> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# CrowdStrike

> Deploy, inventory, and operate Forge endpoint coverage through CrowdStrike Falcon.

The CrowdStrike Falcon integration uses Real Time Response (RTR) to extend
Forge across your existing endpoint fleet. It imports Falcon hosts, connects
them to Forge devices and people, and supports setup, health, repair,
inventory, and remediation from Forge.

Falcon-backed devices receive agentless Forge coverage through the CrowdStrike
agent already deployed in your environment. Forge verifies the resulting
endpoint state and keeps a complete audit trail for every operation.

## Capabilities

| Capability         | Implementation                                                        |
| ------------------ | --------------------------------------------------------------------- |
| Host discovery     | Falcon host inventory, platform, OS, serial number, status, last seen |
| Device binding     | Falcon AID to Forge device, with an explicit directory-user mapping   |
| Endpoint setup     | Deploy or update Forge-managed endpoint configuration through RTR     |
| Inventory          | Collect endpoint AI applications, MCP servers, skills, and plugins    |
| Policy remediation | Run supported process, application, browser, and extension actions    |
| Lifecycle          | Validate, repair, rotate credentials, and remove Forge-managed state  |
| Audit              | Record request, execution, polling, result, and verification history  |

## Permissions

Create an OAuth2 API client in Falcon with these scopes:

| Falcon API scope           | Access | Forge usage                                          | Requirement |
| -------------------------- | ------ | ---------------------------------------------------- | ----------- |
| Hosts                      | Read   | Host discovery, import, and device details           | Required    |
| Real time response         | Read   | Open and close RTR sessions                          | Required    |
| Real time response (admin) | Write  | Inventory commands, installation, and remediation    | Required    |
| Alerts                     | Read   | Falcon alert collection                              | Required    |
| Event streams              | Read   | Falcon event-stream discovery and collection         | Required    |
| Assets                     | Read   | Host, network, and available user-context enrichment | Required    |

Falcon assigns the admin-command and put-file APIs to **Real time response
(admin): Write**. Forge therefore needs that scope even when the command being
executed is a read-only inventory probe. Forge validates command content and
scope separately before dispatch.

## Connection

| Forge field      | Falcon value                                                     |
| ---------------- | ---------------------------------------------------------------- |
| Falcon cloud URL | API base URL for the tenant cloud, such as `api.crowdstrike.com` |
| Member CID       | Optional child CID for Flight Control or MSSP environments       |
| Client ID        | OAuth2 API client ID                                             |
| Client secret    | OAuth2 API client secret, stored encrypted and write-only        |

## Setup

1. In Falcon, open **Support and resources → API clients and keys**.
2. Create an OAuth2 API client and grant all six required scopes above.
3. Open **Settings → Integrations → CrowdStrike Falcon** in Forge. Enter the
   Falcon cloud URL, client ID and secret, and optional Member CID.
4. Select **Test connection**. Forge validates authentication, host access, RTR
   session access, and RTR admin-command access independently.
5. Import targetable hosts and explicitly bind them to the correct person.
   Conflicts and blocked hosts remain visible instead of creating ambiguous
   Forge device identities.
6. Allow the scheduled inventory to run, or start an inventory or deployment
   operation and monitor progress for each device in Forge.

Do not grant additional Falcon scopes to resolve a failed test without first
reviewing the failed capability. A successful OAuth exchange does not prove
host, RTR, alert, or event-stream access.

## Host model

| Field             | Meaning                                                  |
| ----------------- | -------------------------------------------------------- |
| `aid`             | Stable Falcon agent identifier                           |
| `targetable`      | Whether the host can receive the requested RTR operation |
| `importState`     | `not_imported`, `imported`, `conflict`, or `blocked`     |
| `deviceId`        | Forge device identity after import                       |
| `directoryUserId` | Person explicitly assigned during import                 |

## Operations

Endpoint inventory runs can target one imported device, a bounded device list,
or all imported CrowdStrike devices in the organization. Each intentional run
uses a client-generated idempotency key, and each device reports its own
`queued`, `dispatched`, `running`, `succeeded`, `failed`, `timed_out`,
`partially_succeeded`, or `canceled` state.

Forge keeps provider references, execution evidence, accepted and rejected
inventory counts, and the resulting canonical inventory batch.

Full-fleet runs automatically continue through the complete Falcon host list.
Forge shows progress and per-device results throughout the run, so large
environments can be operated with the same workflow as a single endpoint.

Forge reconciles Falcon host identity with directory and endpoint sources such
as Microsoft Entra ID, Intune, Jamf Pro, and Forge for devices. Matching records
appear as one device in Forge while retaining their source history.