Source: https://sprinto-test.docs-staging.pageloop.ai/integrations/overview/crowdstrike-edr-integration

# CrowdStrike EDR Integration

Integrate CrowdStrike EDR with Sprinto to sync endpoint detection and response data and automate evidence collection for supported controls and checks.

Sprinto uses **Leen.dev** as its unified security API provider. Sprinto does not connect to CrowdStrike directly.

> [!INFO]
>
> #### Note
>
> Sprinto supports two separate CrowdStrike integrations: **CrowdStrike EDR** for endpoint detection and response, and **CrowdStrike Spotlight** for endpoint vulnerability scanning. This article covers CrowdStrike EDR.

### Prerequisites

Before you begin, make sure you have:

- Admin access to your CrowdStrike account.
- Read-only access configured for the API client.
- The following CrowdStrike credentials:
  - **Client ID**
  - **Client Secret**
  - **Base URL**
- A paid Sprinto plan.

The integration does not require write permissions.

### Permissions and data

Sprinto requires **Read Access** to your CrowdStrike EDR account.

The integration can sync:

- EDR-managed devices
- Threat alerts and detections
- Device groups
- Endpoint data

The integration supports automated evidence collection for **26 controls and 1 check**.

### Set up the integration

#### 1. Open the CrowdStrike EDR integration

1. Log in to your Sprinto dashboard.
2. Go to **Settings → Integrations**.
3. In the **All** tab, search for **CrowdStrike EDR**.
4. Click **Connect** next to CrowdStrike EDR.

![](/assets/45c107e91015-screenshot-2026-08-14-at-17.13.10.png)

#### 2. Review the integration requirements

A drawer opens with information about the integration.

Review the following sections:

- **Automate evidences for:** Shows the controls and checks supported by the integration.
- **Permission & Data:** Shows the required access and data Sprinto uses.
- **Additional Information:** Confirms that admin access to CrowdStrike EDR is required.

Click **Next**.

![](/assets/64e91c8f729f-screenshot-2026-08-14-at-17.33.26.png)

#### 3. Confirm admin access

The next drawer provides the setup instructions.

1. Select **I have admin access to CrowdStrike EDR**.
2. Click **Connect to CrowdStrike EDR**.

![](/assets/cd654dbbaaf9-screenshot-2026-08-14-at-17.33.57.png)

#### 4. Enter your CrowdStrike credentials

A pop-up opens where you need to enter:

- **Client ID:** Your CrowdStrike OAuth 2.0 Client ID.
- **Client Secret:** Your CrowdStrike OAuth 2.0 Client Secret.
- **Base URL:** The API base URL for your CrowdStrike cloud environment.

For instructions on creating the API client and retrieving these credentials, see [Leen's CrowdStrike documentation](https://docs.leen.dev/integrations/crowdstrike-credential).

> [!INFO]
>
> #### Note
>
> The Leen documentation covers the CrowdStrike credentials and read permissions required for its CrowdStrike connectors. Use the credentials generated for your CrowdStrike environment.

Enter the credentials in the corresponding fields and click **Create**.

![](/assets/1217823b4736-screenshot-2026-08-14-at-17.34.37.png)

Your CrowdStrike EDR integration is now connected.

### Post-connection flow

After successful authentication, Sprinto displays a confirmation.

Click **Close window** to complete the setup.

Once connected, Sprinto automatically syncs data from CrowdStrike through Leen.dev. The integration is read-only, so data flows from **CrowdStrike → Sprinto**.

Sprinto syncs data every **24 hours**.

The integration can retrieve:

- **Devices and hosts**
- **Device groups**
- **EDR alerts and detections**
- Endpoint-related security data

Leen's EDR connector supports listing and retrieving CrowdStrike EDR alerts, while its device connector supports CrowdStrike EDR devices and device groups. ([Leen.dev Unified API for Security](https://docs.leen.dev/integrations/endpoint-detection-response?utm_source=chatgpt.com))

### APIs used

Sprinto uses Leen.dev's unified security API to retrieve CrowdStrike data.

| Leen endpoint                    | Data                      |
| -------------------------------- | ------------------------- |
| `GET /v1/entities/device-groups` | Device and host groups    |
| `GET /v1/entities/devices`       | Hosts and endpoints       |
| `GET /v1/edr/alerts`             | EDR alerts and detections |
| `GET /v2/vulnerability_findings` | Vulnerability findings    |
| `GET /v2/resources`              | Resources                 |

Leen's documentation confirms that CrowdStrike EDR is supported for EDR alerts, devices, device groups, and related configuration data. ([Leen.dev Unified API for Security](https://docs.leen.dev/integrations/endpoint-detection-response?utm_source=chatgpt.com))

### Limitations

- The integration is **read-only**. Sprinto does not write data to CrowdStrike.
- Data is automatically synced every **24 hours**.
- A **paid Sprinto plan** is required.
- Only **one CrowdStrike EDR connection per organisation** is supported.
- CrowdStrike Spotlight is a separate integration and is not required for CrowdStrike EDR.

### Troubleshooting

#### Insufficient credentials or scopes

If the Leen connection test fails, verify that:

- You have admin access to CrowdStrike.
- The API client has the required read permissions.
- The Client ID and Client Secret are correct.
- The Base URL matches your CrowdStrike cloud environment.

#### Spotlight requirements

**Spotlight must be enabled only when using the CrowdStrike Spotlight integration.** It is not a prerequisite for CrowdStrike EDR.

#### Duplicate credentials error

If Sprinto displays a duplicate credentials error, the connection is treated as successful when the credentials already belong to an existing connection.

#### Data is not syncing

If data is not appearing in Sprinto, check that:

- The CrowdStrike API client is active.
- The required read permissions are still assigned.
- The Client Secret has not been regenerated.
- The connection is active in Sprinto.

[Leen's EDR integration documentation](https://docs.leen.dev/integrations/crowdstrike-credential) provides additional information about the CrowdStrike EDR connector and supported data.