Overview
The CrowdStrike context connector builds a picture of your devices, user accounts, and login activity into Torq's organizational Context Graph. This gives Torq the context it needs to enrich alerts, support investigations, and power the Context Graph page.
Key benefits
Simplified setup: Configure ingestion through a guided UI, no custom polling workflows or API logic required.
Richer triage: Auto Triage uses the context graph to enrich alerts with device ownership, user roles, group memberships, and access, helping analysts judge severity faster.
Flexible scoping: Ingest only the data streams relevant to your Falcon license and use case.
Built-in reliability: Pagination, state tracking, and error handling are managed automatically to ensure consistent data delivery.
This is a context and enrichment connector; it builds a picture of your users, devices, and access into Torq's organizational Context Graph. It does not route alerts or events into Torq for triage. Detection routing is handled by the CrowdStrike Streaming.
Common scenarios
The same Context Graph powers multiple use cases, regardless of which vendors are connected.
Improving alert triage with organizational context
When an alert involves a user or device, Auto Triage enriches it with context from the Context Graph, including identity, role, group memberships, device ownership, management status, and access privileges. This context is incorporated into the triage verdict and displayed in the alert's Context Graph section, helping analysts assess risk more quickly. For example, an alert involving a privileged user on an unmanaged device may warrant a different response than one involving a standard user on a managed corporate device.
Investigating entities and relationships
The Context Graph page is where analysts can explore users, devices, accounts, and their relationships without switching between vendor consoles. Common questions include:
Who owns this device, and is it managed?
Which groups and applications does this user belong to?
What resources can this account access?
How are these entities connected?
By centralizing organizational context, the Context Graph enables faster investigations and more informed security decisions.
Prerequisites
Before setting up the CrowdStrike context connector, ensure the following:
CrowdStrike subscription:
EDR device inventory: Available on all paid Falcon tiers via the Hosts API.
Extended discovery (org-wide hosts, user accounts, logins, installed software): Requires the Falcon Discover SKU. Without it, Discover endpoints are skipped automatically and only EDR device data is ingested.
API client: Create an API client in the Falcon console prior to configuration.
API scopes: The API client must be granted the following scopes:
Hosts: Read, EDR device inventory
Falcon Discover: Read, org-wide hosts, user accounts, login events, and installed software (requires Falcon Discover license)
Assets: Read: discovered applications, managed and unmanaged assets, and account details across the environment.
The four Falcon Discover streams require the Falcon Discover SKU. Customers without the Discover license will only have the EDR device inventory (Hosts API) ingested. Discover endpoints return access errors and are skipped automatically.
How to use
Create a CrowdStrike API client
Log in: Go to your Falcon console and log in with an admin account.
Navigate to API clients: Go to Support and resources > API Clients and Keys and click Create API client.
Name the client: Give it a unique and meaningful name (e.g., Torq Integration).
Assign scopes: Enable the following permissions:
Hosts: Read
Falcon Discover: Read (if you have the Falcon Discover license)
Assets: Read
Save and copy credentials: Click Add. Copy the Client ID, Client Secret and the Base URL; the secret is shown only once and cannot be retrieved later.
Set up a context connector instance in Torq
Open connector setup: Go to Integrations > Context Graph > CrowdStrike Context Connector and click Add Instance.
Configure connection details:
Name: Enter a descriptive name for the connector instance.
Client ID: Enter your API client ID.
Client Secret: Enter your API client secret.
Base URL: Enter the API base URL for your CrowdStrike region:
Region | Base URL |
US-1 |
|
US-2 |
|
EU-1 |
|
US Gov |
|
To find your region, check the URL in your browser after logging into the Falcon console.
Token URL: The OAuth 2.0 token endpoint URL. This is the server address where access tokens are issued in exchange for authorization credentials.
3. Save configuration: Click Add to create the connector. Ingestion starts
automatically.
You've successfully set up the CrowdStrike context connector in Torq. With the instance configured, Torq will continuously ingest device inventory, user accounts, and login activity into the Context Graph. This context is available immediately for alert enrichment in Auto Triage and for investigation in the Context Graph page.