Configure Premium Threat Feed for CrowdStrike

The CrowdStrike feed enables users to ingest indicators, actors, reports, malware, vulnerabilities, and their associated context from the CrowdStrike Falcon Intelligence feed into TISC.

Before you begin

Role required: sn_sec_tisc.admin

Procedure

Navigate to Workspaces > Threat Intelligence Security Center > Integrations.
Select Custom.
On the CrowdStrike Feed form page, select Edit.

Note: By default, the CrowdStrike feed is disabled. Edit the configurations to enable the feed.

[Omitted image "tisc-crowdstrike-premium-feed.png"] Alt text: CrowdStrike-Premium feed
Select Details.
Enter the Client ID, and Client Secret.

Note:
1. Generate your Client ID and Client Secret if you don't have them. For more information on the Client ID and Client Secret, see Defining your first API Client section.
2. Get Client ID and Client Secret from CrowdStrike for required scopes. The following scopes are required for the Client ID and Client Secret from CrowdStrike:
  - Indicators (Falcon intelligence)
  - Actors (Falcon Intelligence)
  - Reports (Falcon Intelligence)
  - Malware Families (Falcon Intelligence)
  - Vulnerabilities (Falcon Intelligence)
Select Additional Settings to configure the filters to apply while ingesting indicators from CrowdStrike.

[Omitted image "tisc-crowdstrike-additional-settings.png"] Alt text: CrowdStrike additional settings tab

These filters allow you to customize the data integration process to meet your specific requirements, ensuring that only the most relevant information is included.
Select Edit Settings.
Select the required filters.

Note: All configured filters are applied together while ingesting indicators from CrowdStrike.

The following section provides a detailed explanation of each available option. Review each option in the following table to understand how filters optimize data ingestion.
Select the required values from the available filters.

Field	Description
Record types to ingest
Select record types to ingest	Select the record types that you want to ingest. The available record types are:- Indicators Reports Actors Malware Vulnerabilities Note: If you don't select a record type, all the record types are ingested.
Filters on indicator attributes
Include deleted indicators for ingestion	Select this check box to allow the ingestion of indicators that have been deleted.Note: Deleted indicators are created as observables only if they were previously ingested. A Deleted in CrowdStrike tag is added to indicators removed from CrowdStrike.
Indicator types to ingest	Select the specific CrowdStrike indicator types you want to ingest. If none are selected, all available indicators are retrieved by default.
Malicious confidence of indicators to ingest	Select the malicious confidence level of CrowdStrike indicators to ingest. If left blank, all indicators are fetched from CrowdStrike regardless of malicious confidence.
Targeted industries of indicators to ingest	Select the targeted industries associated with CrowdStrike indicators to ingest. If none are selected, all indicators are fetched from CrowdStrike regardless of targeted industry.
Filters on associated actors
Fetch indicators only if actors associated to it	Select this check box to fetch indicators only if they are associated with actors.
Ingest indicators only associated to these actors	Specify comma-separated actor names related to the indicators for ingestion. If not provided, all indicators are fetched from CrowdStrike regardless of associated actors.
Filters on associated reports
Fetch indicators only if reports associated to it	Select this check box to fetch indicators only if they are associated with reports.
Ingest indicators only associated to these reports	Enter comma-separated report names associated with the indicators for ingestion. If left blank, all reports are included in the ingestion process.If not provided, all indicators are fetched from CrowdStrike regardless of associated reports.
Filters on associated malware families
Fetch indicators only if malware families associated to it	Select this check box to fetch indicators only if they are associated with malware families.
Ingest indicators only associated to these malware families	Enter comma-separated malware family names associated with the indicators for ingestion. If left empty, all malware families are included in the ingestion process.If not provided, all indicators are fetched from CrowdStrike regardless of malware families.
Mapping of Indicator Malicious confidence to TISC confidenceNote: The High, Medium, Low, and Unverified values are the source value for malicious confidence received from CrowdStrike.
High	Enter a confidence value (0–100) for indicators with high malicious confidence. Note: If a matching malicious confidence mapping is found in the Additional Settings, it overrides the value provided in the Details section even if a confidence value is manually entered.
Medium	Enter a confidence value (0–100) for indicators with medium malicious confidence.
Low	Enter a confidence value (0–100) for indicators with low malicious confidence.
Unverified	Enter a confidence value (0–100) for indicators with unverified malicious confidence.

Field	Description
Filters on vulnerability attributes
Severity of vulnerabilities to ingest	Select the severities of CrowdStrike vulnerabilities to ingest. If left empty, all vulnerabilities are fetched regardless of severity.
Exploit status of vulnerabilities to ingest	Select the exploit statuses of CrowdStrike vulnerabilities to ingest. If left empty, all vulnerabilities are fetched regardless of exploit status.
CVSS v3 severity of vulnerabilities to ingest	Select the Common Vulnerability Scoring System (CVSS) v3 severities of CrowdStrike vulnerabilities to ingest. If left empty, all vulnerabilities are fetched regardless of CVSS v3 severity.
Minimum CVSS v3 base score	Enter the minimum CVSS v3 base score for ingestion, such as 9.5. Only vulnerabilities with a score above this value are ingested.
CVE IDs of vulnerabilities to ingest	Enter comma-separated CVE IDs to ingest. If left empty, all vulnerabilities are considered for ingestion.
Filters on published date
Fetch vulnerabilities published on or after	Select the date on or after which CVEs were published. Populate both date fields to ingest CVEs published within a date range.
Fetch vulnerabilities published on or before	Select the date on or before which CVEs were published. Populate both date fields to ingest CVEs published within a date range.
Filters on associated actors
Fetch vulnerabilities only if actors associated to it	Select this check box to ingest only the vulnerabilities that have associated actors.
Ingest vulnerabilities only associated to these actors	Enter comma-separated actor names. If left empty, all actors are considered for vulnerability ingestion.
Filters on associated threats
Fetch vulnerabilities only if threats associated to it	Select this check box to ingest only the vulnerabilities that have associated threats.
Ingest vulnerabilities only associated to these threats	Enter comma-separated threat names. If left empty, all threats are considered for vulnerability ingestion.Threats in CrowdStrike correspond to malware in TISC.
Filters on associated products
Fetch vulnerabilities only if products associated to it	Select this check box to ingest only the vulnerabilities that have associated products.
Ingest vulnerabilities only associated to these products	Enter comma-separated product names. If left empty, all products are considered for vulnerability ingestion.
Filters on associated vendors
Fetch vulnerabilities only if vendors associated to it	Select this check box to ingest only the vulnerabilities that have associated vendors.
Ingest vulnerabilities only associated to these vendors	Enter comma-separated vendor names. If left empty, all vendors are considered for vulnerability ingestion.

**Note:** With the same additional settings you have defined, you can duplicate the feed when creating a new one.

Select Update on the Additional Settings dialog box to save the modified additional settings.
Select Enable to enable CrowdStrike Feed for ingestion.

Note:
- When you enable the feed, its configuration fields are set to read-only and the Save button is hidden. To change the configuration, disable the feed first.
- The premium feed is the same as other feeds except the response that is parsed during configuration. A specific response is parsed to CrowdStrike by adding the Client ID and Client Secret. What type of data is fetched from CrowdStrike:
1. Indicators from CrowdStrike that are updated after the configured ingestion time and match the filters configured in additional settings. These indicators from CrowdStrike are then mapped to observables in TISC. The following indicator types are ingested in TISC:
  - SHA256 Hash
  - MD5 Hash
  - SHA1 Hash
  - URL
  - Domain
  - IP Address
  - Mutex Name
  - File Name
  - Email Address
  - Username
  - IP Address Block
2. Threat Actors from CrowdStrike that are updated after the configured ingestion time are mapped to Threat Actors in TISC.
3. Reports from CrowdStrike that are updated after the configured ingestion time are mapped to threat reports in TISC based on matching attributes.
4. Malwares from CrowdStrike that are updated after the configured ingestion time are mapped to malwares in TISC based on matching attributes.
5. Vulnerabilities from CrowdStrike that are updated after the configured ingestion time, are mapped to Vulnerabilities in TISC based on matching attributes.
6. Data is related based on the source CrowdStrike feed and ingestion. Relationships can be established when entities originate from:
  1. The same CrowdStrike feed and the same ingestions.
  2. The same CrowdStrike feed and different ingestions.
  3. Different CrowdStrike feeds. Note: Filters configured in Additional Settings are also applied when ingesting indicators associated with previously ingested indicators, reports, or actors.
Select Duplicate to duplicate the feed.

For more information, see Duplicate threat intelligence feeds.

System Properties for CrowdStrike
The following details the system properties for CrowdStrike.

Parent Topic:View Custom Feed

title	Configure Premium Threat Feed for CrowdStrike
description	The CrowdStrike feed enables users to ingest indicators, actors, reports, malware, vulnerabilities, and their associated context from the CrowdStrike Falcon Intelligence feed into TISC.
locale	en-US
canonical_url	https://www.servicenow.com/docs/r/security-management/threat-intelligence-security-center/premium-threat-feed-for-crowdstrike.html
release	brazil
product	Threat Intelligence Security Center
classification	threat-intelligence-security-center
topic_type	task
last_updated	2026-09-10
reading_time_minutes	7
keywords	CrowdStrike Premium FeedThreat feed configurationIndicator ingestionFalcon Intelligence feedFeed filteringThreat data ingestionCrowdStrike integration
breadcrumb	View Custom FeedView Threat Intel FeedsThreat Intelligence FeedsIntegrateThreat Intelligence Security CenterSecurity Operations