--- sourceDocument: Store Version History Release Notes sourceDocumentLink: https://www.servicenow.com/docs/r/store-release-notes Release : - store ft:locale : - en-US ft:publication_title : - Store Version History Release Notes ft:clusterId : - rnst bundleId : - rnst --- # CrowdStrike Falcon Insight Integration for Security Operations release notes # CrowdStrike Falcon Insight Integration for Security Operations release notes {#ariaid-title1} Release version: Store Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of CrowdStrike Falcon Insight Integration for Security Operations Release Notes The CrowdStrike Falcon Insight Integration for Security Operations app on the ServiceNow Store enables enhanced endpoint visibility, detection, response, and forensic capabilities within the ServiceNow platform. It facilitates continuous monitoring and response actions such as indicator creation, host isolation, and blocking of malicious hashes, empowering security teams to quickly identify and mitigate threats. Show full answer Show less ## Key Features and Enhancements * **Continuous Endpoint Visibility:** Provides comprehensive endpoint detection and response (EDR) capabilities directly in ServiceNow, helping prevent potential breaches. * **CI Enrichment and Host Isolation:** Enriches configuration items (CIs) with endpoint data and supports host isolation actions to contain threats. * **Blocking Capabilities:** Analysts can block SHA256/MD5 hashes from security incidents to prevent execution of malicious files (introduced in version 1.5.2). * **Improved API and UI Integrations:** Upgrades to CrowdStrike device API and enhancements to the Workspace UI ensure smoother operation and fewer errors. * **Flow Designer Migration:** Workflows have been migrated to Flow Designer flows to leverage modern ServiceNow automation capabilities (version 1.3.0). * **Strict Read-Only Security:** Dictionary-level fields have been upgraded to strict read-only to prevent unauthorized changes across UIs, scripts, and integrations (version 1.4.0). * **New Modules and Actions:** Added modules for approvals, notification configuration, and default settings, as well as new capabilities such as 'Get File' and 'Remote Threat Response (RTR) actions' (version 1.1.3). ## Fixes and Stability Improvements * Normalization of date formats for API compatibility, resolving issues with non-UTC date settings (version 1.5.7). * Resolved access issues for Security Analysts querying tables and corrected validation errors in the Workspace UI. * Fixed multiple bugs impacting functionalities such as sighting searches, file retrieval accuracy, batch ID initialization, and OS detection. * Enhanced logging and error handling for improved troubleshooting and operational visibility. ## Practical Benefits for ServiceNow Customers By integrating CrowdStrike Falcon Insight with ServiceNow Security Operations, customers gain a streamlined, automated approach to endpoint threat detection and response within their existing security workflows. The integration improves the accuracy and efficiency of security incident management by enriching data, enabling direct blocking and isolation actions, and providing enhanced visibility into endpoint activities---all while maintaining security and compliance through strict field controls and robust error handling. Version history for the CrowdStrike Falcon Insight Integration for Security Operations on the ServiceNow Store. Important: For details on system requirements and family compatibility, view the application listing on the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website. ## Version history Version 1.5.7 - October 2026 : Fixed: The "Create Indicators" action in the CrowdStrike Create IOCs subflow that failed with the provided data does not match expected format when the instance's date_format system property was set to a non-UTC format (e.g. DD-MM-YYYY). Date values are now normalized to the API-expected format regardless of the instance's date_format setting. Version 1.5.6 - July 2026 : Fixed: Missing field names in Workspace UI validation errors for the CrowdStrike Create Indicators dialog. Version 1.5.3 - June 2026 : Fixed: Access issues for Security Analyst while querying tables. Version 1.5.2 - March 2026 : New: Added the block request capability - enabling analysts to block SHA256/MD5 hashes from Security incident. Version 1.4.1 - January 2026 : Fixed: Fixed an issue where the Initialise Batch ID action returned no choice values for the Status field in the output. Version 1.4.0 - December 2025 : New: Upgraded all dictionary-level read-only fields to Strict Read-Only to enhance security and prevent unauthorized changes.This update ensures the server consistently enforces read-only behaviour across all UIs, scripts, and integrations. Version 1.3.1 - May 2025 : Fixed: Various bugs have been addressed and resolved as part of this release.{#store-secops-rn-crowdstrike-falcon-insight__latest-store-secops-rn-crowdstrike-falcon-insight} {#store-secops-rn-crowdstrike-falcon-insight__latest-store-secops-rn-crowdstrike-falcon-insight} Version 1.3.0 - November 2024 : Changed: Migrated Workflows to Flow Designer flows. Version 1.2.3 - November 2023 : Fixed: When the customer upgrades to the latest capability framework version, previously only one profile gets copied, but now all the profiles will get copied. Version 1.2.1 - June 2023 : Fixed: Upgrade issue post migration to capability framework. Version 1.1.10 - May 2023 : Changed: Migrated to capability framework. Version 1.1.8 - February 2023 : * Changed: Crowdstrike device API upgrade. * Fixed: * Sighting search is not working and displays a 404 error from the API. * Clean up of worknotes. {#store-secops-rn-crowdstrike-falcon-insight__ul_xjf_4q5_gwb} Version 1.1.7 - November 2022 : * Changed: Utah Mandate: Update snc-app-parent version to 5.0.0.77 * Fixed: * CrowdStrike's Get file retrieves the wrong file from the system. * Improve the logging for CrowdStrike Falcon Insight. {#store-secops-rn-crowdstrike-falcon-insight__ul_twj_hvd_3vb} Version 1.1.6 - June 2022 : * Fixed: * CrowdStrike Falcon Insight Sighting Search is not working in the latest platform versions. * If both Agent Client Collector capabilities and CrowdStrike Falcon Insight capabilities are active, an incorrect window can open when clicking UI action. Version 1.1.3 - October 2021 : * New: * Added new modules: Crowdstrike Approvals, Crowdstrike Notification Configuration, and Crowdstrike Default Setting * New capabilities 'Get File' and 'RTR actions' are available * Added support for Linux endpoints for CI submissions * In the Crowdstrike Additional Actions module: * Admin can create a new record for custom script with all fields editable * Analyst can create a new record with some restricted access * Fixed: * Fixed OS determination while 'Get Logged on Users' is run against a MacOS * Improved performance for CrowdStrike flows Version 1.0.2 - February 2021 : * New: * Falcon Insight delivers continuous, comprehensive endpoint visibility that spans detection, response and forensics to ensure nothing is missed and potential breaches are stopped. * CrowdStrike Falcon Insight Integration for Security Operations provides CI enrichment and host isolation capabilities. {#store-secops-rn-crowdstrike-falcon-insight__ul_dv4_d23_p4b}