CrowdStrike EDR Integration

Learn how to connect CrowdStrike EDR with Sprinto to sync endpoint, device, and threat alert data for compliance monitoring.

Integrate CrowdStrike EDR with Sprinto to sync endpoint detection and response data and automate evidence collection for supported controls and checks.

Sprinto uses Leen.dev as its unified security API provider. Sprinto does not connect to CrowdStrike directly.

Note

Sprinto supports two separate CrowdStrike integrations: CrowdStrike EDR for endpoint detection and response, and CrowdStrike Spotlight for endpoint vulnerability scanning. This article covers CrowdStrike EDR.

Prerequisites

Before you begin, make sure you have:

• Admin access to your CrowdStrike account.

• Read-only access configured for the API client.

• The following CrowdStrike credentials:

  • Client ID

  • Client Secret

  • Base URL

• A paid Sprinto plan.

The integration does not require write permissions.

Permissions and data

Sprinto requires Read Access to your CrowdStrike EDR account.

The integration can sync:

• EDR-managed devices

• Threat alerts and detections

• Device groups

• Endpoint data

The integration supports automated evidence collection for 26 controls and 1 check.

Set up the integration

1. Open the CrowdStrike EDR integration

1. Log in to your Sprinto dashboard.

2. Go to Settings → Integrations.

3. In the All tab, search for CrowdStrike EDR.

4. Click Connect next to CrowdStrike EDR.

2. Review the integration requirements

A drawer opens with information about the integration.

Review the following sections:

• Automate evidences for: Shows the controls and checks supported by the integration.

• Permission & Data: Shows the required access and data Sprinto uses.

• Additional Information: Confirms that admin access to CrowdStrike EDR is required.

Click Next.

3. Confirm admin access

The next drawer provides the setup instructions.

1. Select I have admin access to CrowdStrike EDR.

2. Click Connect to CrowdStrike EDR.

4. Enter your CrowdStrike credentials

A pop-up opens where you need to enter:

• Client ID: Your CrowdStrike OAuth 2.0 Client ID.

• Client Secret: Your CrowdStrike OAuth 2.0 Client Secret.

• Base URL: The API base URL for your CrowdStrike cloud environment.

For instructions on creating the API client and retrieving these credentials, see Leen's CrowdStrike documentation.

Note

The Leen documentation covers the CrowdStrike credentials and read permissions required for its CrowdStrike connectors. Use the credentials generated for your CrowdStrike environment.

Enter the credentials in the corresponding fields and click Create.

Your CrowdStrike EDR integration is now connected.

Post-connection flow

After successful authentication, Sprinto displays a confirmation.

Click Close window to complete the setup.

Once connected, Sprinto automatically syncs data from CrowdStrike through Leen.dev. The integration is read-only, so data flows from CrowdStrike → Sprinto.

Sprinto syncs data every 24 hours.

The integration can retrieve:

• Devices and hosts

• Device groups

• EDR alerts and detections

• Endpoint-related security data

Leen's EDR connector supports listing and retrieving CrowdStrike EDR alerts, while its device connector supports CrowdStrike EDR devices and device groups. (Leen.dev Unified API for Security)

APIs used

Sprinto uses Leen.dev's unified security API to retrieve CrowdStrike data.

Leen endpoint	Data
GET /v1/entities/device-groups	Device and host groups
GET /v1/entities/devices	Hosts and endpoints
GET /v1/edr/alerts	EDR alerts and detections
GET /v2/vulnerability_findings	Vulnerability findings
GET /v2/resources	Resources

Leen's documentation confirms that CrowdStrike EDR is supported for EDR alerts, devices, device groups, and related configuration data. (Leen.dev Unified API for Security)

Limitations

• The integration is read-only. Sprinto does not write data to CrowdStrike.

• Data is automatically synced every 24 hours.

• A paid Sprinto plan is required.

• Only one CrowdStrike EDR connection per organisation is supported.

• CrowdStrike Spotlight is a separate integration and is not required for CrowdStrike EDR.

Troubleshooting

Insufficient credentials or scopes

If the Leen connection test fails, verify that:

• You have admin access to CrowdStrike.

• The API client has the required read permissions.

• The Client ID and Client Secret are correct.

• The Base URL matches your CrowdStrike cloud environment.

Spotlight requirements

Spotlight must be enabled only when using the CrowdStrike Spotlight integration. It is not a prerequisite for CrowdStrike EDR.

Duplicate credentials error

If Sprinto displays a duplicate credentials error, the connection is treated as successful when the credentials already belong to an existing connection.

Data is not syncing

If data is not appearing in Sprinto, check that:

• The CrowdStrike API client is active.

• The required read permissions are still assigned.

• The Client Secret has not been regenerated.

• The connection is active in Sprinto.

Leen's EDR integration documentation provides additional information about the CrowdStrike EDR connector and supported data.