Skip to main content

​
Prerequisites

  • CrowdStrike Falcon with Next-Gen SIEM or Falcon LogScale
  • Access to create API clients in the Falcon Console

​
Step 1: Determine your CrowdStrike product

TOTAL supports two CrowdStrike products. Each requires a different API scope: If you’re unsure, check with your CrowdStrike administrator or contact us — we can help identify your product during setup.

​
Step 2: Create a Falcon API client

  1. Log in to the Falcon Console
  2. Navigate to Support and resources > API Clients and Keys
  3. Click Create API client
  4. Enter a name (e.g. TOTAL Integration)
  5. In the scope list, enable the scopes from Step 1:
    • For Next-Gen SIEM: enable NGSIEM — Read and Write, and App Logs — Read only
    • For Falcon LogScale: enable App Logs — Read and Write
  6. Click Create
Write access on NGSIEM or App Logs is required because executing a search is a write operation in CrowdStrike’s API. TOTAL only uses this to run CQL queries and read results.App Logs Read is needed for NGSIEM customers so TOTAL can discover which repositories and views are available.

​
Step 3: Copy your credentials

After creating the client, the console displays:
Copy the Client Secret immediately. You may not be able to retrieve it later.

​
Step 4: Identify your cloud region

Your Base URL maps to a cloud region: Your region also appears in the URL you use to log in to the Falcon Console (e.g. falcon.us-2.crowdstrike.com is US-2).

​
Step 5: Connect in TOTAL

  1. Open Settings > Connectors in TOTAL
  2. Select CrowdStrike
  3. Choose your product: Next-Gen SIEM or Falcon LogScale
  4. Enter:
    • Falcon API Client ID — from Step 3
    • Falcon API Client Secret — from Step 3
    • Cloud Region — select the region matching your Base URL from Step 4
  5. Click Connect
TOTAL stores your credentials securely. Data discovery begins automatically after connection.