# Crowdstrike Falcon

[<mark style="color:blue;">Crowdstrike Falcon</mark>](https://www.crowdstrike.com/falcon-platform/) helps to secure the most critical areas of enterprise risk – endpoints, cloud workloads, identities, and data.

Route detailed alerts from Crowdstrike Falcon to the right users in Squadcast.

### Using Crowdstrike Falcon as an Alert Source

1. Navigate to **Services** -> **Service Overview** -> select or search for your Service. Expand the accordion -> In the Alert Sources section, click **Add**.

![](https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-4fbd74e7ca0b30173c47a1d58ed6a0804a0465aa%2FAlert_Sources.png?alt=media\&token=aaca6610-9d18-4dd4-9cf5-320042f326f1)

2\. Select **Crowdstrike Falcon**. Copy the displayed **Webhook URL** to [configure](#create-a-squadcast-webhook-url-rest-endpoint-in-crowdstrike-falcon) it within **Crowdstrike Falcon**. Finish by clicking **Add Alert Source** -> **Done**.

![](https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-6ac1ac9c35f5479c28f8414af2ef9e928b9cae69%2FCrowdstrike%20Falcon.png?alt=media\&token=173ab53c-2827-420b-b77e-1c33458d727a)

{% hint style="warning" %} <mark style="color:orange;">**Important**</mark>**:**

When an alert source turns <mark style="color:green;">Active</mark>, it’ll show up under Configured Alert Sources. You can either generate a test alert from the integration or wait for a real-time alert to be generated by the Alert Source.\
\
An Alert Source is <mark style="color:green;">active</mark> if there is a recorded incident via that Alert Source for the Service.
{% endhint %}

### Create a Squadcast Webhook URL REST Endpoint in Crowdstrike Falcon

**(1)** Login to your Crowdstrike Falcon dashboard. Head over to **Workflows**

![](https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-1f9bd98016310bb312dd70683e7f5c3e738d0e3f%2Fcrowdstrike_falcon_2.png?alt=media\&token=d618e1d1-82c7-4c09-a580-0bc5e9540a47)

**(2)** Click on **Create Workflow**. Select trigger as **New detection** or **New incident** and then under workflow diagram choose **condition**. Choose Parameter as **Detection status** or **Incident status**, Operator as **is equal to** & Value as **New**. Then click on **+** and add **Action**. Choose **Notifications** as **Action type** and **Call webhook** as **Action**.

![](https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-a0cdff89d8be9b50ece0315c193febd0dd39ce60%2Fcrowdstrike_falcon_3.png?alt=media\&token=c7fc723c-b9d4-4bd4-9e45-3101176579f5)

Add webhook by clicking to **Go to Store**. Click on **Configure** and then add **Squadcast** as **Name**. Paste the previously copied Squadcast Webhook URL in the placeholder for **Webhook URL**. Then click on **Save configuration**.

Choose **Squadcast** as **Webhook name** and add the data you want to send to Squadcast.

![Configuration of Crowdstrike Falcon](https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-d0dbefc8d956a761644df5be3fb12fccb88d0f53%2Fimage.png?alt=media)

{% hint style="info" %}
**Note**:\
Squadcast does not validate HMAC Secret Key, so the user can send any random secret key of their choice.
{% endhint %}

{% hint style="warning" %}
**Important**

* **For New Detection :**

Always add **Detection Id** and **Detection Status** in the data you want to send to Squadcast.

* **For New Incident :**

Always add **Incident Id** and **Incident Status** in the data you want to send to Squadcast.
{% endhint %}

Again add a **condition** after the **Trigger** event. Choose Parameter as **Detection status** or **Incident status**, Operator as **is equal to** & Value as **Closed**. Then click on **+** and add **Action**. Choose **Notifications** as **Action type** and **Call webhook** as **Action**. Choose **Squadcast** as **Webhook name** and add the data you want to send to Squadcast.

![](https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-4008ae07bd364dd6eb99200c56947d60bd0888a4%2Fcrowdstrike_falcon_4.png?alt=media\&token=12144b17-107a-4132-a2c6-885b2c7afb26)

Then click on **Finish**. Give it a name and set the **Workflow Status** as **On**. Then click on **Save workflow**

![](https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-35090ffd226e5356d497926b5346140b79919566%2Fcrowdstrike_falcon_6.png?alt=media\&token=624dae9e-2563-4fb3-8328-5ab7b104d1f1)

That's it, you are good to go! Your Crowdstrike Falcon integration is now complete. Whenever Crowdstrike Falcon fires an alert, an incident will be created in Squadcast for it. Also, when an status has changed to **Closed**, the corresponding incident gets **auto-resolved** in Squadcast.

*Have any questions?* [*Ask the community*](https://community.squadcast.com/view/home)*.*