# The CrowdStrike Module

With the CrowdStrike Module, you can import CrowdStrike Intelligence Reports and Recon Alerts into your Liberty91 instance. Turning this module on involves two easy steps:

1. [Create an client-ID and client-secret in the CrowdStrike Falcon portal](#step-1-creating-a-client-id-and-client-secret)
2. [Provide the base URL, Client ID and Client Secret in Liberty91](#step-2-provide-base-url-client-id-and-client-secret-in-liberty91s-crowdstrike-module)

You need an active license with CrowdStrike for this module to work.

### Step 1: Creating a client-ID and client-secret

1. Go to the [CrowdStrike Falcon Portal](https://falcon.crowdstrike.com/login/).
2. In the sidebar (click on the 'hamburger': three horizontal lines in the top left), choose '**Support and Resources**', and then '**API clients and keys**'.

<figure><img src="/files/5dzebjxY1Y3ueGXuy2Jp" alt="" width="375"><figcaption><p>choose 'support and resources' and then 'API clients and keys' in the sidebar</p></figcaption></figure>

3. Click on the '**Create API client**' button

<figure><img src="/files/SeaaN769jfHKYguWM8UI" alt=""><figcaption><p>click on the 'Create API client' button</p></figcaption></figure>

4. Provide a name and description for your new API client:
   1. Client name: `Liberty91`
   2. Description: `Liberty91 Client`

<figure><img src="/files/o2M3BIXpc18QrEvIFGOk" alt="" width="375"><figcaption><p>Create an API-client (in this example 'indicators' and 'rules' are also activated, but you don't have to)</p></figcaption></figure>

4. You need to tick the 'read' button for the following Scopes:
   1. Actors (Falcon Intelligence)
   2. Malware Families (Falcon Intelligence)
   3. Reports (Falcon Intelligence)
   4. Vulnerabilities (Falcon Intelligence)
   5. Monitoring rules (Falcon Intelligence Recon)
   6. Scheduled Reports
5. Click on 'Update client details'
6. You will see a dialog box showing a `base URL`, `client ID` and `client secret`. Note all three of these down: you will need them in Liberty91 in the next step.

<figure><img src="/files/mH85YQ7agVmImXHFvuzU" alt="" width="375"><figcaption><p>write these values down, you will need them in Liberty91</p></figcaption></figure>

### Step 2: Provide Base URL, client-ID and client-secret in Liberty91's Crowdstrike Module

1. Go to your CrowdStrike Module in Liberty91
2. Provide the details you have generated during [step 1](#step-1-creating-a-client-id-and-client-secret).
3. Select the type of reports and notifications you want to import in Liberty91. Note that even though you can select them all here, Liberty91 will only import the type of reports that are included in your CrowdStrike license.&#x20;
4. Don't forget to **activate** your module, and click '**update**'.

<figure><img src="/files/U86eeftkx5PXFbYwm6P1" alt="" width="375"><figcaption><p>provide the generated API-details and activate the CrowdStrike Module</p></figcaption></figure>

Congratulations! You have now successfully activated your CrowdStrike Module! New reports and notifications will start to appear in the second (middle) column of your [Recent Threats](/dashboards/recent-threats-dashboard.md) dashboard. Reports are imported and displayed as PDF's, which does not always work on a mobile phone or in the app. Use your laptop or desktop instead.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.liberty91.com/modules/collection-modules/the-crowdstrike-module.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.