> ## Documentation Index
> Fetch the complete documentation index at: https://docs.axiomancer.io/llms.txt
> Use this file to discover all available pages before exploring further.

# CrowdStrike Falcon

> Connect CrowdStrike Falcon to Layer to inventory endpoint devices, detections, and prevention policies — and generate endpoint protection evidence for audits.

The CrowdStrike Falcon integration syncs your managed device inventory, open detections, and prevention policy configuration. Use it to maintain a complete device inventory, track endpoint security posture, and generate compliance evidence for [Axiom Codex](/codex/index).

## What you'll need

* CrowdStrike Falcon console access with permission to create API clients.
* Two minutes.

## Set it up

<Steps>
  <Step title="Create an API client in CrowdStrike">
    In the Falcon console, go to **Support and resources → API clients and keys** and click **Create API client**.

    * Name: `Axiom Layer`
    * Scopes: enable **Read** for **Hosts**, **Detections**, and **Prevention Policies**

    Copy the **Client ID** and **Client Secret**. The secret is only shown once.
  </Step>

  <Step title="Paste credentials into Layer">
    In Layer, go to **Integrations**, find CrowdStrike, and click **Connect**. Paste the **Client ID** and **Client Secret**, then click **Connect**.

    <Note>
      If your CrowdStrike tenant uses a non-default regional API endpoint (for example `https://api.us-2.crowdstrike.com`), enter it in the **Base URL** field. Leave it blank for the default US-1 endpoint.
    </Note>
  </Step>

  <Step title="Wait for the first sync">
    The initial sync runs immediately. Fleets under 5,000 devices typically finish in under 10 minutes.
  </Step>
</Steps>

## What gets synced

| Object              | Fields                                                                                            | Refresh cadence |
| ------------------- | ------------------------------------------------------------------------------------------------- | --------------- |
| Devices             | hostname, device ID, platform (Windows/macOS/Linux), OS version, serial number, last seen, status | Daily           |
| Detections          | detection ID, status (new/in-progress/resolved)                                                   | Daily           |
| Prevention policies | policy ID, policy count                                                                           | Daily           |

## Compliance evidence

CrowdStrike data generates evidence records for the following SOC 2 controls:

| Evidence                                      | Controls     |
| --------------------------------------------- | ------------ |
| Device inventory with OS and status breakdown | CC6.1, CC6.7 |
| Open detections count                         | CC7.2, CC7.3 |
| Prevention policy inventory                   | CC6.1, CC6.7 |

See the [SOC 2 evidence catalog](/codex/soc2-evidence-catalog) for full control descriptions.

## Troubleshooting

<AccordionGroup>
  <Accordion title="OAuth token error on first sync">
    Double-check that you copied the Client ID and Client Secret correctly. If the secret was rotated or the API client was disabled, create a new one in the Falcon console.
  </Accordion>

  <Accordion title="Zero devices returned">
    Verify the API client has the **Hosts → Read** scope enabled. Also confirm your CrowdStrike tenant has devices enrolled — a newly created tenant with no sensor deployments will return an empty inventory.
  </Accordion>

  <Accordion title="I use a regional CrowdStrike cloud">
    Enter your regional API base URL when connecting (for example `https://api.eu-1.crowdstrike.com` for EU). If you connected without specifying a base URL, disconnect and reconnect with the correct endpoint.
  </Accordion>
</AccordionGroup>