CrowdStrike

This integration lets Stairwell take files and detections from a CrowdStrike Falcon deployment you already run, so endpoints covered by Falcon contribute to your corpus without a second agent.

It uses two Falcon features. Falcon Data Replicator (FDR) exports raw endpoint telemetry to a cloud storage bucket, which is how Stairwell learns that a file of interest exists. Real Time Response (RTR) provides remote access to endpoints, which is how Stairwell optionally retrieves the file itself. FDR tells you something happened; RTR gets you the artifact.

What do I need before I start?

Three things configured on the Falcon side:

The Falcon Data Replicator service enabled.
An FDR feed created.
An RTR API client set up.

The RTR API client needs three scopes:

Scope	Access
Real time response	Read
Real time response	Write
Hosts	Read

If none of that is configured yet, contact [email protected] rather than working it out from the Falcon documentation alone. Getting the scopes wrong produces an integration that appears healthy and silently retrieves nothing.

FDR supports many event types. Stairwell consumes two:

SuspiciousPeFileWritten
PeFileWrittenDetectInfo

Both are Portable Executable events, which is worth noting when you plan coverage: this integration sees Windows executables written on Falcon-monitored hosts, not the full range of formats a forwarder collects.

Should I use this instead of the forwarder?

For Windows endpoints where you cannot deploy a forwarder, yes. As a replacement for the forwarder, no.

CrowdStrike's pipeline may not sustain ingestion at the rate full file visibility requires. If you need extended visibility into macOS or Linux endpoints in particular, deploy the forwarder there and treat this integration as an addition rather than a substitute. For help sizing that, contact [email protected].

How do I configure it?

In Stairwell:

Select the settings icon.
Open the Managed environments tab.
Find the environment you are configuring, select (...) under Actions, and choose Manage integrations.
Choose Add new CrowdStrike integration.

Then fill in eight fields. Four come from the RTR setup and three from the FDR setup.

Field	Where it comes from
Name	Yours to choose. Name it for the environment or business unit it covers, because you will be reading this label in a list later
Hostname	The base URL for the credentials created during RTR setup, for example `api.us-2.crowdstrike.com`
Client ID	The Falcon API client ID from RTR setup
Client Secret	The Falcon API client secret from RTR setup
AWS Client ID	Generated during FDR setup
AWS Secret	Generated during FDR setup
SQS URI	The AWS SQS queue URI, generated during FDR setup

Three of those secrets are shown exactly once. The Falcon API client secret, the AWS client ID, and the AWS secret cannot be retrieved after the dialog that creates them is closed. Have somewhere to put each one before you generate it, and if you lose one, expect to reissue rather than recover it.

How do I know it is working?

Files start appearing in the environment you configured. Give it time before concluding anything: a few minutes to a few hours is normal, depending on how much activity the FDR feed carries.

Once objects arrive, open one and read the object panel. A file that came in through this integration is an ordinary object in every respect: it has a verdict, prevalence, sightings naming the assets that held it, matching YARA rules, and variants. Nothing about its origin limits what you can ask of it.

If nothing has arrived after several hours, check the RTR client's scopes first. That is the most common cause, and it fails quietly.

Where do I get help?

[email protected], with the integration name and the environment it belongs to.

What should I read next?

Integrations, for the inbound and outbound distinction and what else is available.
Forwarder Deployment, for the coverage question above.
The Object Panel, for what to do with the files once they arrive.