Source: https://atomic-works-test.docs-staging.pageloop.ai/integrations/overview/crowdstrike-edr-integration

# Crowdstrike Edr Integration

---
description: >-
  Learn how to connect CrowdStrike EDR with Sprinto to sync endpoint, device,
  and threat alert data for compliance monitoring.
---

# CrowdStrike EDR Integration

Integrate CrowdStrike EDR with Sprinto to sync endpoint detection and response data and automate evidence collection for supported controls and checks.

Sprinto uses **Leen.dev** as its unified security API provider. Sprinto does not connect to CrowdStrike directly.

{% hint style="info" %}
#### Note

Sprinto supports two separate CrowdStrike integrations: **CrowdStrike EDR** for endpoint detection and response, and **CrowdStrike Spotlight** for endpoint vulnerability scanning. This article covers CrowdStrike EDR.
{% endhint %}

### Prerequisites

Before you begin, make sure you have:

* Admin access to your CrowdStrike account.
* Read-only access configured for the API client.
* The following CrowdStrike credentials:
  * **Client ID**
  * **Client Secret**
  * **Base URL**
* A paid Sprinto plan.

The integration does not require write permissions.

### Permissions and data

Sprinto requires **Read Access** to your CrowdStrike EDR account.

The integration can sync:

* EDR-managed devices
* Threat alerts and detections
* Device groups
* Endpoint data

The integration supports automated evidence collection for **26 controls and 1 check**.

### Set up the integration

#### 1. Open the CrowdStrike EDR integration

1. Log in to your Sprinto dashboard.
2. Go to **Settings → Integrations**.
3. In the **All** tab, search for **CrowdStrike EDR**.
4. Click **Connect** next to CrowdStrike EDR.

<figure><img src="../../.gitbook/assets/Screenshot 2026-08-14 at 17.13.10.png" alt="" width="563"><figcaption></figcaption></figure>

#### 2. Review the integration requirements

A drawer opens with information about the integration.

Review the following sections:

* **Automate evidences for:** Shows the controls and checks supported by the integration.
* **Permission & Data:** Shows the required access and data Sprinto uses.
* **Additional Information:** Confirms that admin access to CrowdStrike EDR is required.

Click **Next**.

<figure><img src="../../.gitbook/assets/Screenshot 2026-08-14 at 17.33.26.png" alt="" width="375"><figcaption></figcaption></figure>

#### 3. Confirm admin access

The next drawer provides the setup instructions.

1. Select **I have admin access to CrowdStrike EDR**.
2. Click **Connect to CrowdStrike EDR**.

<figure><img src="../../.gitbook/assets/Screenshot 2026-08-14 at 17.33.57.png" alt="" width="375"><figcaption></figcaption></figure>

#### 4. Enter your CrowdStrike credentials

A pop-up opens where you need to enter:

* **Client ID:** Your CrowdStrike OAuth 2.0 Client ID.
* **Client Secret:** Your CrowdStrike OAuth 2.0 Client Secret.
* **Base URL:** The API base URL for your CrowdStrike cloud environment.

For instructions on creating the API client and retrieving these credentials, see [Leen's CrowdStrike documentation](https://docs.leen.dev/integrations/crowdstrike-credential).

{% hint style="info" %}
#### Note

The Leen documentation covers the CrowdStrike credentials and read permissions required for its CrowdStrike connectors. Use the credentials generated for your CrowdStrike environment.
{% endhint %}

Enter the credentials in the corresponding fields and click **Create**.

<figure><img src="../../.gitbook/assets/Screenshot 2026-08-14 at 17.34.37.png" alt="" width="375"><figcaption></figcaption></figure>

Your CrowdStrike EDR integration is now connected.

### Post-connection flow

After successful authentication, Sprinto displays a confirmation.

Click **Close window** to complete the setup.

Once connected, Sprinto automatically syncs data from CrowdStrike through Leen.dev. The integration is read-only, so data flows from **CrowdStrike → Sprinto**.

Sprinto syncs data every **24 hours**.

The integration can retrieve:

* **Devices and hosts**
* **Device groups**
* **EDR alerts and detections**
* Endpoint-related security data

Leen's EDR connector supports listing and retrieving CrowdStrike EDR alerts, while its device connector supports CrowdStrike EDR devices and device groups. ([Leen.dev Unified API for Security](https://docs.leen.dev/integrations/endpoint-detection-response?utm_source=chatgpt.com))

### APIs used

Sprinto uses Leen.dev's unified security API to retrieve CrowdStrike data.

<table><thead><tr><th width="375.07421875">Leen endpoint</th><th>Data</th></tr></thead><tbody><tr><td><code>GET /v1/entities/device-groups</code></td><td>Device and host groups</td></tr><tr><td><code>GET /v1/entities/devices</code></td><td>Hosts and endpoints</td></tr><tr><td><code>GET /v1/edr/alerts</code></td><td>EDR alerts and detections</td></tr><tr><td><code>GET /v2/vulnerability_findings</code></td><td>Vulnerability findings</td></tr><tr><td><code>GET /v2/resources</code></td><td>Resources</td></tr></tbody></table>

Leen's documentation confirms that CrowdStrike EDR is supported for EDR alerts, devices, device groups, and related configuration data. ([Leen.dev Unified API for Security](https://docs.leen.dev/integrations/endpoint-detection-response?utm_source=chatgpt.com))

### Limitations

* The integration is **read-only**. Sprinto does not write data to CrowdStrike.
* Data is automatically synced every **24 hours**.
* A **paid Sprinto plan** is required.
* Only **one CrowdStrike EDR connection per organisation** is supported.
* CrowdStrike Spotlight is a separate integration and is not required for CrowdStrike EDR.

### Troubleshooting

#### Insufficient credentials or scopes

If the Leen connection test fails, verify that:

* You have admin access to CrowdStrike.
* The API client has the required read permissions.
* The Client ID and Client Secret are correct.
* The Base URL matches your CrowdStrike cloud environment.

#### Spotlight requirements

**Spotlight must be enabled only when using the CrowdStrike Spotlight integration.** It is not a prerequisite for CrowdStrike EDR.

#### Duplicate credentials error

If Sprinto displays a duplicate credentials error, the connection is treated as successful when the credentials already belong to an existing connection.

#### Data is not syncing

If data is not appearing in Sprinto, check that:

* The CrowdStrike API client is active.
* The required read permissions are still assigned.
* The Client Secret has not been regenerated.
* The connection is active in Sprinto.

[Leen's EDR integration documentation](https://docs.leen.dev/integrations/crowdstrike-credential) provides additional information about the CrowdStrike EDR connector and supported data.