Activation required. AI access management must be enabled for your tenant before you can use it. To get started, contact the C1 support team for a walkthrough.
How C1 connects to CrowdStrike
C1 hosts the CrowdStrike MCP server, so your users’ AI clients only ever see MCP tools — they never call CrowdStrike directly. When an AI client calls one of these tools, C1 makes the matching request to the CrowdStrike API using the credentials you configure here, then returns the result to the AI client. The credentials you set up below are what C1 uses to call CrowdStrike on your users’ behalf.Before you begin
- AI access management must be enabled for your tenant. See Enable AI access management.
- A CrowdStrike Falcon account with the Falcon Administrator role, or another role that can create API clients.
If you don’t see CrowdStrike in your MCP server catalog, contact the C1 support team to enable it for your tenant.
Create a CrowdStrike Falcon API client
CrowdStrike issues a client ID and client secret to an API client, which C1 exchanges for an access token using the client credentials flow.1
In the Falcon console, go to Support and resources > API clients and keys.
2
Select Add new API client.
3
Give the client a recognizable name such as
C1, then grant Read on the API scopes covering the tools you want. See Choose API scopes for the mapping.4
Select Create.
5
Copy the Client ID and Client Secret. CrowdStrike shows the secret only once.
6
Note your Falcon cloud’s API base URL. Each tenant lives on one regional cloud, and both the token request and every API call go to that region’s gateway.
Choose API scopes
Each tool reads a different Falcon API, and each API has its own scope. Grant Read on the scopes for the tools you want. A tool whose scope is missing returns CrowdStrike’s authorization error rather than an empty result, so an unexpected 403 usually means the scope is absent from the API client.
Falcon Intelligence is three separate scopes, not one — granting Actors doesn’t enable
list_intel_indicators or list_intel_reports. Grant each scope whose tool you want.
Spotlight, Falcon Intelligence, Zero Trust Assessment, Discover, Device Control, and Cloud Security are separately licensed Falcon products. If a scope you expect isn’t in the dialog, your tenant doesn’t license that product. An unlicensed module returns 403 the same way a missing scope does, so when a tool 403s and its scope is already granted, check the license before re-editing scopes.
Leaving Write off the API client is a deliberate way to keep the connection read-only: those four tools then return CrowdStrike’s authorization error, and the rest keep working.
list_ioms and list_iom_details need the CSPM Registration scope. CrowdStrike also offers a Cloud Security API Detections scope, which is the easier one to reach for by name — but it authorizes a different misconfiguration family (/cloud-security-evaluations/) that C1 doesn’t expose, so an API client carrying only that scope returns 403 from both tools. The Alerts scope doesn’t cover them either, despite the endpoints sharing a URL prefix with Falcon’s detections API. If list_ioms returns 403 while your other tools return data, add CSPM Registration to the API client.How CrowdStrike credentials are shared
The API client authenticates every user as one shared Falcon identity, so CrowdStrike sees a single identity for all tool calls. C1 still attributes each call to the individual user in the AI tool usage audit log. For a shared setup, use a dedicated API client so activity is attributable to C1 rather than a person. For how shared and per-user credentials work across MCP servers, see Configure authentication.Register the CrowdStrike MCP server in C1
With your API client ready, register the server and provide your credentials.1
Follow Register an MCP server and select CrowdStrike from the catalog.
2
Enter your Falcon API base URL, such as
https://api.crowdstrike.com.3
When you configure authentication, choose OAuth2 — client credentials and enter the API client’s client ID and client secret.
4
Save your changes. C1 starts a sync that discovers the tools the CrowdStrike server exposes.
Discover and govern tools
After you register the server, C1 runs tool discovery against CrowdStrike. Discovered tools appear on the server’s Tools tab. Each tool starts as either Pending review or automatically Approved, depending on the option chosen when the server was set up or your tenant’s default tool settings in AI > MCPs > Settings. See Require tool approval and Default tool classification. Before anyone can call a CrowdStrike tool, it must be approved, added to a toolset, and bound to an access profile. Continue to Govern tools and toolsets to set this up.Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn’t confirm that authentication is working. You confirm your CrowdStrike credentials when an approved user successfully calls a CrowdStrike tool from their AI client.
Manage your CrowdStrike credentials
- Rotate the client secret by resetting it on the API client in the Falcon console, then update the secret on the server’s authentication settings in C1.
- Adjust access by editing the API scopes granted to the API client in CrowdStrike. See Choose API scopes.