Add CrowdStrike integration docs (#538)

* Add CrowdStrike integration docs

* crowdstrike screenshot files

* sneak in defender addition

* spelling expect CIDs

* Add final screenshots

* Add final screenshots

* Add final screenshots

* remove Assets scope because it seems to be gone

* put assets scope back in and clarify the need for Discover

Author: misterpantz

Diff for: .github/actions/spelling/expect.txt

@@ -66,6 +66,7 @@ cfee
 cfeed
 cgr
 chainguard
+CIDs
 cim
 classname
 clientid

Diff for: docs/platform/infra/imports/crowdstrike.mdx

@@ -0,0 +1,135 @@
+---
+title: Import Data from CrowdStrike Falcon Spotlight
+sidebar_label: CrowdStrike Falcon
+sidebar_position: 20
+description: Import data from CrowdStrike Falcon Spotlight to combine CrowdStrike data with your Mondoo security findings.
+image: /img/featured_img/mondoo-feature.jpg
+---
+
+Mondoo can import data from CrowdStrike Falcon Spotlight and incorporate that data with your findings. With a unified view of CrowdStrike's exposure management and Mondoo scan results, you can take advantage of Mondoo's powerful security visualization, prioritization, and ticket system integration.
+
+## Prerequisites
+
+Before you integrate CrowdStrike Falcon with Mondoo, be sure you have:
+
+- A Mondoo account with Editor or Owner permissions for the space in which you want to add the integration
+
+- Administrator access to a [CrowdStrike Falcon account](https://www.crowdstrike.com/platform/)
+
+- Falcon Spotlight exposure management enabled
+
+- Falcon Discover enabled (if you want Mondoo to collect information from CrowdStrike about software running on your assets)
+
+## Integrate Mondoo with CrowdStrike Falcon
+
+To create a new CrowdStrike Falcon integration in Mondoo, perform these steps:
+
+Step A: Create a CrowdStrike Falcon API client to give Mondoo access to CrowdStrike data
+
+Step B: Add a new CrowdStrike integration in the Mondoo Console
+
+### Step A: Create a CrowdStrike Falcon API client
+
+Like any service that integrates with CrowdStrike, Mondoo must have a CrowdStrike Falcon API client that gives it access to CrowdStrike data. To learn about API clients, read [CrowdStrike OAuth2-Based APIs](https://falcon.us-2.crowdstrike.com/documentation/page/a2a7fc0e/crowdstrike-oauth2-based-apis) in the Falcon documentation.
+
+1. Log into the Falcon console as a Falcon Administrator.
+
+   ![CrowdStrike Falcon menu](/img/platform/infra/imports/crowdstrike/cs-menu-client.png)
+
+2. In the left navigation, select **Support and resources**. Under **Resources and tools**, select **API clients and keys**.
+
+   ![CrowdStrike Falcon API clients](/img/platform/infra/imports/crowdstrike/cs-clients.png)
+
+3. Near the top-right corner, select the **Create API client** button.
+
+   ![CrowdStrike Falcon create API client](/img/platform/infra/imports/crowdstrike/cs-create-client.png)
+
+4. Give the new client a name that lets you know it's for Mondoo.
+
+5. In the **Scopes** table, check these boxes in the **Read** column to allow Mondoo to read data:
+
+   - Apps
+
+   - Detections
+
+   - Device content
+
+   - Device control policies
+
+   - Hosts
+
+   - Assets (only available if Falcon Discover is enabled for your CrowdStrike account)
+
+   - Vulnerabilities
+
+6. Select the **Create** button.
+
+   ![CrowdStrike Falcon new API client details](/img/platform/infra/imports/crowdstrike/cs-client-created.png)
+
+    CrowdStrike Falcon shows the API client details that you need to give Mondoo. Keep this page open in your browser as you continue to the next step.
+
+### Step B: Add a new CrowdStrike Falcon integration in the Mondoo Console
+
+After you've created your new API client, you can create a Mondoo CrowdStrike Falcon integration. You need information from the API client you created in the instructions above.
+
+1. Access the Integrations > Add > CrowdStrike page in one of two ways:
+
+   - New space setup: After creating a new Mondoo account or creating a new space, the initial setup guide welcomes you. Select **BROWSE INTEGRATIONS** and then select **CrowdStrike**.
+
+   ![Welcome to Mondoo Page](/img/platform/start/welcome_to_mondoo.png)
+
+   - INTEGRATIONS page: In the side navigation bar, under **INTEGRATIONS**, select **Add New Integration**. Under Third-Party Data, select **CrowdStrike**.
+
+   ![Add a CrowdStrike integration to Mondoo](/img/platform/infra/imports/crowdstrike/cs-int-top.png)
+
+2. In the **Choose an integration name** box, enter a name for the integration.
+
+3. In the **Provide the client ID** box, paste the client ID from the API client you created in the steps above.
+
+   ![Add a CrowdStrike integration to Mondoo](/img/platform/infra/imports/crowdstrike/cs-int-top.png)
+
+4. In the **Provide the secret** box, paste the secret from the API client you created in the steps above.
+
+5. In the **Provide the base URL** box, paste the base URL from the API client you created in the steps above.
+
+6. Nearly all Mondoo customers can leave the **Export data from a specific member CID** option disabled. In the unlikely event that the API client you created for Mondoo has access to multiple member CIDs, read the Multiple CrowdStrike Falcon CIDs section below. Enable **Export data from a specific member CID** and, in the **Provide the member CID** box, paste the member CID from which you want to import data.
+
+7. Select the **START IMPORTING** button.
+
+Mondoo begins connecting to CrowdStrike Falcon Spotlight and collecting data.
+
+### Multiple CrowdStrike CIDs
+
+A minority of CrowdStrike users, such as managed IT providers who handle security for multiple companies, have multiple CrowdStrike CIDs (customer identities). These are the only users who need to concern themselves with the **Configure member CID usage** section in when they create a new Mondoo CrowdStrike Falcon integration.
+
+If you were logged in as an administrator that manages multiple CIDs, then the CrowdStrike Falcon API client you created can provide access to data belonging to any of those CIDs. Mondoo lets you specify a single CID from which to import data.
+
+Get the CrowdStrike member CID from the CrowdStrike Falcon console:
+
+![CrowdStrike Falcon menu](/img/platform/infra/imports/crowdstrike/cs-menu-cid.png)
+
+1. In the left navigation, select **Host setup and management**. Under **Deploy**, select **Sensor downloads**.
+
+   ![CrowdStrike Falcon CID](/img/platform/infra/imports/crowdstrike/cs-cid.png)
+
+2. Under HOW TO INSTALL, select the copy icon beside the **Customer ID**. This is the value you paste in the Mondoo **Provide the member CID** box as described above.
+
+## View, edit, or remove a CrowdStrike Falcon integration
+
+1. In the left navigation, under **Integrations**, select **All Integrations**.
+
+2. Select CrowdStrike and then select the integration you want.
+
+   ![Mondoo CrowdStrike integration](/img/platform/infra/imports/crowdstrike/cs-view-int.png)
+
+3. Use the options in near the top-right corner of the page:
+
+   - To change the integration settings, select the edit (pencil) icon.
+
+   - To import data from CrowdStrike as soon as possible, select the **SCHEDULE NOW** button.
+
+   - To pause or resume importing data from CrowdStrike, select the ellipsis (...) menu and then select Pause Imports or Resume Imports.
+
+   - To remove the integration, select the delete (trash can) icon.
+
+---

Diff for: docs/platform/infra/imports/defender.mdx

@@ -1,7 +1,7 @@
 ---
 title: Import Data from Microsoft Defender for Cloud
 sidebar_label: Microsoft Defender for Cloud
-sidebar_position: 20
+sidebar_position: 30
 description: Import data from Microsoft Defender for Cloud to combine Defender data with your Mondoo security findings.
 image: /img/featured_img/mondoo-azure.jpg
 ---
@@ -236,4 +236,22 @@ After you've created and granted permissions to your new app registration, you c
 
 Mondoo begins connecting to Microsoft Defender for Cloud and collecting data.
 
+## View, edit, or remove a Microsoft Defender integration
+
+1. In the left navigation, under **Integrations**, select **All Integrations**.
+
+2. Select Microsoft Defender for Cloud and then select the integration you want.
+
+   ![Mondoo Microsoft Defender integration](/img/platform/infra/imports/defender/defender-int.png)
+
+3. Use the options in near the top-right corner of the page:
+
+   - To change the integration settings, select the edit (pencil) icon.
+
+   - To import data from Microsoft Defender as soon as possible, select the **SCHEDULE NOW** button.
+
+   - To pause or resume importing data from Microsoft Defender, select the ellipsis (...) menu and then select Pause Imports or Resume Imports.
+
+   - To remove the integration, select the delete (trash can) icon.
+
 ---