> For the complete documentation index, see [llms.txt](https://docs.sprinto.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sprinto.com/integrations/overview/crowdstrike-edr-integration.md).
# CrowdStrike EDR Integration
Integrate CrowdStrike EDR with Sprinto to sync endpoint detection and response data and automate evidence collection for supported controls and checks.
Sprinto uses **Leen.dev** as its unified security API provider. Sprinto does not connect to CrowdStrike directly.
{% hint style="info" %}
#### Note
Sprinto supports two separate CrowdStrike integrations: **CrowdStrike EDR** for endpoint detection and response, and **CrowdStrike Spotlight** for endpoint vulnerability scanning. This article covers CrowdStrike EDR.
{% endhint %}
### Prerequisites
Before you begin, make sure you have:
* Admin access to your CrowdStrike account.
* Read-only access configured for the API client.
* The following CrowdStrike credentials:
* **Client ID**
* **Client Secret**
* **Base URL**
* A paid Sprinto plan.
The integration does not require write permissions.
### Permissions and data
Sprinto requires **Read Access** to your CrowdStrike EDR account.
The integration can sync:
* EDR-managed devices
* Threat alerts and detections
* Device groups
* Endpoint data
The integration supports automated evidence collection for **26 controls and 1 check**.
### Set up the integration
#### 1. Open the CrowdStrike EDR integration
1. Log in to your Sprinto dashboard.
2. Go to **Settings → Integrations**.
3. In the **All** tab, search for **CrowdStrike EDR**.
4. Click **Connect** next to CrowdStrike EDR.
#### 2. Review the integration requirements
A drawer opens with information about the integration.
Review the following sections:
* **Automate evidences for:** Shows the controls and checks supported by the integration.
* **Permission & Data:** Shows the required access and data Sprinto uses.
* **Additional Information:** Confirms that admin access to CrowdStrike EDR is required.
Click **Next**.
#### 3. Confirm admin access
The next drawer provides the setup instructions.
1. Select **I have admin access to CrowdStrike EDR**.
2. Click **Connect to CrowdStrike EDR**.
#### 4. Enter your CrowdStrike credentials
A pop-up opens where you need to enter:
* **Client ID:** Your CrowdStrike OAuth 2.0 Client ID.
* **Client Secret:** Your CrowdStrike OAuth 2.0 Client Secret.
* **Base URL:** The API base URL for your CrowdStrike cloud environment.
For instructions on creating the API client and retrieving these credentials, see [Leen's CrowdStrike documentation](https://docs.leen.dev/integrations/crowdstrike-credential).
{% hint style="info" %}
#### Note
The Leen documentation covers the CrowdStrike credentials and read permissions required for its CrowdStrike connectors. Use the credentials generated for your CrowdStrike environment.
{% endhint %}
Enter the credentials in the corresponding fields and click **Create**.
Your CrowdStrike EDR integration is now connected.
### Post-connection flow
After successful authentication, Sprinto displays a confirmation.
Click **Close window** to complete the setup.
Once connected, Sprinto automatically syncs data from CrowdStrike through Leen.dev. The integration is read-only, so data flows from **CrowdStrike → Sprinto**.
Sprinto syncs data every **24 hours**.
The integration can retrieve:
* **Devices and hosts**
* **Device groups**
* **EDR alerts and detections**
* Endpoint-related security data
Leen's EDR connector supports listing and retrieving CrowdStrike EDR alerts, while its device connector supports CrowdStrike EDR devices and device groups. ([Leen.dev Unified API for Security](https://docs.leen.dev/integrations/endpoint-detection-response?utm_source=chatgpt.com))
### APIs used
Sprinto uses Leen.dev's unified security API to retrieve CrowdStrike data.
Leen endpoint
Data
GET /v1/entities/device-groups
Device and host groups
GET /v1/entities/devices
Hosts and endpoints
GET /v1/edr/alerts
EDR alerts and detections
GET /v2/vulnerability_findings
Vulnerability findings
GET /v2/resources
Resources
Leen's documentation confirms that CrowdStrike EDR is supported for EDR alerts, devices, device groups, and related configuration data. ([Leen.dev Unified API for Security](https://docs.leen.dev/integrations/endpoint-detection-response?utm_source=chatgpt.com))
### Limitations
* The integration is **read-only**. Sprinto does not write data to CrowdStrike.
* Data is automatically synced every **24 hours**.
* A **paid Sprinto plan** is required.
* Only **one CrowdStrike EDR connection per organisation** is supported.
* CrowdStrike Spotlight is a separate integration and is not required for CrowdStrike EDR.
### Troubleshooting
#### Insufficient credentials or scopes
If the Leen connection test fails, verify that:
* You have admin access to CrowdStrike.
* The API client has the required read permissions.
* The Client ID and Client Secret are correct.
* The Base URL matches your CrowdStrike cloud environment.
#### Spotlight requirements
**Spotlight must be enabled only when using the CrowdStrike Spotlight integration.** It is not a prerequisite for CrowdStrike EDR.
#### Duplicate credentials error
If Sprinto displays a duplicate credentials error, the connection is treated as successful when the credentials already belong to an existing connection.
#### Data is not syncing
If data is not appearing in Sprinto, check that:
* The CrowdStrike API client is active.
* The required read permissions are still assigned.
* The Client Secret has not been regenerated.
* The connection is active in Sprinto.
[Leen's EDR integration documentation](https://docs.leen.dev/integrations/crowdstrike-credential) provides additional information about the CrowdStrike EDR connector and supported data.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.sprinto.com/integrations/overview/crowdstrike-edr-integration.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.