From fe04e27e45c10cc3896d01647804690f5568ba1b Mon Sep 17 00:00:00 2001 From: leet-c1 <264029741+leet-c1@users.noreply.github.com> Date: Thu, 20 Aug 2026 18:18:17 +0000 Subject: [PATCH 1/2] docs(crowdstrike): document the API scopes each tool group needs The page told admins to grant "Read access to Detections, Incidents, and Hosts", which does not map to the tools C1 actually exposes and leaves the most confusing case undocumented. Adds a Choose API scopes section mapping each tool group to its Falcon API scope, covering hosts, alerts, incidents, indicators of compromise, device control policies, Spotlight vulnerabilities, Falcon Intelligence, Zero Trust Assessment, Falcon Discover, and cloud misconfigurations. Calls out the trap behind a real support question: the cloud misconfiguration tools need CSPM registration, not Cloud Security API Detections. The two scopes authorize different Falcon APIs, so an admin who enables the latter sees 403s on those tools while everything else works. Also documents the write scopes the response tools need (Hosts and IOC Manager), since the previous text implied Read was sufficient for the whole surface, and notes that a read-only API client is a deliberate way to keep response actions unavailable. Scope edits apply on the next token request, so admins do not need to re-register the server. --- product/admin/mcp-server/crowdstrike.mdx | 40 ++++++++++++++++++++++-- 1 file changed, 38 insertions(+), 2 deletions(-) diff --git a/product/admin/mcp-server/crowdstrike.mdx b/product/admin/mcp-server/crowdstrike.mdx index 6a7745d5..fa879dc5 100644 --- a/product/admin/mcp-server/crowdstrike.mdx +++ b/product/admin/mcp-server/crowdstrike.mdx @@ -42,7 +42,7 @@ In the Falcon console, go to **Support and resources** > **API clients and keys* {/* REVIEWER NOTE — needs a verified docs link for generating credentials */} -Give the client a recognizable name such as `C1`, then grant only the **API scopes** you need, such as **Read** access to Detections, Incidents, and Hosts. +Give the client a recognizable name such as `C1`, then grant **Read** on the API scopes covering the tools you want. See [Choose API scopes](#choose-api-scopes) for the mapping. Select **Create**, then copy the **Client ID** and **Client Secret**. CrowdStrike shows the secret only once. @@ -56,6 +56,42 @@ Note your Falcon cloud's API base URL, such as `https://api.crowdstrike.com` or For a shared production setup, use a dedicated API client so activity is attributable to C1 rather than a person. +## Choose API scopes + +The API client's scopes determine which tools return data. C1 exposes tools across several Falcon products, and each needs its own scope. **Read** covers every list tool: + +| Tools | Falcon API scope | +|---|---| +| Hosts | Hosts | +| Alerts | Alerts | +| Incidents | Incidents | +| Indicators of compromise | IOC Manager | +| Device control policies | Device control policies | +| Vulnerabilities and remediations | Vulnerabilities (Falcon Spotlight) | +| Threat actors, indicators, and reports | Falcon Intelligence | +| Zero Trust Assessment | Zero Trust Assessment | +| Applications | Falcon Discover | +| Cloud misconfigurations (IOM) | CSPM registration | + +{/* REVIEWER NOTE — confirm the exact Falcon console labels for each scope row */} + +Grant only the scopes for the tools you plan to use. A tool whose scope is missing returns CrowdStrike's authorization error rather than an empty result, so an unexpected 403 usually means the scope is absent from the API client. + +The response tools need **Write** in addition to Read: + +| Tools | Falcon API scope | +|---|---| +| Contain, lift containment, hide host | Hosts (Write) | +| Create indicator of compromise | IOC Manager (Write) | + +Leave these scopes off the API client if you want a read-only connection. The tools then return CrowdStrike's authorization error, so a read-only client is a deliberate way to keep response actions unavailable. + + +The cloud misconfiguration tools need **CSPM registration**, not **Cloud Security API Detections**. The two scopes cover different Falcon APIs, and Cloud Security API Detections does not authorize the tools C1 exposes. If `crowdstrike_list_ioms` returns 403 while your other tools work, add CSPM registration to the API client. + + +Scope changes take effect the next time C1 requests a token, so you don't need to re-register the server or reconnect after editing the API client. + ## How CrowdStrike credentials are shared The API client authenticates every user as one shared Falcon identity, so CrowdStrike sees a single identity for all tool calls. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared setup, use a dedicated API client so activity is attributable to C1 rather than a person. @@ -96,4 +132,4 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your CrowdStrike credentials - **Rotate the client secret** by resetting it on the API client in the Falcon console, then update the secret on the server's authentication settings in C1. -- **Adjust access** by editing the API scopes granted to the API client in CrowdStrike. +- **Adjust access** by editing the API scopes granted to the API client in CrowdStrike. See [Choose API scopes](#choose-api-scopes). From 18afd590da8527d8391e4c0424dad8f8793fbf4a Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Thu, 20 Aug 2026 14:33:14 -0700 Subject: [PATCH 2/2] docs: apply style guide fixes Co-Authored-By: Claude Sonnet 5 --- product/admin/mcp-server/crowdstrike.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/product/admin/mcp-server/crowdstrike.mdx b/product/admin/mcp-server/crowdstrike.mdx index fa879dc5..d0e8194d 100644 --- a/product/admin/mcp-server/crowdstrike.mdx +++ b/product/admin/mcp-server/crowdstrike.mdx @@ -86,9 +86,9 @@ The response tools need **Write** in addition to Read: Leave these scopes off the API client if you want a read-only connection. The tools then return CrowdStrike's authorization error, so a read-only client is a deliberate way to keep response actions unavailable. - + The cloud misconfiguration tools need **CSPM registration**, not **Cloud Security API Detections**. The two scopes cover different Falcon APIs, and Cloud Security API Detections does not authorize the tools C1 exposes. If `crowdstrike_list_ioms` returns 403 while your other tools work, add CSPM registration to the API client. - + Scope changes take effect the next time C1 requests a token, so you don't need to re-register the server or reconnect after editing the API client.