--- sourceDocument: Xanadu IT Asset Management sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/it-asset-management Release : - xanadu ft:locale : - en-US ft:publication_title : - Xanadu IT Asset Management ft:clusterId : - itam bundleId : - itam workflow : - Technology --- # Integrating with CrowdStrike # Integrating with CrowdStrike {#ariaid-title1} * Release version: Xanadu * * Updated January 21, 2025 * * ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 6 minutes to read Integrating your Software Asset Management application with the CrowdStrike enables you to view CrowdStrike active host sensors information and check license compliance. Note: CrowdStrike currently doesn't support the APIs for integration in regulated environments, including US-GOV-1 (GovCloud) or US-GOV-2 CrowdStrike clouds. Important: Minimize security risks and protect information by granting access only to the necessary user or API permissions.{#integrate-with-crowdstrike__table_box__entry__3} | Process | Required user role in the CrowdStrike application | Authentication scopes | |-|-|-| | Download consumption | Falcon administrator | Sensor usage scope with read permissions | [Table 1. Minimal user permissions] {#integrate-with-crowdstrike__box-title} This process is applicable for Xanadu Patch 6 and Software Asset Management - SaaS License Management (sn_sam_saas_int) 14.0.7 version onwards. If you are on any version for Xanadu below Patch 6, refer [KB1801232](https://support.servicenow.com/kb?id=kb_article_view&sys_kb_id=ef634dac83935610cdbbc430feaad3d9). ## Register a CrowdStrike OAuth application {#ariaid-title2} Register the CrowdStrike OAuth application to access the CrowdStrike API and to receive a Client ID and Client secret. ### Before you begin The CrowdStrike Integration Hub spoke must be active. For more information, see [CrowdStrike spoke](https://www.servicenow.com/docs/access?context=crowdstrike-spoke&version=xanadu&pubname=xanadu-integrate-applications&ft:locale=en-US). CrowdStrike Role required: Falcon administrator Important: * To use the Sensor Usage APIs, your API client must be assigned the Sensor usage scope with Read permissions. * Contact your account team to enable the following feature flags: * Hourly usage data feature flag: This flag must be enabled for your Customer Identification (CID) to view hourly usage data. * Aggregated usage data feature flag: This flag must be enabled to get aggregated usage data in multi-CID (non-Flight Control) accounts. {#register-auth-crowdstrike__ul_amb_df3_ydc} {#register-auth-crowdstrike__ul_h5g_y23_ydc}This prerequisite is required for Xanadu Patch 6 onwards. ### Procedure 1. Log in to [Falcon](https://falcon.crowdstrike.com/login/) using your admin credentials. 2. Navigate to Support and resourcesAPI Clients and Keys. 3. Select Create API Client. 4. Provide the client name and description. 5. Select the Read check box for the Sensor usage scope. 6. Select Create. The API client created screen is displayed. 7. Copy the Client ID and Secret for later use. 8. Select Done. {#register-auth-crowdstrike__steps_xmt_zfk_jrb} ## Create a CrowdStrike integration profile {#ariaid-title3} Create a CrowdStrike integration profile to track software subscriptions and optimize licensing for your CrowdStrike applications. ### Before you begin The Software Asset Management - SaaS License Management plugin (sn_sam_saas_int) must be installed from the [ServiceNow Store](https://store.servicenow.com/). ServiceNow Role required: admin or sam_integrator ### About this task If you're using Software Asset Workspace, the option to create the CrowdStrike integration profile in Core UI is inactive. Note: When upgrading to Yokohama patch 1 with Software Asset Management - SaaS License Management (sn_sam_saas_int) 15.0.8 and Software Asset Management (sn_itam_samp) 2.1.0 store applications installed, you must delete the entitlements for the existing CrowdStrike integration profiles. Then, create entitlements for various CrowdStrike products, such as Falcon Endpoint Protection and Falcon Discover, based on their license metrics. These metrics include Reserved Hourly Average Sensor and Sensor Subscription, which are found under the CrowdStrike license metric group. * If any existing CrowdStrike profiles are in the Draft state, create new integration profiles and delete the existing ones. * If any existing CrowdStrike profiles are in the Published state, their state changes to Draft. {#create-crowdstrike-integration__ul_ocb_53d_zdc} If you are on any version for Yokohama below patch 1, refer [KB1801232](https://support.servicenow.com/kb?id=kb_article_view&sys_kb_id=ef634dac83935610cdbbc430feaad3d9). ### Procedure 1. Navigate to the integration profile. | Interface | Action | | Core UI | 1. Navigate to AllSoftware AssetSaaS LicenseDirect Integration Profiles. 2. Select New. 3. Select CrowdStrike Integration Profile. {#create-crowdstrike-integration__ol_ijd_bjk_qtb} | | Software Asset Workspace | 1. Navigate to License operationsUser SubscriptionsDirect integration profiles. 2. Select New. 3. Select CrowdStrike from the drop-down list. 4. Select Continue. {#create-crowdstrike-integration__ol_wjd_bjk_qtb} | |-|-| {#create-crowdstrike-integration__choicetable_o3p_z3k_qtb} 2. On the form, fill in the fields. {#create-crowdstrike-integration__table_tzy_rt5_pqb__entry__2} | Field | Value | |-|-| | Display name | Name of the integration profile. For example, CrowdStrike integration. | | Status | Status of the integration profile. * If you have not published the integration profile, this field is automatically set to  Draft. * If you have already published the integration profile, this field is automatically set to  Published. {#create-crowdstrike-integration__ul_b41_23b_2rb} | | Profile type | Type of integration profile. This field is automatically set to CrowdStrike Subscription. | [Table 2. Integration profile form] {#create-crowdstrike-integration__table_tzy_rt5_pqb} 3. On the Download Consumptions tab, verify that the Subflow field is set to CrowdStrike Download Weekly and Hourly Sensor Usage. For more information about the required roles and scopes, see [Minimal user permissions table](https://www.servicenow.com/docs/A6~Di63v4nxALZNKPW7DfA#integrate-with-crowdstrike "Integrating your Software Asset Management application with the CrowdStrike enables you to view CrowdStrike active host sensors information and check license compliance."). 4. Select Save. A draft integration profile is created. The Connection \& Credential field appears and is automatically set to sn_crowdstrk_spoke.CrowdStrike. 5. Open the connection \& credential aliases record by selecting the preview icon (![Preview icon.]()) next to the Connection \& Credential field and then selecting Open Record in the record preview. 6. On the Connection \& Credential Aliases form, select the Create New Connection \& Credential related link. 7. In the Create Connection and Credential dialog box, fill in the fields. {#create-crowdstrike-integration__table_xg1_fmt_hrb__entry__2} | Field | Value | |-|-| | Connection Information || | Connection Name | Name of the CrowdStrike connection. This field populates automatically. | | Connection URL | URL for the connection. This field is automatically set to https://api.crowdstrike.com. Each CrowdStrike cloud has a different base URL. Use the base URL that corresponds to the cloud where your integration is hosted. * US-1: https://api.crowdstrike.com * US-2: https://api.us-2.crowdstrike.com * EU-1: https://api.eu-1.crowdstrike.com {#create-crowdstrike-integration__ul_f3x_vfy_rcc} | | Credential Information || | OAuth Client ID | Client ID that you generated while configuring the CrowdStrike API settings. | | OAuth Client Secret | Client Secret that you generated while configuring the CrowdStrike API settings. | | OAuth Redirect URL | https://\/oauth_redirect.do, where the instance name is the name of your ServiceNow instance. | [Table 3. Create Connection and Credential dialog box] {#create-crowdstrike-integration__table_xg1_fmt_hrb} 8. Select Create and Get OAuth Token. Note: For the role required to perform this step, refer to the [Minimal user permissions](https://www.servicenow.com/docs/A6~Di63v4nxALZNKPW7DfA#integrate-with-crowdstrike "Integrating your Software Asset Management application with the CrowdStrike enables you to view CrowdStrike active host sensors information and check license compliance.") table. The OAuth token is generated successfully. 9. On the Integration Profile form, proceed with the Workload product mapping by selecting the CrowdStrike Product Workload Mappings tab. Workload mapping is essential for accurately associating specific products with the types of workloads they manage (for example, servers, desktops, containers). This is because CrowdStrike provides data on workloads and not direct product-to-machine connections. With workload mapping, you can correctly count license usage and ensure compliance. The system adds up the relevant workloads for each product based on this mapping, preventing over- or under-counting. This new approach replaces previous methods and aligns with how CrowdStrike now tracks usage, making it easier to manage compliance. 1. On the CrowdStrike Product Workload Mappings page, select New. Note: The software entitlements and software models must be created before proceeding to the next step. * For more information on creating software entitlements in the Software Asset Management classic application, see [Create entitlements in Software Asset Management classic](https://www.servicenow.com/docs/MAohEZPg4SjZLPTVioRdog "Create entitlements in the Software Asset Management application classic to record your license details and allocate purchased software rights to users or devices."). * For more information on creating software entitlements in the Software Asset Workspace, see [Create entitlements in workspace](https://www.servicenow.com/docs/Jh~FO6x8BChwOmSEDyY0kA "Create entitlements in the Software Asset Workspace to enter your license details and allocate purchased software rights to users or devices."). * For more information on creating software entitlements using the Software Asset Management Playbook, see [Create entitlements using the guided walk-through](https://www.servicenow.com/docs/Tiy_LA~jOKwaLS2ioqEHRA "Use the guided walk-through playbook for a step-by-step process of creating entitlements."). {#create-crowdstrike-integration__ul_ykl_zmk_dhc} 2. On the form, fill in the fields. {#create-crowdstrike-integration__table_mdk_b33_ydc__entry__2} | Field | Description | |-|-| | Integration profile | This field is automatically set to the integration profile for which the workload mapping is being created. | | Workload | Endpoints are physical or virtual devices, such as a computer, server, laptop, desktop computer, mobile, cellular, container, pod, or virtual machine image. Endpoints are sometimes referred to as workloads. For example, * containers * public_cloud_with_containers * servers_without_containers * chrome_os {#create-crowdstrike-integration__ul_cf1_2x3_ydc} | | Software model | Profile of the software, which includes publisher, version, and discovery map. | | License metric | License metric for the selected software model. * Reserved Hourly Average Sensor: This metric counts the number of unique active endpoints per clock-hour and averages them over a rolling 28-day period. The count of Reserved Hourly Average Sensor Licenses resets at the start of each clock-hour. * Sensor Subscription: This metric calculates license usage by averaging endpoint counts over four consecutive weeks. Weekly endpoint counts are based on the total number of endpoints consumed in the previous seven days. {#create-crowdstrike-integration__ul_kyt_1j3_ydc} | [Table 4. CrowdStrike Product Workload Mapping form] {#create-crowdstrike-integration__table_mdk_b33_ydc} 3. Select Save. {#create-crowdstrike-integration__substeps_ogq_gh3_ydc} 10. After the workload product mapping is provided, select Publish. Important: You must provide the Workload product mapping before publishing the profile. 11. In the Publish Confirmation dialog box, select OK. {#create-crowdstrike-integration__steps_ttn_sg4_zqb} ### Result This integration pulls or creates usage records in the CrowdStrike Product Usage \[samp_crowdstrike_product_usage\] table and CAL records in the Client Access \[samp_sw_client_access\] table. ### What to do next If you want to set up multiple integration profiles with unique connections, create child aliases to manage different configurations and settings for each integration profile. For more information, see [Create a child alias to set up multiple integration profiles](https://www.servicenow.com/docs/ank2kL8kWf4RhxBVQvFw5g "Create a child alias to set up multiple integration profiles with unique connections and manage different configurations for each integration profile."). Reconciliation also runs on your subscriptions as a scheduled job or on-demand. You can view your reconciliation results in the [License Workbench](https://www.servicenow.com/docs/O_bB4w6fQREuwthkTeWiqg "Review reconciliation results in a simplified workbench view.") (Software Asset Management classic application) or the [License usage view](https://www.servicenow.com/docs/UZ6v3AA1wKSbw~zTb_Xy6w "Use the license usage view as a single plane to understand the license position of all software products, remediate non-compliance, view reconciliation results, view, or add removal candidates, and view Software Asset Management related reports.") (Software Asset Workspace). Use these results to determine your license compliance position and to remediate any non-compliance. * For more information on running reconciliation in the Software Asset Management classic application, see [Run software reconciliation](https://www.servicenow.com/docs/xJni40GL3ctIVn4LYUkVVQ "Reconciliation is run as a scheduled job (default is weekly), but you can also run reconciliation manually to reconcile software products in your environment on demand."). * For more information on running reconciliation in the Software Asset Workspace, see [Run software reconciliation in the workspace](https://www.servicenow.com/docs/F4t9mIl3Z6yakXJGjLthTg "Reconciliation is run as a scheduled job (default is weekly), but you can also run reconciliation manually to reconcile software products in the Software Asset Workspace environment on-demand."). {#create-crowdstrike-integration__ul_qgf_zhr_sqb} *[\>]: and then