Skip to main content
This article covers both CrowdStrike connectors. The standard connector is read-only. The CrowdStrike (Multi-Auth) connector uses the same Falcon API client credentials and adds provisioning.
The CrowdStrike (Multi-Auth) connector is in Early Access. Contact your Lumos team to have it enabled for your domain.

​
After this article

You’ll be able to connect CrowdStrike to Lumos for visibility and Access Reviews, and, with the CrowdStrike (Multi-Auth) connector, to provision Falcon users and their roles from Lumos.

​
Capabilities

​
Activity Tracking

Status: Supported. Lumos reads the last login for each Falcon user. Last login is the only activity signal available from CrowdStrike.

​
Required plan and roles

  • CrowdStrike access: you’ll need credentials from your CrowdStrike Falcon environment to authorize the connection.
  • For provisioning (Multi-Auth connector): the API client also needs the User Management: Write scope.

​
Read-only access vs provisioning

Is read-only possible? Yes. The standard CrowdStrike connector is read-only: it reads users, the roles they hold, and their last login. The CrowdStrike (Multi-Auth) connector adds provisioning; connect it with read scopes only to keep it read-only. What read-only requires. An API client created in the Falcon console under Support > API Clients and Keys > Add new API client, with the read scopes for User Management and API Integrations enabled. Creating it generates a Client ID and a Client Secret, and the same screen shows your API base URL. Enter all three on the connection card and follow the steps below. What full provisioning requires. The CrowdStrike (Multi-Auth) connector with an API client that has the read scopes above plus the User Management: Write scope. Watch out for. Check three things on the credential. The Client Secret is shown only once when you create the API client, so capture it then. The API base URL belongs in its own field and is not the Client ID, which is a 32-character alphanumeric string rather than a URL or hostname. The base URL must also match the CrowdStrike cloud your tenant runs in. You can find the cloud in the subdomain of your Falcon console address. Use the plain api.crowdstrike.com address when there is no region subdomain. On the standard connector, granting scopes beyond the two read scopes above does not add any capability in Lumos; provisioning requires the CrowdStrike (Multi-Auth) connector with the User Management: Write scope.

​
Instructions

Phase 1: Connect in Lumos
  1. Find the CrowdStrike card in your Lumos integrations.
  2. Enter the credentials shown on the connection card.
  3. Click Connect.

​
Troubleshooting

Connection fails. Confirm the credentials you entered are valid in your CrowdStrike Falcon environment and haven’t been revoked, then reconnect. Connection fails with a message naming a different API base URL. Your Falcon tenant lives in another CrowdStrike cloud. Enter the base URL from the message in the API base URL field and connect again. On the CrowdStrike (Multi-Auth) connector this check runs when you click Connect, so the mismatch is caught before the connection is saved.