CrowdStrike Falcon Response Integration via API

Purpose

This guide explains how to configure the CrowdStrike Falcon Response integration in Logsign so that Incidents and Alarms can automatically, or an analyst can manually, contain and release a host on CrowdStrike Falcon. This is not the log collection poller that brings CrowdStrike Falcon detections and events into Logsign; it is a separate Response (action) integration, configured under Settings > Integrations > Responses, that lets a Logsign correlation rule or manual incident action reach out to Falcon and isolate a compromised endpoint from the network in real time.

Logsign authenticates to the Falcon API using OAuth2 client credentials (an API Client ID and Client Secret created in the Falcon console) and calls Falcon's host actions endpoint to contain or lift containment on a specific host, identified by its Falcon host (Agent) ID.

Prerequisites

• A CrowdStrike Falcon tenant with API access enabled. Network Containment is a licensed capability of Falcon Insight/Prevent; confirm your subscription includes host containment before relying on this integration.
• An account with permission to create API clients in the Falcon console (typically a Falcon Administrator).
• The Falcon host ID (also called Agent ID or AID) for the endpoints you want to contain or release. This is a Falcon-internal identifier, not the hostname; if your correlation rules need to map a hostname or IP address to a host ID, that lookup has to happen before the contain/lift action, for example from fields already present on the detection or from a separate Falcon Hosts API lookup. This response integration does not do that lookup itself, it only takes a host ID as input.
• Network connectivity from the Logsign server to your Falcon cloud's API endpoint on outbound HTTPS/443. The configuration screen in Step 2 does not currently expose a proxy setting for this integration, so if your Logsign server can only reach the internet through a proxy, confirm with your Logsign contact whether that is supported for this specific integration before relying on it.
• Know which of CrowdStrike's regional clouds your tenant lives in (US-1, US-2, EU-1, or a GovCloud region). See Step 2 for the base URL each one uses; picking the wrong one will fail authentication even with correct credentials.

Step 1: Create an OAuth2 API Client on CrowdStrike

Do not reuse an API client that already has broad read access for log collection or other integrations. Create a separate client scoped only to what this Response integration actually calls.

1. Log in to the Falcon console with an administrator account.
2. Open the menu in the top left corner, go to Support and resources, then select the API Clients and Keys tab.
3. Click Create API client in the top right corner.
4. Give the client a descriptive name, for example logsign-response-containment, so it is identifiable later if you need to rotate or revoke it.
5. Under Scopes, select only Hosts and enable Write access (Read is included implicitly for this endpoint, but do not additionally grant Read/Write on Detections, Incidents, Alerts, or any other collection; this integration never calls those APIs). This integration only calls the host actions endpoint that contains and lifts containment on a host, which requires the Hosts scope with Write access; it does not need any of the broader read scopes (Detections, Incidents, Alerts, Vulnerabilities, and so on) that the separate CrowdStrike Falcon log-collection poller integration uses.
6. Save the client. Falcon shows the Client ID and Client Secret once, immediately after creation. Copy both and store them securely; the secret cannot be retrieved again later, only regenerated (which invalidates the old one).

The exact scope name and its behavior in the Falcon console have not been independently verified against a live tenant as part of this write-up (unverified); it is based on CrowdStrike's published API reference for the host actions endpoint. If Falcon rejects a contain or lift-containment call with a permissions error after following the steps above, confirm in the API client's scope list that Hosts / Write is actually checked, since Falcon's scope UI has changed across console versions.

Step 2: Configure the Integration in Logsign

In Logsign, go to Settings > Integrations > Responses, search for CrowdStrike Falcon, click Configure, then +Device. Fill in the following fields:

Region field: known dropdown labeling issue

The Region dropdown in the current Logsign build shows six options. For the two GovCloud entries, the descriptive text next to the option does not describe a real CrowdStrike GovCloud location: the option labeled US-GOV-1 currently reads "South America" and the option labeled US-GOV-2 currently reads "Middle East" in the dropdown text. Both of these GovCloud options are for United States federal government tenants; neither corresponds to South America or the Middle East. This is a known display issue in the dropdown text itself, not something you need to work around when picking a value, but it can cause the wrong option to be selected if you go by the descriptive text rather than the US-1/US-2/EU-1/EU-2/US-GOV-1/US-GOV-2 code. Use the table below, matched by that code and by your own knowledge of which CrowdStrike cloud your tenant is provisioned in, rather than the label text.

If your tenant is on US-1, US-2, or EU-1, the base URL Logsign uses is correct and only the GovCloud dropdown labels are cosmetically wrong; picking the right code (US-GOV-1 or US-GOV-2) is enough, and this fix is tracked separately as a product/engineering item. If your tenant is on a GovCloud region, treat the base URL itself as unverified and confirm with CrowdStrike support or your account team before going live, since an incorrect hostname will fail authentication regardless of how correct your Client ID and Client Secret are.

After saving, run Logsign's connection test on this device before relying on it in a correlation rule. The test confirms that Logsign can obtain an OAuth2 access token from the selected region's base URL using the configured Client ID and Client Secret; it does not itself contain or release any host, so it will not tell you whether the API client's scope is sufficient for an actual containment action. Confirm that separately with a manual test on a non-production host.

Available Methods

Once the device is configured, these methods become available as response actions in Incident/Alarm automation rules or as manual actions from the incident view. Both methods call the same Falcon host actions endpoint, differing only in the action_name parameter sent (contain or lift_containment).

contain_with_host_id

Places the specified host into network containment on CrowdStrike Falcon. A contained host can still communicate with the Falcon cloud for sensor management, but its network access is otherwise restricted, which is Falcon's standard way of isolating a compromised endpoint while investigation continues.

lift_containment_with_host_id

Removes network containment from a previously contained host, restoring its normal network access.

Notes and Limits

• This integration only exposes host containment and its release. It does not cover other Falcon response actions such as running Real Time Response (RTR) commands, killing processes, quarantining files, or triggering a network scan; none of that functionality is implemented in the current version of this integration.
• There is no lookup method to resolve a hostname or IP address into a Falcon host ID. Both methods require the host ID as input, so your automation rule or manual workflow needs that value available already, typically from a field on the CrowdStrike detection that triggered the rule.
• Logsign's connection test only validates that an OAuth2 access token can be obtained from the configured region and credentials; it does not verify that the API client's scope actually allows containment actions. A successful test does not guarantee contain_with_host_id or lift_containment_with_host_id will succeed.
• Containment is a disruptive action: a contained host loses normal network connectivity. If this method is wired into an automated correlation rule rather than a manual analyst action, confirm the correlation logic is specific enough to avoid containing hosts on a false positive.
• The Region field determines the API base URL for every call this integration makes. Picking the wrong region for your tenant results in authentication failures even with a correct Client ID and Client Secret, since the OAuth2 token request itself is sent to that base URL.

Troubleshooting