Overview

To view CrowdStrike Falcon logs through the Logsign Unified SecOps Platform product, you will need to perform some configurations.

First, enter the link you have for CrowdStrike Falcon. You are expected to be an authorized user who can access the management panel and take actions.

In addition to Detections, Alerts and Vulnerabilities, Logsign also collects CrowdStrike Falcon Case Management records (case lifecycle: new, in progress, closed).

Prerequisites

• Logsign Unified SecOps Platform 6.4.24+ versions support this integration.

Configure On CrowdStrike Falcon

When you click on the icon resembling three lines in the top left corner of the page, you will see an area similar to the one in the image.

You need to click on ‘Support and resources’ at the bottom of this area, then select the ‘API Clients and keys’ tab in the window that opens on the side.

On this screen, there is a ‘Create API client’ option in the top right corner. Click on it to create an API.

While creating the API connection, we need to give it a name and then define the ‘Scope.’

In this section, it will be sufficient to only select the options with Read permission. You will need to select the scopes listed below:

• Alerts

• App Logs

• Apps

• Case Management

• Configuration Assessment

• Detections

• Device control policies

• Hosts

• Assets

• Quarantined Files

• Vulnerabilities

• User management

Note: the ‘Incidents’ scope is not required. CrowdStrike retired the Incidents API on 2026-03-09; Logsign collects case lifecycle data through Case Management instead. If the Incidents scope is already granted on your API client, you do not need to remove it, it is simply unused.

Once created, you will see a screen like this. You need to save this information. After saving it, you will need to log into Logsign Unified SecOps Platform and add the source based on the saved information.

Log into Logsign Unified SecOps Platform and then click on the Settings option in the top menu. In the window that opens, click on ‘Data Collection’ on the left side to view the sources you have added to Logsign Unified SecOps Platform. Click on the ’ + Device ’ option on the right side to begin the process of adding a source.

First, under Devices, select API, and then choose CrowdStrike Falcon in the Provider section. Fill in the fields based on the information we have obtained.

For the Region section, you can refer to the values provided below:

• US-1 | United States | api.crowdstrike.com

• US-2 | United States-2 | api.us-2.crowdstrike.com

• EU-1 | Europe | api.eu-1.crowdstrike.com

• EU-2 | Europe-2 | api.eu-2.crowdstrike.com

• US-GOV-1 | US GovCloud | api.lagov.crowdstrike.com

• US-GOV-2 | US GovCloud | api.usgov.crowdstrike.com

Note: the US-GOV-1 / US-GOV-2 host values above are what the current Logsign dropdown sends and have not been independently verified against CrowdStrike's official GovCloud documentation. If your CrowdStrike tenant is on GovCloud and the connection fails, contact Logsign support.

After adding the source, you will start seeing the logs in the ‘Search’ section after a while.

Response Actions

/devices/entities/devices-actions/v2?action_name=contain
/devices/entities/devices-actions/v2?action_name=lift_containment