Skip to main content
Who is this for? Workspace Admins or Security Engineers who manage a workspace that uses CrowdStrike Falcon. This guide walks you through creating the CrowdStrike API clients, configuring both modules in ContraForce, and verifying that alerts flow end-to-end.

​
Before You Begin

​
What These Modules Do

CrowdStrike integrates with ContraForce through two separate modules:

Detection Module

Detection ingestion and investigation
  • Pulls Falcon detections from the CrowdStrike Alerts API
  • Surfaces every detection as its own ContraForce incident
  • Round-trips status changes and comments back to Falcon

Response Module

Gamebook response actions
  • Powers Contain and Lift Containment Gamebooks
  • Powers On-Demand Scan Gamebooks
  • Required for any Gamebook that acts on a CrowdStrike-managed device
The two modules use separate CrowdStrike API clients so each client has only the scopes it needs.

​
Prerequisites

1

CrowdStrike Falcon subscription

An active CrowdStrike Falcon subscription with at least one product line in scope (EPP, IDP, or any of the product lines listed in Select Alert Types below).
2

Falcon admin access

Access to API Clients and Keys under Support and resources → Resources and tools in the Falcon console. This typically requires the Falcon Administrator role.
3

ContraForce workspace

A ContraForce workspace created for the tenant, with your account assigned the Workspace Admin role.
4

Your CrowdStrike cloud region

Identify which CrowdStrike cloud your tenant is deployed in. You need this for the Base URL field when configuring each module.

​
CrowdStrike Cloud Base URLs

CrowdStrike has multiple regional clouds. Use the Base URL that matches your tenant:
ContraForce does not currently support CrowdStrike’s US-GOV-1 cloud. Contact support@contraforce.com if you have a GovCloud tenant.
You can confirm which cloud your tenant is in by looking at the URL of your Falcon console. A console URL of https://falcon.us-2.crowdstrike.com means you’re on US-2.

​
Step 1 — Create the Detection API Client in Falcon

The scopes you grant on the Detection API client depend on which Falcon tier the customer is licensed for. Pick the matching column below — the tier you choose here must match what you select on the ContraForce configuration page in Step 3.
  1. Navigate to Support and resources → Resources and tools → API Clients and Keys in the Falcon console
  2. Click Create API client
  3. Set Client name to ContraForce Detection
  4. Set Description to ContraForce alert ingestion and status writeback
  5. Under API scopes, grant the scopes for the customer’s tier, then click Create:
For tenants on Falcon Insight (EDR) only. Cases workbench is not available on this tier.
Copy the Client ID and Client Secret to a secure location — the secret is only shown once.
The Client Secret is shown once at creation time and cannot be retrieved later. If you lose it, you must reset the secret from the same API client in Falcon.

​
Step 2 — Create the Response API Client in Falcon

Repeat the process for a second API client that ContraForce will use for Gamebook response actions.
  1. In the same API Clients and Keys menu, click Create API client
  2. Set Client name to ContraForce Response
  3. Set Description to ContraForce Gamebook response actions
  4. Under API scopes, grant the scopes listed below, then click Create:
Copy the Client ID and Client Secret for the Response client.
Creating two separate API clients — one for Detection, one for Response — follows the principle of least privilege. The Detection client never needs to contain a device or run a scan, and the Response client never needs to read an alert.

​
Step 3 — Configure the CrowdStrike Falcon Module in ContraForce

  1. In the ContraForce portal, navigate to Workspaces → your workspace → Modules
  2. Locate the CrowdStrike Falcon card and click Configure
  3. Pick the Falcon licensing tier that matches the customer’s CrowdStrike SKU. The required-scopes list, the incidents-table preview copy, and the verification panel all update based on this selection:
The tier you pick must match the customer’s actual Falcon SKU. The required scopes and which advanced features (Process Tree ancestor walk, Events Timeline) unlock depend on the tier — see CrowdStrike Falcon Integration → Tier Selection for the full breakdown.
  1. Fill in the following fields:
  1. Click Test Connection to verify the credentials reach CrowdStrike and have the scopes the selected tier requires
  2. Review the Verification panel that appears below the form:
    • ✓ on a row means the API client has that scope and the tenant exposes the corresponding capability
    • ✗ on a row means the scope or capability is missing for the tier you picked — fix it in the Falcon console before saving
    • ℹ︎ on a row means the API client has more capability than the tier you picked uses (e.g. NG-SIEM is reachable but you picked Falcon Insight XDR) — pick a higher tier to unlock the advanced features
  3. Click Save
If Test Connection fails with a scope-missing error, return to the Falcon console and verify the scopes listed in Step 1 for the tier you picked.

​
What You’ll See After Saving

The configuration page surfaces a “What you’ll see in the incidents table” preview directly under the tier dropdown, so you can confirm the choice before saving. After Save, the incidents table reflects that preview the next time the poller runs (typically within a few minutes).

​
Tune Which Products Are Ingested (Optional)

After the credentials are saved, an Alert Types card appears as a sibling to the Configuration Information card. Use it to narrow which CrowdStrike products ContraForce ingests into the analyst queue — useful when you’re contracted to triage only a subset of the products the customer’s Falcon tenant emits. The card is tier-aware by default to cut UI noise: Click Show all products above the checkbox list (visible on EDR / XDR tiers) to reveal the full catalog when the customer has non-standard add-ons (e.g. EDR with the Mobile add-on). The toggle auto-defaults to “show all” when the persisted selection already includes products outside the tier shortlist.
Saving the Alert Types card is independent of Test Connection. Changing the product selection does not require re-validating credentials or re-saving the Detection module — the card has its own Save button.
Leaving every product checked, or unchecking every product, both fall through to “ingest all products.” This preserves backwards-compatibility for workspaces created before the per-product filter shipped, and acts as a friendly fallback if you accidentally clear every box.

​
Choose a Vendor-Side Service Account (Optional)

By default, when one of your analysts takes a CrowdStrike-sourced incident in ContraForce, the assignment is recorded in the ContraForce audit log only and the underlying Falcon alert stays unassigned. This is the right default for tenants where every analyst already has a Falcon login, but in MSSP topologies most ContraForce analysts have no matching principal in the customer’s Falcon tenant. The Assignment Writeback card lets you bind one CrowdStrike user (typically a named service account in the customer’s Falcon tenant, e.g. Stratascale ContraForce) so that ContraForce mirrors every analyst assignment onto the underlying Falcon alert as that user. The end customer sees someone is actively engaged in their own Falcon console, without you having to provision a per-analyst account in every customer’s tenant. To bind a service account:
1

Click Change

On the Assignment Writeback card, click Change. ContraForce queries the customer’s Falcon user-management API (this requires the User Management: Read scope on the Detection client, already part of every tier in Step 1).
2

Search and pick

Type a name or email into the search box; the picker filters the live Falcon user list as you type. Pick the user that should appear as the assignee on the customer’s Falcon console.
3

Save

Click Save Service Account. Future analyst assignments in ContraForce immediately mirror onto the underlying Falcon alert as the chosen user.
To stop writing back, click Remove on the bound state, then Save Service Account. The card returns to None and the audit-only behavior resumes.
The ContraForce audit log is always the source of truth for who actually picked up an incident, regardless of what shows on the Falcon side. The writeback only controls visibility in the customer’s Falcon console.
The writeback only affects detections (alerts that contain a colon-shaped composite ID). Legacy case-shaped IDs continue to behave as audit-only. If the Falcon PATCH fails (network blip, Falcon-side outage, the bound user was deleted), ContraForce records the failure in the trace logs and continues with the audit-only assignment so your queue stays responsive.

​
Step 4 — Configure the CrowdStrike Falcon Response Module

  1. On the same Modules page, locate the CrowdStrike Falcon Response card and click Configure
  2. Fill in the following fields:
  1. Click Test Connection to verify the credentials reach CrowdStrike and have the required scopes
  2. Click Save
A successful test means Gamebook response actions are ready for CrowdStrike-managed devices.

​
Step 5 — Verify End-to-End

1

Wait for the first poll cycle

The Detection module polls CrowdStrike on a short interval. New alerts appear in ContraForce within a few minutes of being generated in Falcon.
2

Check the Command Dashboard

Navigate to the Command Dashboard. CrowdStrike incidents should appear alongside incidents from other sources.
3

Open an incident

Click into a CrowdStrike incident and verify that the Entities and Timeline tabs are populated with alert data.
4

Try a Gamebook (optional)

If the Response module is configured, open a CrowdStrike incident where the affected entity is a device and confirm that Contain, Lift Containment, and On-Demand Scan Gamebook actions are available.

​
What Each Module Unlocks

You can configure the Detection module without the Response module if you don’t need Gamebook response actions for CrowdStrike devices. Configuring only the Response module without Detection is not a supported configuration — you’d have no incidents for the Gamebooks to run on.

​
Troubleshooting

​
Rotating an API Secret

CrowdStrike secrets do not expire automatically, but some organizations rotate them on a schedule.
  1. In Falcon, open the affected API client and click Reset secret
  2. Copy the new secret
  3. In ContraForce, reopen the affected module (Detection or Response)
  4. Paste the new secret into Client Secret and click Save
  5. Click Test Connection to verify

CrowdStrike Falcon Integration

What the integration does, what each tier unlocks, and how Falcon’s retention shapes the data shown in the platform

What are Gamebooks?

Learn how Gamebook response actions work

Incident Management

Triage and resolve incidents in ContraForce

Entity Insights

Explore investigation context for an incident’s entities

Roles and Permissions

Detailed role reference for ContraForce users
Questions about connecting CrowdStrike Falcon to ContraForce? Contact us at support@contraforce.com.