The ServiceNow CrowdStrike Falcon integration enables organizations to automatically transform security detections from CrowdStrike's endpoint detection and response platform into actionable ServiceNow security incidents, while providing bi-directional communication for threat response orchestration. This integration is primarily used by Security Operations Centers (SOCs), IT security teams, and incident response professionals who need to centralize threat detection workflows within ServiceNow's Security Operations application. The integration supports bi-directional data flows including inbound detection events that create security incidents, outbound commands for endpoint isolation and remediation actions, and continuous CMDB synchronization for asset context enrichment. Primary automation patterns include real-time webhook-based detection ingestion, scheduled batch synchronization of device information, and on-demand threat response actions triggered from ServiceNow security incident workflows, all managed within the Security Operations and Integration Hub modules.
Prerequisites
- •ServiceNow Quebec or later with Security Operations application installed and activated
- •CrowdStrike Falcon platform with API access and appropriate user permissions for Detections API and Host Management API
- •Integration Hub Professional license or higher for CrowdStrike Falcon spoke usage
- •Security Incident Response plugin (com.snc.security_incident) enabled
- •ServiceNow MID Server installed and configured if on-premises CMDB synchronization is required
- •CrowdStrike Falcon Real Time Response (RTR) license for endpoint isolation capabilities
- •Admin or security_admin role in ServiceNow for integration configuration
Architecture Overview
The integration utilizes the official ServiceNow Integration Hub CrowdStrike Falcon spoke, which provides pre-built actions for detection retrieval, device management, and host isolation operations through CrowdStrike's RESTful APIs. Authentication is established using OAuth 2.0 Client Credentials flow with the client ID and secret stored securely in ServiceNow Connection & Credential Alias records, eliminating the need for hardcoded API keys. Data flows are primarily inbound from CrowdStrike to ServiceNow via scheduled import jobs and optional real-time webhooks that trigger security incident creation, with outbound flows for threat response actions like host isolation and remediation commands. A MID Server is not required for cloud-to-cloud communication but may be needed for hybrid environments where on-premises CMDB systems require device information synchronization. CrowdStrike enforces API rate limits of approximately 300 requests per minute per API client, requiring the integration to implement proper throttling and batch processing mechanisms within the Integration Hub flow design.
Sourdough: ServiceNow Monitoring and Analytics
A Chrome extension for ServiceNow Admins and Developers with essential tools, analytics, graphs and monitoring features.
Free to install. Pro $5/month after a 14-day no-card trial.
Pro requires the ServiceNow admin role. Upgrade inside the extension.
Implementation Steps
Create CrowdStrike Falcon API client and configure OAuth credentials
Navigate to the CrowdStrike Falcon console and access Support > API Clients & Keys to create a new API client with appropriate scopes including 'Detections:Read', 'Hosts:Read', 'Real time response:Write', and 'Real time response admin:Write'. Copy the generated Client ID and Client Secret immediately as they will not be shown again. In ServiceNow, navigate to Connections & Credentials > Credentials and create a new OAuth Entity Profile record with Grant Type set to 'Client Credentials', entering the CrowdStrike Client ID in the Client ID field and Client Secret in the Client Secret field. Set the Token URL to your CrowdStrike cloud region's OAuth endpoint (e.g., https://api.crowdstrike.com/oauth2/token for US-1).
Install and configure the CrowdStrike Falcon Integration Hub spoke
Navigate to System Applications > All Available Applications > All and search for 'CrowdStrike Falcon' to locate the official Integration Hub spoke. Install the spoke and ensure all required dependencies are satisfied, including the Security Operations application. After installation, navigate to Integration Hub > Connections and create a new connection record for CrowdStrike Falcon, selecting the OAuth Entity Profile created in the previous step. Configure the connection alias with the appropriate CrowdStrike API base URL for your cloud region (api.crowdstrike.com for US-1, api.eu-1.crowdstrike.com for EU, or api.us-2.crowdstrike.com for US-2). Test the connection to verify successful OAuth token acquisition and API connectivity.
Configure CMDB identification rules for CrowdStrike device correlation
Navigate to Configuration > Identification and Reconciliation > Identification Rules and create or modify rules to correlate CrowdStrike device data with existing CMDB Configuration Items. Set up identification criteria using MAC addresses, hostname patterns, and serial numbers that CrowdStrike provides in its device API responses. Configure the rule to target the cmdb_ci_computer table and establish proper data source precedence to ensure CrowdStrike data appropriately updates or supplements existing device records. Create transform maps if custom field mappings are required between CrowdStrike device attributes and ServiceNow CI fields, particularly for OS version, last seen timestamp, and security policy assignments.
// Example identification script for CrowdStrike device correlation
var gr = new GlideRecord('cmdb_ci_computer');
gr.addQuery('mac_address', current.mac_address);
gr.addOrCondition('name', current.hostname);
gr.query();
if (gr.next()) {
gr.setValue('last_discovered', new GlideDateTime());
gr.setValue('u_crowdstrike_agent_id', current.device_id);
gr.setValue('u_crowdstrike_status', current.status);
gr.update();
return gr.getUniqueValue();
}
return '';Create Integration Hub flow for CrowdStrike detection ingestion
Navigate to Integration Hub > Flows and create a new flow named 'CrowdStrike Detection Import' with a scheduled trigger set to run every 5-10 minutes depending on your detection volume requirements. Add the 'CrowdStrike Falcon - Get Detections' action as the first step, configuring it to retrieve detections with severity 'Medium' or higher and status 'new' or 'in_progress'. Configure the flow to iterate through returned detections using a For Each loop, with each iteration creating a new Security Incident record via the 'ServiceNow Core - Create Record' action. Map detection fields to incident fields including short_description, description, severity, and custom fields for CrowdStrike-specific metadata like detection_id and device information.
// Detection to Incident mapping script within Integration Hub flow
var incident = new GlideRecord('sn_si_incident');
incident.setValue('short_description', 'CrowdStrike Detection: ' + detection.behavior_name);
incident.setValue('description', detection.description + '\nDevice: ' + detection.device.hostname + '\nUser: ' + detection.user_name);
incident.setValue('severity', detection.max_severity >= 70 ? '1' : detection.max_severity >= 40 ? '2' : '3');
incident.setValue('u_detection_id', detection.detection_id);
incident.setValue('u_crowdstrike_url', 'https://falcon.crowdstrike.com/activity/detections/detail/' + detection.detection_id);
incident.setValue('state', '1'); // New state
var incidentSysId = incident.insert();
return incidentSysId;Implement host isolation workflow with approval process
Create a ServiceNow workflow or Flow Designer flow that triggers when a Security Incident reaches a specific state requiring host isolation. Navigate to Workflow > Workflow Editor and design a flow that first requires approval from a security manager before executing isolation commands. Add workflow activities that utilize the CrowdStrike Falcon spoke's 'Contain Host' action, passing the device ID obtained from the original detection data. Include error handling to manage scenarios where the host is already isolated, offline, or the isolation command fails due to insufficient permissions. Configure notification activities to alert the incident assignee and affected user when isolation is initiated or completed.
// Script to initiate host isolation from Security Incident
var gr = new GlideRecord('sn_si_incident');
if (gr.get(current.sys_id)) {
var deviceId = gr.getValue('u_device_id');
if (deviceId) {
var isolationFlow = new sn_fd.FlowAPI();
var inputs = {
'device_id': deviceId,
'incident_sys_id': current.sys_id,
'requester': gs.getUserID()
};
isolationFlow.startFlow('CrowdStrike_Host_Isolation', inputs);
gr.setValue('work_notes', 'Host isolation workflow initiated for device: ' + deviceId);
gr.update();
}
}Configure threat intelligence sharing and IOC synchronization
Set up bidirectional threat intelligence sharing by creating Integration Hub flows that periodically synchronize Indicators of Compromise (IOCs) between CrowdStrike Falcon Intelligence and ServiceNow Threat Intelligence tables. Navigate to Integration Hub > Flows and create flows using the 'CrowdStrike Falcon - Get IOCs' and 'Create Custom IOC' actions to pull threat indicators and push organization-specific IOCs back to CrowdStrike. Configure data transformation logic to map CrowdStrike IOC types (hash, domain, IP, URL) to corresponding ServiceNow threat intelligence record types. Implement deduplication logic to prevent duplicate IOC creation and establish proper data governance controls to ensure only validated threat intelligence is shared between platforms.
// IOC synchronization with deduplication logic
var iocGr = new GlideRecord('u_threat_intelligence');
iocGr.addQuery('u_indicator_value', crowdstrikeIOC.indicator);
iocGr.addQuery('u_indicator_type', crowdstrikeIOC.type);
iocGr.query();
if (!iocGr.hasNext()) {
var newIOC = new GlideRecord('u_threat_intelligence');
newIOC.setValue('u_indicator_value', crowdstrikeIOC.indicator);
newIOC.setValue('u_indicator_type', crowdstrikeIOC.type);
newIOC.setValue('u_confidence', crowdstrikeIOC.malicious_confidence);
newIOC.setValue('u_source', 'CrowdStrike Falcon');
newIOC.setValue('u_created_date', crowdstrikeIOC.created_timestamp);
newIOC.insert();
}Set up real-time webhook endpoint for immediate detection alerting
Configure a ServiceNow Scripted REST API to receive real-time detection webhooks from CrowdStrike, enabling immediate security incident creation for critical threats. Navigate to System Web Services > Scripted REST APIs and create a new API with a POST resource that processes CrowdStrike webhook payloads. Implement authentication verification using the webhook secret provided by CrowdStrike and payload validation to ensure data integrity. Configure the endpoint to immediately create high-priority security incidents for detections with severity 'Critical' or 'High', while routing lower-severity detections to the scheduled import process to prevent alert fatigue.
// Scripted REST API endpoint for CrowdStrike webhooks
(function process(request, response) {
var payload = request.body.data;
var webhookSecret = gs.getProperty('crowdstrike.webhook.secret');
var receivedSignature = request.getHeader('X-CS-Signature');
// Verify webhook authenticity
if (!verifySignature(payload, receivedSignature, webhookSecret)) {
response.setStatus(401);
return;
}
// Process detection for immediate incident creation
if (payload.severity >= 70) {
var incident = new GlideRecord('sn_si_incident');
incident.setValue('priority', '1');
incident.setValue('short_description', 'URGENT: ' + payload.behavior_name);
incident.setValue('u_detection_id', payload.detection_id);
incident.insert();
}
response.setStatus(200);
})(request, response);Test integration functionality and implement monitoring
Execute comprehensive testing of all integration components including detection import, incident creation, host isolation workflows, and CMDB synchronization. Navigate to Integration Hub > Flow Execution History to verify successful flow executions and review any error messages or failed steps. Test the webhook endpoint using CrowdStrike's webhook testing feature or tools like Postman to simulate detection payloads. Set up proactive monitoring by creating ServiceNow Event Management rules that alert administrators when integration flows fail, API rate limits are exceeded, or authentication tokens require renewal. Configure dashboard widgets and reports to track integration health metrics including detection processing times, incident creation rates, and failed API calls.
// Integration health monitoring script
var healthCheck = new GlideRecord('sys_flow_execution');
healthCheck.addQuery('flow', 'CrowdStrike Detection Import');
healthCheck.addQuery('sys_created_on', '>', gs.hoursAgoStart(1));
healthCheck.addQuery('status', 'failed');
healthCheck.query();
if (healthCheck.getRowCount() > 0) {
gs.eventQueue('crowdstrike.integration.failure', null, 'Detection import failures detected', 'Check Integration Hub flow logs');
}
// Check API credential expiry
var cred = new GlideRecord('oauth_entity_profile');
if (cred.get('name', 'CrowdStrike Falcon')) {
var expiryTime = new GlideDateTime(cred.getValue('token_expires_on'));
if (expiryTime.before(gs.nowDateTime())) {
gs.eventQueue('crowdstrike.auth.expired', null, 'OAuth token expired', 'Renew CrowdStrike API credentials');
}
}Common Use Cases
Automated Security Incident Creation from Malware Detections
CrowdStrike Falcon detects malware execution on endpoints and automatically creates ServiceNow Security Incidents with complete context including file hashes, execution paths, and affected user information. The integration enriches incidents with CMDB data to provide asset ownership and business service impact details. Security analysts receive immediate notifications through ServiceNow's assignment rules and can access detailed forensic information without switching between platforms. This use case typically processes hundreds of detections daily in enterprise environments, with automated severity classification reducing manual triage efforts by 70-80%.
Orchestrated Endpoint Isolation for Threat Containment
When critical security incidents require immediate containment, ServiceNow workflows automatically trigger CrowdStrike host isolation commands while managing approval processes and stakeholder notifications. The integration tracks isolation status in real-time and automatically creates follow-up tasks for forensic analysis and system remediation. Business stakeholders receive automated notifications about isolated systems with estimated business impact based on CMDB relationships and service dependencies. This orchestrated approach reduces threat containment time from hours to minutes while maintaining proper change management controls and audit trails.
CMDB Enrichment with Endpoint Security Posture Data
The integration continuously synchronizes CrowdStrike device information with ServiceNow CMDB to maintain accurate security posture visibility across all managed endpoints. Configuration items are automatically updated with agent status, last seen timestamps, prevention policy assignments, and security control effectiveness metrics. This enriched CMDB data supports risk assessment workflows, compliance reporting, and security architecture decisions by providing real-time endpoint security context. Organizations use this data to identify coverage gaps, track agent deployment progress, and correlate security events with asset criticality and business service dependencies.
Threat Intelligence Sharing and IOC Management
Bidirectional threat intelligence sharing enables organizations to consume CrowdStrike's global threat intelligence while contributing organization-specific indicators of compromise back to their CrowdStrike environment. ServiceNow becomes the central repository for threat intelligence correlation, allowing security teams to enrich IOCs with internal context and threat hunting results. The integration automatically creates custom IOCs in CrowdStrike based on internal threat research and incident analysis performed within ServiceNow. This collaborative approach enhances detection capabilities and creates a feedback loop that improves overall security effectiveness across the organization's security stack.
Compliance Reporting and Security Metrics Dashboard
The integration enables comprehensive security reporting by combining CrowdStrike detection data with ServiceNow's reporting and dashboard capabilities to create executive-level security metrics and compliance reports. Organizations track key performance indicators including mean time to detection, incident response times, endpoint coverage percentages, and threat trend analysis over time. Automated report generation provides stakeholders with regular security posture updates while supporting audit requirements and regulatory compliance initiatives. ServiceNow's Performance Analytics capabilities process historical detection data to identify patterns, predict security trends, and measure the effectiveness of security controls and response procedures.
Troubleshooting
OAuth token expiration causing 401 Unauthorized errors in Integration Hub flows
Navigate to Integration Hub > Connections and test the CrowdStrike connection to verify token status, then check the OAuth Entity Profile record for token expiration timestamps. If tokens have expired, manually refresh them by editing the connection and clicking 'Test Connection', or configure automatic token refresh by ensuring the OAuth profile has proper refresh token handling enabled. Review the Integration Hub execution history for specific error messages and verify that the CrowdStrike API client hasn't been deactivated or had its permissions modified in the Falcon console.
Duplicate security incidents being created for the same CrowdStrike detection
Review the detection import flow logic to ensure proper deduplication using the unique detection_id field from CrowdStrike, and create a unique index on the custom detection_id field in the security incident table if not already present. Check the scheduled flow execution frequency and adjust timing to prevent overlapping executions that might process the same detection multiple times. Implement flow execution locking mechanisms using ServiceNow's mutex capabilities or add conditional logic to check for existing incidents before creating new ones.
Host isolation commands failing with 'device not found' errors
Verify that the device_id stored in ServiceNow matches the exact format expected by CrowdStrike's API by checking the device details in the Falcon console and comparing with ServiceNow records. Ensure that the CrowdStrike API client has the required 'Real time response admin:Write' permission scope and that the target device has the Real Time Response feature enabled. Check that the device is online and has recent activity in CrowdStrike before attempting isolation, as offline devices will reject isolation commands until they reconnect to the Falcon cloud.
CMDB synchronization failing to correlate CrowdStrike devices with existing Configuration Items
Review the identification rules configuration to ensure that matching criteria include multiple identifiers like MAC address, hostname, and serial number, accounting for potential data format differences between systems. Check the IRE (Identification and Reconciliation Engine) logs in ServiceNow for specific correlation failures and verify that CrowdStrike device data contains the expected identifying attributes. Adjust the identification rule precedence and create custom transform maps if CrowdStrike provides device information in formats that don't directly match ServiceNow CI field requirements.
Webhook endpoint receiving payloads but failing signature verification
Verify that the webhook secret configured in ServiceNow matches exactly with the secret configured in CrowdStrike's webhook settings, checking for any trailing spaces or encoding issues. Review the signature verification algorithm implementation to ensure it matches CrowdStrike's HMAC-SHA256 signature format and header naming conventions (X-CS-Signature). Enable debug logging in the Scripted REST API to capture the raw payload and signature values for comparison, and ensure that the signature verification occurs before any payload parsing that might modify the original data.
API rate limit exceeded errors during high-volume detection periods
Implement exponential backoff retry logic in Integration Hub flows and reduce the scheduled flow execution frequency during peak detection periods to stay within CrowdStrike's 300 requests per minute limit. Add flow execution monitoring to track API call volume and configure dynamic throttling that adjusts request frequency based on current rate limit status returned in CrowdStrike API response headers. Consider implementing batch processing for detection retrieval and use CrowdStrike's pagination features to reduce the total number of API calls required for large detection datasets.
Pro Tips
- →Implement custom retry logic with exponential backoff in Integration Hub flows to handle transient API failures gracefully, and use the 'Wait' action with dynamic timing based on CrowdStrike's rate limit headers to optimize API call efficiency. Configure flow execution monitoring with automated alerting when consecutive failures exceed threshold values to ensure proactive issue resolution.
- →Create custom ServiceNow tables to store CrowdStrike-specific metadata like detection timelines, behavioral indicators, and parent-child process relationships that don't map directly to standard security incident fields. This approach preserves valuable forensic data while maintaining clean incident records and enables advanced threat hunting capabilities within ServiceNow.
- →Leverage ServiceNow's Event Management capabilities to create correlation rules that automatically escalate related security incidents when multiple CrowdStrike detections occur across similar systems or users within defined time windows. This reduces alert fatigue while ensuring that coordinated attacks or widespread infections receive appropriate priority and response.
- →Implement custom business rules that automatically populate incident impact and urgency based on CMDB relationships between affected endpoints and critical business services, enabling proper SLA application and stakeholder notification. Use ServiceNow's Impact Calculation Engine to dynamically assess business risk based on real-time asset criticality and service dependencies.
- →Configure Integration Hub connection pooling and implement circuit breaker patterns for CrowdStrike API calls to maintain integration stability during high-load periods or CrowdStrike service disruptions. Use ServiceNow's MID Server clustering for redundancy if processing large volumes of detection data or requiring high availability for threat response workflows.
- →Create custom Performance Analytics datasets that combine CrowdStrike detection metrics with ServiceNow incident response times to identify bottlenecks in security operations and measure the effectiveness of automated workflows. Use this data to continuously optimize detection-to-resolution timelines and justify security automation investments.
Known Limitations
- —CrowdStrike's API rate limiting of approximately 300 requests per minute per API client can become a bottleneck in large environments with high detection volumes, requiring careful flow scheduling and batch processing design. The rate limits apply globally to all API endpoints, so organizations must balance detection import frequency with other CrowdStrike integrations and manual API usage.
- —Real-time webhook delivery from CrowdStrike is not guaranteed and may experience delays during high-load periods, requiring organizations to maintain both webhook and scheduled polling mechanisms for critical detections. Webhook payload size limitations may truncate detailed forensic data for complex detections, necessitating additional API calls to retrieve complete detection context.
- —The Integration Hub Professional license is required for full CrowdStrike spoke functionality, and flow execution limits may restrict processing capacity in environments with thousands of daily detections. Organizations exceeding standard flow execution quotas will need to implement custom scripted solutions or upgrade to higher Integration Hub license tiers to maintain processing performance.
- —CrowdStrike's API does not support real-time streaming of detection updates, so status changes and analyst annotations made in the Falcon console require separate scheduled synchronization flows to reflect in ServiceNow incidents. This can create temporary data consistency issues between platforms during active incident response activities.
- —Host isolation and remediation actions through the Real Time Response API require devices to be online and connected to the CrowdStrike cloud, limiting the effectiveness of automated containment workflows for devices that are powered off or disconnected from the network. Additionally, some endpoint configurations or security policies may block RTR commands, requiring manual intervention for successful execution.
Frequently Asked Questions
Can I customize which CrowdStrike detection types create ServiceNow security incidents?
Yes, you can configure detection filtering in the Integration Hub flow by modifying the 'Get Detections' action parameters to specify severity thresholds, behavior types, or specific tactics and techniques. The CrowdStrike Falcon spoke allows filtering by detection status, confidence levels, and time ranges to control which detections trigger incident creation. You can also implement custom business rules in the flow to apply organization-specific criteria based on affected systems, user roles, or detection patterns before creating incidents.
How does the integration handle CrowdStrike detection updates and incident synchronization?
The integration primarily creates new incidents from CrowdStrike detections but requires separate flows to synchronize detection status updates and analyst comments back to ServiceNow incidents. You can create scheduled flows that check for detection status changes and update corresponding incident records using the detection_id as the correlation key. ServiceNow's built-in duplicate detection and update mechanisms help maintain data consistency, but real-time bidirectional synchronization requires custom development using both platforms' APIs.
What ServiceNow roles and permissions are required for users to manage CrowdStrike-related security incidents?
Users need the 'sn_si.admin' or 'sn_si.analyst' roles to manage security incidents created from CrowdStrike detections, along with appropriate CMDB read permissions to access device information. For executing host isolation workflows, users require custom roles that include access to Flow Designer execution and Integration Hub spoke actions. Security managers approving isolation requests need workflow approval permissions, while system administrators configuring the integration require 'admin' or 'integration_admin' roles for accessing Connection and Credential records.
Can the integration automatically create ServiceNow Change Requests for CrowdStrike remediation actions?
Yes, you can extend the integration to automatically create Change Requests when host isolation or remediation actions are required, using ServiceNow's Change Management workflows integrated with the CrowdStrike response processes. Configure Flow Designer workflows that trigger Change Request creation when security incidents reach specific states requiring system modifications. The Change Request can include pre-populated information about affected systems, required remediation steps, and business impact assessments based on CMDB relationships, ensuring proper change control while maintaining rapid threat response capabilities.
How can I monitor the health and performance of the CrowdStrike integration?
ServiceNow provides several monitoring capabilities including Integration Hub execution history, outbound HTTP request logs, and custom Event Management rules for integration failures. Create custom reports and dashboards that track detection processing times, API call success rates, and incident creation volumes to identify performance trends and bottlenecks. Configure automated alerting using ServiceNow's notification system to alert administrators when flows fail, API rate limits are approached, or authentication tokens near expiration, ensuring proactive maintenance and optimal integration performance.
What happens if the CrowdStrike API is temporarily unavailable during scheduled detection imports?
The Integration Hub automatically implements basic retry logic for failed API calls, but you should enhance this with custom error handling that includes exponential backoff and circuit breaker patterns for extended outages. Configure the flow to log detailed error information and trigger administrative alerts when consecutive failures exceed defined thresholds. Consider implementing a queuing mechanism that stores failed detection retrieval requests for reprocessing once connectivity is restored, ensuring that no critical detections are missed during service disruptions.
Can I integrate CrowdStrike Falcon X threat intelligence data with ServiceNow's Threat Intelligence application?
Yes, the CrowdStrike Falcon spoke includes actions for retrieving threat intelligence data including IOCs, actor information, and campaign details that can be imported into ServiceNow's Threat Intelligence tables. Create Integration Hub flows that periodically synchronize threat intelligence feeds and implement custom mapping logic to correlate CrowdStrike intelligence reports with internal threat data. You can also configure bidirectional sharing to push organization-specific IOCs from ServiceNow back to CrowdStrike for enhanced detection capabilities, creating a comprehensive threat intelligence sharing ecosystem between both platforms.
Test Your Knowledge
Quick 3-question quiz — see how your ServiceNow skills stack up.
A list view on a table with millions of records is slow. Best fix?
Select an answer to continue