This article leads you through the process of creating API credentials to integrate your existing CrowdStrike Falcon Complete environment with Red Canary. Follow the procedure from beginning to end. 

Prerequisites

• CrowdStrike Support has granted you the Falcon Administrator role to your Customer Identification (CID)
• CrowdStrike Support has granted Red Canary access to your CID and enabled the following features:
  • Falcon data replicator
  • Legacy ThreatGraph API

Step 1: Workstation–Create a text file

Red Canary needs your API credentials to finish integrating your environments. In addition, a text file containing the API credentials must be saved and shared with Red Canary’s Support team.

1. On your workstation, create a new text file.
2. Insert the following template into the text file:
   

   CrowdStrike Falcon Complete Integration Credentials Name: Organization Name: Falcon CID:  ThreatGraph Username: ThreatGraph API Key/Password: Falcon Data Replicator SQS URL: Falcon Data Replicator AWS Access Key ID: Falcon Data Replicator AWS Secret Access Key/Secret: Falcon Oauth2 Client ID: Falcon Oauth2 Secret:

3. We recommend leaving the text file open to easily copy and then paste the created API credentials into the text file.

Step 2: CrowdStrike–Create ThreatGraph API credentials

Red Canary requires the use of ThreatGraph API to integrate. Create and then save these credentials. 

1. Log into your CrowdStrike CID at (https://falcon.crowdstrike.com/ or https://falcon.us-2.crowdstrike.com/).
2. Click Open menu. 
3. Click Support and resources.
4. Click API clients and keys.
   Note: If the API clients and keys option is not available, contact CrowdStrike Support as you do not have the required Falcon Administrator role.
   
   
5. From the Legacy Falcon API credentials section, click Create new credentials.
   
6. Copy and then save the new ThreatGraph Username and Password that appears.
   Note: Do not lose the Password as this is the only time you can view it.
   
7. Paste the ThreatGraph Username and Password into the correct field of the text file from Step 1.2.
8. Click DONE.

Step 3: CrowdStrike–Create FDR (Falcon Data Replicator) SQS credentials

Red Canary requires the use of FDR SQS Credentials to integrate properly. Create and then save these credentials.

1. From your CrowdStrike CID homepage, click Open menu. 
2. Click Support and resources.
3. Click API clients and keys.
4. From the FDR AWS S3 Credentials and SQS Queue section, click Create new credentials. Note: If a window opens asking you to CHOOSE FEED, select default.

5. Copy and then save the new Falcon Data Replicator (FDR) URL, Client ID (Access Key ID), and Secret.
   Note: Do not lose the Secret as this is the only time you can view it.
6. Paste the FDR credentials into the correct fields of the text file from Step 1.2.
7. Close the FDR credential window.

Step 4: CrowdStrike–Create OAuth 2.0 Credentials

Create the CrowdStrike Oauth2 Client ID and Secret from the CrowdStrike platform. At the end of this step, your text file should have all the credentials required to integrate properly with Red Canary.

1. From your CrowdStrike CID homepage, click Open menu.
2. Click Support and resources.
3. From the Legacy Falcon API credentials section, click Create new credentials.
4. Click Add a new API client.
   
   
5. For the Client Name Field, enter Red Canary.
6. From the API SCOPES section, select the following permissions:
   1. Detections (Read and Write)
   2. Hosts (Read and Write)
   3. Real time response (admin) (Write)
   4. Real time response (Read and Write)
      
7. Click Add.
8. Copy and then save the Falcon Oauth2 Client ID and Secret that appears. 
9. Paste the Falcon Oauth2 Client ID and Secret into the correct field of the text file from Step 1.2.
10. Close the credential window.

Step 5: Red Canary–Share the credential text file with Red Canary

Red Canary requires the API credentials you created above to complete the integration process. You’ll upload the newly created text file to our Support team. 

Note: Your Customer Success Manager or Sales Engineer should have already invited you to your Red Canary portal via email.

1. Locate the text file containing the needed API credentials.
2. Use the process in this Help article to share the text file with Red Canary Support.
3. Red Canary will confirm they have received the file and finish integrating your environments.
4. Permanently delete the text file.