CrowdStrike Falcon Cloud
Connect CrowdStrike Falcon Cloud to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect CrowdStrike Falcon Cloud to collect endpoint detection & response evidence with automated compliance tests, switched on per workspace.
| Category | Endpoint Detection & Response |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| CrowdStrike Falcon Cloud's guide | developer.crowdstrike.com |
Connect with an API token
-
In CrowdStrike Falcon Cloud:
- Sign in to the Falcon console and go to Support › API Clients and Keys.
- In the OAuth2 API clients area, click Add new API client.
- Enter a Client Name and a description that identifies the client as Safeguard's.
- Under API Scopes, select only the Read capability for the scopes Safeguard needs.
- Click Add. The window that opens shows the Client ID, Secret and Base URL; copy all three now.
Where to find the other values:
- Client ID: Shown in the window that opens after you click Add.
- Cloud: The Base URL shown with the new client identifies your cloud: api.crowdstrike.com is US-1, api.us-2.crowdstrike.com is US-2, api.eu-1.crowdstrike.com is EU-1, api.laggar.gcw.crowdstrike.com is US-GOV.
CrowdStrike Falcon Cloud shows the secret only once, so copy it before you leave the page.
CrowdStrike Falcon Cloud's public documentation does not cover every step.
Source: developer.crowdstrike.com, crowdstrike.com, checked 2026-10-07.
The permissions Safeguard needs:
CSPM registration: Read. -
On Compliance › Connectors, open CrowdStrike Falcon Cloud, click Connect, choose API token and fill in:
Field What to enter Client ID Required. Client secret Required. Stored encrypted and never shown again. Cloud Required. -
Click Connect with token.
Frameworks
Safeguard's automated tests read CrowdStrike Falcon Cloud and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC7.1 | 3 |
| ISO/IEC 27001 | Automated tests | A.8.8, A.8.9 | 3 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1) | 3 |
| PCI DSS | Automated tests | 2.2.1, 6.3.3, 11.3.1 | 3 |
| NIST CSF 2.0 | Automated tests | DE.CM-09, ID.AM-02, ID.RA-01, PR.PS-01 | 3 |
These tests are switched on per workspace by the Safeguard team.
Related
- Endpoint Detection & Response connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks