> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/integrations/integrations-crowdstrike.md).
# CrowdStrike Falcon
CrowdStrike Falcon has become very popular for its ability to protect against data breaches and various attacks, from commodity malware to ransomware and sophisticated cyber attacks.
CrowdStrike Falcon stops breaches on endpoints with detection and response (EDR), manages workloads and identities, and performs threat hunting to monitor everyday activities across the network and investigate possible anomalies.
## Use cases
Integrate CrowdStrike Falcon with DoControl to **prevent future malware attacks via automated workflows.** If CrowdStrike Falcom detects malware in your organization’s Google Drive, you can leverage DoControl to [delete malware immediately](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/google-drive-remediation.md#prevent-malware-propagation) before it propagates.
When CrowdStrike Falcon detects a malicious file on the endpoint, DoControl retrieves the event and compares the hash value with Google Drive to delete any malicious files.
## Prerequisites
To integrate Salesforce with CrowdStrike Falcon, make sure you have fulfilled these prerequisites:
* The user performing the DoControl-CrowdStrike integration must have the **CrowdStrike Falcon Administrator** role.
* Before starting to integrate, you need to sign up with DoControl. Follow the onboarding steps in [Create first account](/docontrol-user-guide/getting-started/quick-start/set-up-docontrol-basics.md#create-first-account).
* Define an [API client ](#define-an-api-client)in CrowdStrike Falcon.
## Required permission scopes
You require these permissions for DoControl to operate on CrowdStrike Falcon:
```
Reading CrowdStrike Alerts
```
## Define an API client
Before integrating with DoControl, you need to define an API client in CrowdStrike Falcon.
1. Login to CrowdStrike, and open the [client and keys APIs](https://falcon.us-2.crowdstrike.com/api-clients-and-keys/clients).\
If this is not your region, replace falcon.us-2 with the relevant region.
2. For the relevant client, click the dots at the end of the row, and click **Edit API client**.
3. For the **Alerts** scope, select **Read** permission.\
4. Click **Update client details**.
5. Copy the three field values: **client ID**, **secret**, **base URL.**
6. Click **Done**.
## Integrate CrowdStrike with DoControl
1. From the DoControl side menu, click **Integrations**.
2. Under **CrowdStrike**, click **Connect**.
3. From **CrowdStrike Login URL**, select the subdomain (region), according to the **base URL** you copied in [Define an API client.](#define-an-api-client)
4. In **Client ID**, enter the **client ID** you copied in the previous step.
5. In **Client secret**, enter the **secret** you copied in the previous step and click **Connect**. \
You are returned to the DoControl **Integrations** page, and CrowdStrike is now integrated.
{% hint style="success" %}
DoControl customers using CrowdStrike Falcon can define automated workflows to prevent malware from spreading in Google Drive. To define such a workflow, see [Prevent malware propagation](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/google-drive-remediation.md#prevent-malware-propagation).
{% endhint %}
## Troubleshooting
Q. What happens if my CrowdStrike token expires?
A. If the person who performed the integration leaves your organization, your CrowdStrike token will expire. You need to reconnect to DoControl by performing the [integration procedure](#integrate-crowdstrike-with-docontrol) again.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/integrations/integrations-crowdstrike.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
