CrowdStrike

The CrowdStrike connector brings the AI agents that CrowdStrike can see into Mesh as non-human identities. Agents from the CrowdStrike catalog carry their owner where CrowdStrike has one, so an agent is tied to a person instead of sitting unattributed.

It can also help you find agents that the CrowdStrike catalog may not list yet. You define the searches, and Mesh runs them against your CrowdStrike security data on a schedule.

What it collects

CrowdStrike licenses these capabilities as separate modules. Check which ones your tenant has, and turn on only those.

Module	What Mesh reads	Becomes in Mesh
SaaS Security	The AI agents in CrowdStrike's catalog, with their detail records	AI agents, in your non-human identity inventory
AIDR	The AI agents AIDR reports, the operating system accounts they run as, and the MCP server names it lists	AI agents, in your non-human identity inventory
NG-SIEM	The results of the searches you define	AI agents for process and domain searches. User identities for privileged group and remote desktop searches

AIDR is a separately licensed add-on, so not every CrowdStrike tenant has it.

Searches can find what the catalog doesn't list

NG-SIEM searches can help you find self-hosted tools and recently renamed agents that a catalog may not have classified yet. What a search finds depends on the terms you give it and on the data CrowdStrike holds. You search by process name or by the domains the agents call, or you write your own CrowdStrike query. See Define your own searches.

What you need before you start

You need	Notes
A CrowdStrike API client	An OAuth client ID and secret, created by your CrowdStrike administrator. Give it read access to the data of each module you turn on
Your CrowdStrike cloud region	For example us-1, us-2, eu-1 or us-gov-1. Mesh uses it to reach the right CrowdStrike API
The modules you are licensed for	An unlicensed module is refused by CrowdStrike on every request. Turn on only what you have
Your NG-SIEM repository name	Only if you define searches. For example search-all. Leave it empty if you have no NG-SIEM license
A Mesh administrator account	To add connectors

Use a dedicated API client

Create an API client for Mesh rather than reusing one that another tool depends on. You can then rotate or revoke it without affecting anything else.

Set it up

Step	What you do
Set up CrowdStrike	Add the connector, choose the modules, define any searches, and test the connection

How often it runs

The connector runs every hour by default.