Capabilities
Query Tools
Action Tools
Detection Ingestion
Hiro automatically polls CrowdStrike for new detections and ingests them into the detection queue with:- AI-generated summaries
- MITRE ATT&CK mapping
- Device, user, and process details
- Full raw detection data
Setup
Prerequisites
- CrowdStrike Falcon console access
- Ability to create API clients
Connection Steps
1
Create API credentials
In the CrowdStrike console:
- Go to Support > API Clients and Keys
- Click Add new API client
- Grant these scopes:
- Detections: Read
- Hosts: Read, Write
- Alerts: Read, Write
2
Copy credentials
Copy the Client ID and Client Secret.
3
Connect in Hiro
In Hiro, go to Settings > Integrations:
- Enter the Client ID
- Enter the Client Secret
- Enter the API base URL (e.g.,
https://api.crowdstrike.comor your regional URL) - Click Connect
Required API Scopes
Host Containment
Containment isolates a compromised endpoint from the network while maintaining the CrowdStrike cloud connection for remote response.What Containment Does
- Blocks all network traffic except to CrowdStrike cloud
- Prevents lateral movement
- Maintains remote management capability
- Does NOT affect local processes
Containment Workflow
Lifting Containment
When remediation is complete:Investigation Examples
Query detections
Check specific host
Correlate with identity
Detection Status Management
Update detection status as you investigate:Troubleshooting
”Authentication failed”
- Verify Client ID and Client Secret are correct
- Check that the API client is enabled in CrowdStrike
- Verify the base URL matches your CrowdStrike region
”Insufficient permissions”
The API client is missing required scopes. Create a new client with Detections (Read), Hosts (Read/Write), and Alerts (Read/Write).Containment failed
- The host may be offline
- The CrowdStrike agent may be outdated
- Check host status in the CrowdStrike console
Next Steps
Okta
Connect identity management.
AWS
Connect cloud infrastructure.