdstrike.com/documentation/page/fa572b1c/falcon-data-replicator#l74bb59e) [US-2](https://falcon.us-2.crowdstrike.com/documentation/page/fa572b1c/falcon-data-replicator#l74bb59e), [EU-1](https://falcon.eu-1.crowdstrike.com/documentation/page/fa572b1c/falcon-data-replicator#l74bb59e)) for step-by-step instructions on how to create an FDR feed and for more information on what FDR feeds do in your system. The **Create an FDR feed** steps are found in the **Falcon Documentation > Tools and Reference > Falcon Data Replicator** topic. To view these instructions you'll need to log in with your CrowdStrike account information for the appropriate region.

1. Navigate to the **FDR feed page** in your **CrowdStrike Falcon** console and click **Create feed**.

![Create feed action highlighted in CrowdStrike Falcon.](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/generateapi2_01.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A50Z&se=2026-11-04T16%3A05%3A50Z&sr=c&sp=r&sig=B%2FVliWvxnk%2BLOAed7%2BspxC9YrSgIP9XFFc%2Bk1ms%2B%2FOs%3D)
2. Type **Zscaler MDR** in the **Feed name** field.
3. Click the **Feed** toggle to **On**.
4. Click the **Create your FDR Feed with default settings**, then click **Next**.
5. Review the FDR feed details as needed, then click **Create Feed**.
6. Copy and then paste the **Client ID**, **Secret,** and **Notifications URL** into the text file you’ll share. Zscaler MDR also recommends saving these values to a secure password manager.
7. Save the text file.
8. Click **Close**.![Close action highlighted in CrowdStrike Falcon.](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/generateapi2_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A50Z&se=2026-11-04T16%3A05%3A50Z&sr=c&sp=r&sig=B%2FVliWvxnk%2BLOAed7%2BspxC9YrSgIP9XFFc%2Bk1ms%2B%2FOs%3D)

## 3 CrowdStrike Falcon | Create an API Client

Create an API client and add the OAuth 2.0 API credentials to the text file. The API client has several required scopes and permissions necessary for Zscaler MDR to ingest CrowdStrike telemetry, and the justification for each is provided in the table below.

You’ll need the following information to fill out the text file:

- Client ID
- Secret

> [!NOTE]
> Note
> 
> Refer to the CrowdStrike documentation ([US-1](https://falcon.crowdstrike.com/documentation/page/a2a7fc0e/crowdstrike-oauth2-based-apis#mf8226da) [US-2](https://falcon.us-2.crowdstrike.com/documentation/page/a2a7fc0e/crowdstrike-oauth2-based-apis#mf8226da), [EU-1](https://falcon.eu-1.crowdstrike.com/documentation/page/a2a7fc0e/crowdstrike-oauth2-based-apis#mf8226da)) for step-by-step instructions on how to create API clients and for more information on what API clients can do in your system. The **Create an API client** steps are found in the **Falcon Documentation > CrowdStrike APIs > CrowdStrike APIs - General Info > CrowdStrike OAuth2-Based APIs** topic. To view these instructions you'll need to log in with your CrowdStrike account information for the appropriate region.

1. Navigate to the **API clients and keys** page in your **CrowdStrike Falcon** console and click **Create API client**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image-1751568924706.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A50Z&se=2026-11-04T16%3A05%3A50Z&sr=c&sp=r&sig=B%2FVliWvxnk%2BLOAed7%2BspxC9YrSgIP9XFFc%2Bk1ms%2B%2FOs%3D)
2. Type **Zscaler MDR** in the **Client name** field, then type an appropriate description in the **Description** field.
3. Enable the following scopes to allow Zscaler MDR to ingest and enrich detection data, perform real-time response and remediation actions, enable investigations and analysis, and support automation and workflow capabilities:

| Scope | Permission | Purpose | Justification |
| --- | --- | --- | --- |
| Alerts | Read and Write | Allows Zscaler MDR to ingest and update detection data. | Zscaler MDR uses this scope to update detection status, add comments, and provide context back into CrowdStrike, and it is critical for SOAR/Automation capabilities that require updating detections as part of automated workflows. |
| Detections | Read and Write | Allows Zscaler MDR to ingest and update detection data. | > [!WARNING] > Deprecation Notice > > CrowdStrike [deprecated the Detects API](https://supportportal.crowdstrike.com/s/article/Tech-Alert-Planned-Decommission-Announcement-of-the-DetectionSummaryEvent-and-detects-API-September-30-2025) on September 30, 2025. Please refer to CrowdStrike’s [Tech Alert](https://supportportal.crowdstrike.com/s/article/Tech-Alert-Planned-Decommission-Announcement-of-the-DetectionSummaryEvent-and-detects-API-September-30-2025) for the rationale behind this decision, as well as CrowdStrike’s documentation ([US-1](https://falcon.crowdstrike.com/documentation/page/d02475a5/converting-from-detects-api-to-alerts-api), [US-2](https://falcon.us-2.crowdstrike.com/documentation/page/d02475a5/converting-from-detects-api-to-alerts-api), [EU-1](https://falcon.eu-1.crowdstrike.com/documentation/page/d02475a5/converting-from-detects-api-to-alerts-api)) for more information about converting to the Alerts API. > > > > All Zscaler MDR customers with existing CrowdStrike integrations have converted to the Alerts API. Zscaler MDR previously used this scope to update detection status, add comments, and provide context back into CrowdStrike, and it was critical for SOAR/Automation capabilities that require updating detections as part of automated workflows. |
| Hosts | Read and Write | Allows Zscaler MDR to view host information and take action against hosts. | Zscaler MDR uses this scope to perform investigations and take actions to protect your environment, such as isolating hosts during an investigation or response scenario. |
| Host Groups | Read | Allows Zscaler MDR to read host group information. | Zscaler MDR uses this scope to understand endpoint groupings and contexts within CrowdStrike, such as mapping and correlating endpoints during analysis and investigation. |
| NGSIEM | Read and Write | Allows Zscaler MDR to query process data. | Zscaler MDR uses this scope to investigate threats within your CrowdStrike environment using the internal [Surveyor on Rails](https://docs.redcanary.com/doc/docs/en/red-canary-release-notes?highlight=surveyor#october-2023) tool. This critical tool allows the Threat Hunting team to hunt for threats more quickly and efficiently. > [!NOTE] > **Note:** Refer to the CrowdStrike documentation ([US-1](https://falcon.crowdstrike.com/documentation/page/bda96fc1/next-gen-siem-search-apis#n4474d0c) [US-2](https://falcon.us-2.crowdstrike.com/documentation/page/bda96fc1/next-gen-siem-search-apis#n4474d0c), [EU-1](https://falcon.eu-1.crowdstrike.com/documentation/page/bda96fc1/next-gen-siem-search-apis#n4474d0c)) for more information regarding Next-Gen SIEM Search APIs. To view these instructions you'll need to log in with your CrowdStrike account information for the appropriate region. |
| Real Time Response (admin) | Write | Allows Zscaler MDR to issue real-time commands on endpoints. | Zscaler MDR uses this scope to provide Active Remediation services, such as executing commands equivalent to the Real Time Responder - Admin role that remove malicious files or run custom scripts. > [!NOTE] > **Note:** This scope is only required if you have purchased [Active Remediation](/doc/docs/ar-getting-started) services through Zscaler MDR. |
| Real Time Response | Read and Write | Allows Zscaler MDR to perform reconnaissance. | Zscaler MDR uses this scope to provide Active Remediation services, such as executing commands equivalent to the Real Time Responder - Read Only Analyst or the Real Time Responder - Active Responder roles. > [!NOTE] > **Note:** This scope is only required if you have purchased [Active Remediation](/doc/docs/ar-getting-started) services through Zscaler MDR. |
| Threatgraph | Read | Allows Zscaler MDR to query CrowdStrike’s ThreatGraph API. | Zscaler MDR uses this scope to retrieve relational telemetry and graph data to be used as context for our investigations. |
4. Click **Create**. ![Create action highlighted in Create API Client pop-up.](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/generateapi3_02.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A50Z&se=2026-11-04T16%3A05%3A50Z&sr=c&sp=r&sig=B%2FVliWvxnk%2BLOAed7%2BspxC9YrSgIP9XFFc%2Bk1ms%2B%2FOs%3D)
5. Copy and then paste the **Client ID** and **Secret** into the text file you will share. Zscaler MDR also recommends saving these values to a secure password manager.
6. Save the text file.
7. Click **Done**. ![Done action highlighted on API client created pop-up.](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/generateapi3_03.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A05%3A50Z&se=2026-11-04T16%3A05%3A50Z&sr=c&sp=r&sig=B%2FVliWvxnk%2BLOAed7%2BspxC9YrSgIP9XFFc%2Bk1ms%2B%2FOs%3D)

## 4 Zscaler MDR | Share the Credentials

Share the API credentials with Zscaler MDR to continue the integration process. Zscaler MDR recommends that you save the secrets to a secure password manager.

> **Note**: Your TIM or Sales Engineer should have already invited you to your Zscaler MDR portal via email.

1. [Share the text file with Zscaler MDR](/doc/docs/share-files-securely-with-red-canary).
2. When Zscaler MDR confirms receipt of the file, permanently delete it.