Install and configure the CrowdStrike Falcon Insight for Security Operations application from the ServiceNow Store on your ServiceNow AI Platform instance.

Before you begin

Role required: admin

Note: You can associate a capability with only one profile. You can't associate a capability with multiple profiles. When you configure CrowdStrike servers, you can't reuse a CrowdStrike capability with multiple profiles that share the CrowdStrike server. Your profiles can have the same CrowdStrike capability, each profile should use its own CrowdStrike server.

Procedure

  1. Download the CrowdStrike Falcon Insight for Security Operations integration from the ServiceNow Store and install it.
  2. Navigate to Security Operations > Integrations > Integration Configurations.
  3. Search for the CrowdStrike Falcon Insight for Security Operations integration tile, and click Configure.
  4. On the form, fill in the fields to complete the configuration:
    Table 1. CrowdStrike Falcon Insight Configuration
    Field Description
    Name

    Name of the integration, for example, demo-1.
    CrowdStrike Falcon Insight API URL Base URL that hosts the CrowdStrike API. Enter the URL with the HTTPS protocol. For example, https://api.crowdstrike.com.
    Client ID

    The client ID that you obtain from the settings section of your account profile in the CrowdStrike Falcon Insight portal.
    Client Secret

    The client secret key that you obtain from the settings section of your account profile in the CrowdStrike Falcon Insight portal.
    CrowdStrike Falcon Insight configuration tile.
  5. Click Submit.

Result

After the integration is successfully validated and submitted, it’s saved on the Security Integrations page as a tile. You can view the CrowdStrike Falcon Insight module in the application navigator.