Set up CrowdStrike

Have your API client and cloud region ready before you start — see what you need.

Step 1 — Open Connectors

1. Select Settings > Connectors.
2. Select Add connector.

Step 2 — Choose CrowdStrike

Under Guided setup, choose CrowdStrike.

In the classic dashboard, add CrowdStrike from System configurations > Connectors. The same setup form opens.

Step 3 — Name it and enter your region

1. Give the connector a name. It appears in the connector list.
2. Enter your CrowdStrike cloud region, for example us-2.

Mesh uses the region to reach CrowdStrike's API and to sign in, so a wrong region means Mesh cannot sign in.

Step 4 — Enter your API client

Enter the OAuth client ID and the OAuth client secret from the API client your CrowdStrike administrator created. The secret is hidden as you type.

Step 5 — Choose the modules

In Enabled modules, choose the CrowdStrike modules to collect from:

• saas_security — the AI agent catalog.
• aidr — the AI agents AIDR reports. This is a separately licensed add-on.
• ngsiem — the searches you define in the next step.

Turn on only the modules your CrowdStrike tenant is licensed for. CrowdStrike refuses every request for a module you are not licensed for, and the connector reports it as an authorization failure.

Step 6 — Define your own searches

This step is optional. Skip it if you have no NG-SIEM license or you only want the catalogs.

1. Enter your NG-SIEM repository name, for example search-all.
2. Under NG-SIEM CQL searches, select Add search.
3. Give the search a label, for example Shadow AI process search. The label becomes the name of the results in Mesh.
4. Choose a mode:
   • Guided (event type + terms) builds the query for you from an event type and a list of terms. You need no query language.
   • Custom (write your own CQL) runs the CrowdStrike query you write.

In guided mode, choose an event type and enter your terms, separated by commas:

Event type	What the terms are	What it finds
Process execution	Process file names. A name must match the whole file name, ignoring case	AI agents, by the process that runs them
DNS request	Domains. A domain also matches its subdomains	AI agents, by the services they call
Added to privileged group	Windows group IDs, for example 544 for local Administrators, 512 for Domain Admins and 555 for Remote Desktop Users	Users added to a privileged group. These become user identities, not AI agents
RDP logon	User names. Leave the field empty to match every RDP logon	Users who log on over remote desktop. These become user identities, not AI agents

For Process execution and DNS request, select Use standard list to fill the terms with a prepared list of known AI tool process names or domains. The list is a starting point, not a complete list. You can edit it and add your own terms, or leave it out.

Add as many searches as you need. Select Remove to delete one.

The ngsiem module must be on

Searches do nothing unless ngsiem is also selected in Enabled modules, and they need the repository name.

Step 7 — Test the connection

Select Test connection. Mesh signs in to CrowdStrike with your API client.

If the test does not pass, see If something goes wrong.

Step 8 — Add the connector

Select Add & connect.

Your connector appears in the list and the first collection starts. When it finishes, check Sync status to confirm the connector is collecting.

Check that it worked

1. Open Settings > Connectors and find your connector.
2. Check Health and Sync status. See Read the Connectors page.
3. Select the row to open Collected data and check the entity counts.
4. Open your non-human identity inventory and look for the agents. See Govern non-human and agentic identities.

If something goes wrong

What you see	What it means
The connection test fails	The client ID or secret is wrong, or the region does not match your CrowdStrike tenant. Check all three
An authorization failure for one module	Your CrowdStrike tenant is not licensed for that module, or the API client cannot read it. Turn the module off, or ask your CrowdStrike administrator for access
A search returns nothing	ngsiem is not turned on, the repository name is empty or wrong, or no event matched your terms

If a problem persists, contact Axiad support with the connector name and the time of the failed collection.