# Set up CrowdStrike

Have your API client and cloud region ready before you start — see
[what you need](./index.md#what-you-need-before-you-start).

## Step 1 — Open Connectors

1. Select **Settings > Connectors**.
2. Select **Add connector**.

## Step 2 — Choose CrowdStrike

Under **Guided setup**, choose **CrowdStrike**.

In the classic dashboard, add CrowdStrike from **System configurations >
Connectors**. The same setup form opens.

## Step 3 — Name it and enter your region

1. Give the connector a name. It appears in the connector list.
2. Enter your CrowdStrike cloud region, for example `us-2`.

Mesh uses the region to reach CrowdStrike's API and to sign in, so a wrong
region means Mesh cannot sign in.

## Step 4 — Enter your API client

Enter the **OAuth client ID** and the **OAuth client secret** from the API
client your CrowdStrike administrator created. The secret is hidden as you
type.

## Step 5 — Choose the modules

In **Enabled modules**, choose the CrowdStrike modules to collect from:

- `saas_security` — the AI agent catalog.
- `aidr` — the AI agents AIDR reports. This is a separately licensed add-on.
- `ngsiem` — the searches you define in the next step.

Turn on only the modules your CrowdStrike tenant is licensed for. CrowdStrike
refuses every request for a module you are not licensed for, and the connector
reports it as an authorization failure.

## Step 6 — Define your own searches

This step is optional. Skip it if you have no NG-SIEM license or you only want
the catalogs.

1. Enter your NG-SIEM **repository** name, for example `search-all`.
2. Under **NG-SIEM CQL searches**, select **Add search**.
3. Give the search a label, for example `Shadow AI process search`. The label
   becomes the name of the results in Mesh.
4. Choose a mode:
   - **Guided (event type + terms)** builds the query for you from an event type
     and a list of terms. You need no query language.
   - **Custom (write your own CQL)** runs the CrowdStrike query you write.

In guided mode, choose an event type and enter your terms, separated by commas:

| Event type | What the terms are | What it finds |
| --- | --- | --- |
| **Process execution** | Process file names. A name must match the whole file name, ignoring case | AI agents, by the process that runs them |
| **DNS request** | Domains. A domain also matches its subdomains | AI agents, by the services they call |
| **Added to privileged group** | Windows group IDs, for example `544` for local Administrators, `512` for Domain Admins and `555` for Remote Desktop Users | Users added to a privileged group. These become user identities, not AI agents |
| **RDP logon** | User names. Leave the field empty to match every RDP logon | Users who log on over remote desktop. These become user identities, not AI agents |

For **Process execution** and **DNS request**, select **Use standard list** to
fill the terms with a prepared list of known AI tool process names or domains.
The list is a starting point, not a complete list. You can edit it and add your
own terms, or leave it out.

Add as many searches as you need. Select **Remove** to delete one.

> **note**
Searches do nothing unless `ngsiem` is also selected in **Enabled modules**,
and they need the repository name.

## Step 7 — Test the connection

Select **Test connection**. Mesh signs in to CrowdStrike with your API client.

If the test does not pass, see [If something goes wrong](#if-something-goes-wrong).

## Step 8 — Add the connector

Select **Add & connect**.

Your connector appears in the list and the first collection starts. When it
finishes, check **Sync status** to confirm the connector is collecting.

## Check that it worked

1. Open **Settings > Connectors** and find your connector.
2. Check **Health** and **Sync status**. See
   [Read the Connectors page](../../../admin-guide/connectors-page.md).
3. Select the row to open **Collected data** and check the entity counts.
4. Open your non-human identity inventory and look for the agents. See
   [Govern non-human and agentic identities](../../../use-cases/govern-nonhuman-identities.md).

## If something goes wrong

| What you see | What it means |
| --- | --- |
| The connection test fails | The client ID or secret is wrong, or the region does not match your CrowdStrike tenant. Check all three |
| An authorization failure for one module | Your CrowdStrike tenant is not licensed for that module, or the API client cannot read it. Turn the module off, or ask your CrowdStrike administrator for access |
| A search returns nothing | `ngsiem` is not turned on, the repository name is empty or wrong, or no event matched your terms |

If a problem persists, contact Axiad support with the connector name and the
time of the failed collection.