--- title: CrowdStrike Identity Protection slug: connectors/crowdstrike-identity-protection docTags: createdAt: 2026-06-09T16:29:37.298Z --- CrowdStrike Identity Protection provides advanced monitoring and protection of user identities against unauthorized access and threats. CrowdStrike Identity Protection is a robust platform designed to enhance identity threat detection and response. By integrating with Swimlane Turbine, this connector allows users to query identity protection data using GraphQL, providing a seamless way to access and analyze identity-related information. This integration empowers security teams to automate identity threat detection and response processes, improving efficiency and reducing the time to mitigate potential threats. ## Prerequisites Before you can use the CrowdStrike Identity Protection connector for Turbine, you'll need access to the CrowdStrike API. This requires the following: - OAuth2 authorization using the following parameters: - URL: The endpoint for accessing CrowdStrike's API services. - Client ID: A unique identifier for your application to authenticate with the API. - Client Secret: A secret key used in conjunction with the Client ID to authenticate. - Token URL: The URL where the OAuth2 token can be obtained. This Connector integrates exclusively with Identity Endpoint API provided by CrowdStrike. ## Capabilities This Connector provides the following capabilities: - Query Identity Protection ## Asset Setup The Connector requires the `oauth2_client_credential` ## Additional Documentation - [CrowdStrike Identity Protection Connector Documentation](https://docs.swimlane.com/connectors/crowdstrike-identity-protection) - [CrowdStrike Identity Protection API Documentation](https://falcon.crowdstrike.com/documentation/page/a2a7fc0e/crowdstrike-oauth2-based-apis) # Configurations ## Oauth 2.0 Client Credentials Authenticates using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token\_url | | string | Required | | client\_id | The client ID | string | Required | | client\_secret | The client secret. | string | Required | | audience | Permission scopes for this action. | string | Optional | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Query Identity Protection Query identity protection in CrowdStrike using GraphQL. Requires a JSON body with a query parameter. ### Endpoint - **URL:** `/identity-protection/combined/graphql/v1` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------------- | | `query` | string | Optional | Parameter for Query Identity Protection | ### Input Example `{"json_body":{"query":"{entities(roles:[BuiltinAdministratorRole] sortKey:PRIMARY_DISPLAY_NAME sortOrder:ASCENDING first:5) {nodes{primaryDisplayName secondaryDisplayName}}}"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ---------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | object | Response data | | `data.entities` | object | Response data | | `data.entities.nodes` | array | Response data | | `data.entities.nodes.file_name` | string | Response data | | `data.entities.nodes.file` | string | Response data | | `extensions` | object | Output field: extensions | | `extensions.runTime` | number | Time value | | `extensions.remainingPoints` | number | Output field: extensions.remainingPoints | | `extensions.reset` | number | Output field: extensions.reset | | `extensions.consumedPoints` | number | Output field: extensions.consumedPoints | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 16 Nov 2023 07:43:36 GMT","Content-Type":"application/json; charset=utf-8","Content-Length":"112","Connection":"keep-alive","Cache-Control":"no-cache","Content-Encoding":"gzip","Etag":"W/\"76-WxOjDDE1egxcFoFaOaRCMUbuHQ0\"","Expires":"Thu, 16 Nov 2023 07:43:35 GMT","Pragma":"no-cache","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Appliance-Date":"2023-11-16T07:43:36+00:...` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------ | | Cache-Control | Directives for caching mechanisms | no-cache | | Connection | HTTP response header: Connection | keep-alive | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | Content-Length | The length of the response body in bytes | 112 | | Content-Type | The media type of the resource | application/json; charset=utf-8 | | Date | The date and time at which the message was originated | Thu, 16 Nov 2023 07:43:36 GMT | | Etag | An identifier for a specific version of a resource | W/"76-WxOjDDE1egxcFoFaOaRCMUbuHQ0" | | Expires | The date/time after which the response is considered stale | Thu, 16 Nov 2023 07:43:35 GMT | | Pragma | HTTP response header: Pragma | no-cache | | Server | Information about the software used by the origin server | nginx | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains | | X-Appliance-Date | HTTP response header: X-Appliance-Date | 2023-11-16T07:43:36+00:00 | | X-Appliance-Id | HTTP response header: X-Appliance-Id | 38e4055c-061d-4ee4-a21f-ffefd648c15a | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | X-Cs-Region | HTTP response header: X-Cs-Region | us-1 | | X-Cs-Traceid | HTTP response header: X-Cs-Traceid | 1ea3951c-dbbd-4e62-8cd4-991c7c78c471 | | X-Dns-Prefetch-Control | HTTP response header: X-Dns-Prefetch-Control | off | | X-Download-Options | HTTP response header: X-Download-Options | noopen | | X-Frame-Options | HTTP response header: X-Frame-Options | SAMEORIGIN | | X-Powered-By | HTTP response header: X-Powered-By | Express | | X-Preempt-Version | HTTP response header: X-Preempt-Version | 5.58.56190 | | X-Ratelimit-Limit | The number of requests allowed in the current rate limit window | 6000 | | X-Ratelimit-Remaining | The number of requests remaining in the current rate limit window | 5998, 5999 | | X-Xss-Protection | HTTP response header: X-Xss-Protection | 1; mode=block |