# CrowdStrike

The CrowdStrike connector brings the AI agents that CrowdStrike can see into
Mesh as non-human identities. Agents from the CrowdStrike catalog carry their
owner where CrowdStrike has one, so an agent is tied to a person instead of
sitting unattributed.

It can also help you find agents that the CrowdStrike catalog may not list yet.
You define the searches, and Mesh runs them against your CrowdStrike security
data on a schedule.

## What it collects

CrowdStrike licenses these capabilities as separate modules. Check which ones
your tenant has, and turn on only those.

| Module | What Mesh reads | Becomes in Mesh |
| --- | --- | --- |
| **SaaS Security** | The AI agents in CrowdStrike's catalog, with their detail records | AI agents, in your non-human identity inventory |
| **AIDR** | The AI agents AIDR reports, the operating system accounts they run as, and the MCP server names it lists | AI agents, in your non-human identity inventory |
| **NG-SIEM** | The results of the searches you define | AI agents for process and domain searches. User identities for privileged group and remote desktop searches |

AIDR is a separately licensed add-on, so not every CrowdStrike tenant has it.

> **note**
NG-SIEM searches can help you find self-hosted tools and recently renamed
agents that a catalog may not have classified yet. What a search finds depends
on the terms you give it and on the data CrowdStrike holds. You search by
process name or by the domains the agents call, or you write your own
CrowdStrike query. See
[Define your own searches](./set-up.md#step-6--define-your-own-searches).

## What you need before you start

| You need | Notes |
| --- | --- |
| A CrowdStrike API client | An OAuth client ID and secret, created by your CrowdStrike administrator. Give it read access to the data of each module you turn on |
| Your CrowdStrike cloud region | For example `us-1`, `us-2`, `eu-1` or `us-gov-1`. Mesh uses it to reach the right CrowdStrike API |
| The modules you are licensed for | An unlicensed module is refused by CrowdStrike on every request. Turn on only what you have |
| Your NG-SIEM repository name | Only if you define searches. For example `search-all`. Leave it empty if you have no NG-SIEM license |
| A Mesh administrator account | To add connectors |

> **tip**
Create an API client for Mesh rather than reusing one that another tool
depends on. You can then rotate or revoke it without affecting anything else.

## Set it up

| Step | What you do |
| --- | --- |
| **[Set up CrowdStrike](./set-up.md)** | Add the connector, choose the modules, define any searches, and test the connection |

## How often it runs

The connector runs every hour by default.