Configure authentication to CrowdStrike Falcon

Beta

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for CrowdStrike Falcon Event Stream from the Previews page. See Manage Databricks previews.

Configure CrowdStrike Falcon to enable authentication from Databricks for the CrowdStrike Falcon Event Stream connector. Use the credentials from these steps to create a Unity Catalog connection in Databricks.

Prerequisites

• Requires a Falcon administrator to create an OAuth2 API client. See CrowdStrike's Event Streams API documentation.
• The API client must have the Event streams scope with Read permission (event_streams read). The connector calls GET /sensors/entities/datafeed/v2 and consumes the returned feeds.

Configure CrowdStrike Falcon

CrowdStrike Falcon authenticates Event Stream requests with an OAuth 2.0 client credentials token. Databricks exchanges the client ID and client secret for an access token, then discovers and reads Event Stream feeds. For more information, see CrowdStrike's Event Streams API documentation.

1. Sign in to the Falcon console as a Falcon administrator.
2. Go to Support and resources, then API clients and keys.
3. Click Add new API client.
4. Enter a Client name (for example, Event_Stream_Ingestor) and an optional Description.
5. Under API scopes, find Event streams and enable Read.
6. Click Create.
7. Copy the Client ID, Client Secret, and Base URL. CrowdStrike Falcon shows the client secret only once. For the Databricks connection, enter the Base URL with the https:// scheme and no path (for example, https://api.crowdstrike.com or https://api.us-2.crowdstrike.com).

Next steps

Create a CrowdStrike Falcon Event Stream connection in Databricks. See Create an CrowdStrike Falcon Event Stream connection.