Connect Qevlar to CrowdStrike Falcon to investigate Falcon detections with endpoint and identity context. This page lists the API scopes Qevlar requires and how to grant them.
Overview
Qevlar authenticates to CrowdStrike with a Falcon API client (OAuth 2.0 client credentials). The Client ID and Client Secret are exchanged for a bearer token at {base_url}/oauth2/token — no user account or interactive sign-in. Access is governed by the API scopes granted to the API client. The connector is read-only.
| API | Purpose | Auth |
|---|---|---|
| CrowdStrike Falcon API | Read alerts, host, endpoint event, and identity context | OAuth 2.0 bearer token |
The base URL is specific to your Falcon cloud region (for example https://api.crowdstrike.com for US-1, https://api.us-2.crowdstrike.com for US-2, https://api.eu-1.crowdstrike.com for EU-1).
Connection details
Enter these values when configuring the connector in Qevlar:
| Field | Where to find it | Required |
|---|---|---|
| Client ID | Falcon console → API clients and keys | Yes |
| Client Secret | Shown once when the API client is created | Yes |
| Base URL | Your Falcon cloud region API endpoint | Yes |
| Flight Control (MSSP) | Enable when connecting through a parent (MSSP) CID to member CIDs | When using MSSP |
Required permissions
Grant these scopes to the Falcon API client. The core scopes are Read-only. The optional Identity Protection and Next-Gen SIEM scopes also need a Write scope: in CrowdStrike, running an Identity Protection GraphQL query or an NG-SIEM search requires the Write scope to submit the query job (no data is written back), alongside Read scopes to retrieve the results.
Core (required):
| Scope | Why |
|---|---|
| Alerts | Read the Falcon detections that trigger investigations |
| Hosts | Read host details and validate connectivity (used by the health check) |
| Threat Graph | Read endpoint event context — process, file, network, registry, and image-load events |
Optional (only if the module is licensed and used):
| Scope | Set to | Why |
|---|---|---|
| Identity Protection GraphQL | Write | Run Identity Protection GraphQL queries — identity timelines, authentication behavior, login events, and entities. CrowdStrike requires the Write scope to execute queries; no data is written back. |
| Identity Protection Entities | Read | Read the identity entity data returned by those queries. |
| Next-Gen SIEM | Read + Write | Run NG-SIEM searches for related alerts. Write submits the search job (no data is written); Read retrieves the results. |
Setup
- Create an API client. In the Falcon console, go to Support and resources → API clients and keys → Create API client. Give it a descriptive name (for example
qevlar-connector). - Assign scopes. Set Alerts, Hosts, and Threat Graph to Read. For Identity Protection (if used), set Identity Protection GraphQL to Write and Identity Protection Entities and Identity Protection Assessment to Read. For Next-Gen SIEM (if used), set NG-SIEM to Read and Write so Qevlar can run searches.
- Record the credentials. Copy the Client ID and Client Secret — the secret is shown only once.
- Note your base URL. Use the API endpoint for your Falcon cloud region.
- For MSSP / Flight Control. Create the API client in the parent CID, and enable Flight Control in the Qevlar connector so Qevlar can investigate member CIDs.
- Configure the connector. In Qevlar, add the CrowdStrike connector and enter the connection details above.
Verify the connection
After saving, Qevlar runs a health check that queries hosts (Hosts: Read). If it fails, check, in order:
- The Alerts, Hosts, and Threat Graph scopes are granted as Read.
- The Base URL matches your Falcon cloud region.
- The Client ID and Client Secret are correct and the secret has not been regenerated.
- For MSSP, the API client was created in the parent CID and the Flight Control toggle matches your setup.
API reference
| Operation | HTTP | Endpoint | Scope |
|---|---|---|---|
| Token request | POST | {base_url}/oauth2/token | — |
| Query hosts (health check) | GET | QueryDevicesByFilter (Hosts API) | Hosts: Read |
| Read alert details | POST | {base_url}/alerts/entities/alerts/v2 | Alerts: Read |
| Identity Protection query | POST | api_preempt_proxy_post_graphql (GraphQL) | Identity Protection GraphQL: Write; Identity Protection Entities & Assessment: Read |
| Run NG-SIEM search | POST | {base_url}/humio/api/v1/repositories/{repository}/queryjobs | Next-Gen SIEM: Write |
| Get NG-SIEM search results | GET | {base_url}/humio/api/v1/repositories/{repository}/queryjobs/{id} | Next-Gen SIEM: Read |
| Endpoint event context | — | Threat Graph API | Threat Graph: Read |