CrowdStrike Falcon Sandbox Integration - Access Denied Error

[RishikeshLoya]

Hello All,

I'm facing an issue while integrating CrowdStrike Falcon Sandbox with ServiceNow Security Operations. When submitting a URL for malware analysis, I receive the following Error: 'access denied, authorization failed' occurred while submitting URL - CN-FG81TQ3 to CrowdStrike Falcon Sandbox Submission. 

Under Sandbox Submission Results, the Submission Status shows Failed.

I have already verified the API credentials (client ID & secret), and they are correct.

Is there anything else I should verify? Has anyone encountered and resolved this issue before?

I have also raised a high ticket with ServiceNow, but there has been no resolution so far.

Any help would be appreciated!

Thanks!

[Shivalika]

Hello @RishikeshLoya 

Did you check in Falcon API Configuration if you have sandbox access for this ? 

Are you using mid server though that's not a requirement for crowdstrike integration but some customers do use it? It tends to create several timeout and connection issues failing in authentication.

Did you update the crowdstrike plugin to latest version ? 

Kindly mark my answer as helpful and accept solution if it helped you in anyway. This will help me be recognized for the efforts and also move this questions from unsolved to solved bucket. 

Regards,

Shivalika 

My LinkedIn - https://www.linkedin.com/in/shivalika-gupta-540346194

My youtube - https://youtube.com/playlist?list=PLsHuNzTdkE5Cn4PyS7HdV0Vg8JsfdgQlA&si=0WynLcOwNeEISQCY.

[RishikeshLoya]

Hello @Shivalika 

No I am not using mid server, also the plugin is updated to the latest version.