Add CrowdStrike integration docs

[misterpantz]

Description

Related issue

Types of changes

• Functional documentation bug fix (i.e., broken link or some other busted behavior)
• New functional doc capabilities (i.e., filter search results)
• New content
• Revision to existing content
• Chore (non-breaking change that does not add functionality or fix an issue)

Checklist

• I have read the README document about contributing to this repo.
• I have tested my changes locally and there are no issues.
• All commits are signed.

[github-actions]

Starting creation of the PREview environment...

[github-actions]

PREview environment has been created at https://mondoo-pre-docs-1970752374.storage.googleapis.com/docs/index.html
Please allow a few minutes for the environment to be fully deployed.

[github-actions]

PREview has been updated at https://mondoo-pre-docs-1970752374.storage.googleapis.com/docs/index.html

[github-actions]

PREview has been updated at https://mondoo-pre-docs-1970752374.storage.googleapis.com/docs/index.html

[github-actions]

PREview has been updated at https://mondoo-pre-docs-1970752374.storage.googleapis.com/docs/index.html

[charlesjohnson]

While creating an API client in CrowdStrike, the required scopes list as such:

In the Scopes table, check these boxes in the Read column to allow Mondoo to read data:

• Apps
• Detections
• Device content
• Device control policies
• Hosts
• Assets
• Vulnerabilities

While the other 6 are there, I don't see Assets as an available scope while creating the certificate, and I don't see that other clients have that scope.

[misterpantz]

@charlesjohnson I posted a question about this yesterday.
https://mondooteam.slack.com/archives/C07QLL59NN7/p1737501136501779

[misterpantz]

Here it is when @afiune and I went through the scopes. But I don't see it any more either. Does your integration work just fine without it?

[charlesjohnson]

Yeah, seems to work great.

[misterpantz]

Okay, thanks, then I'll remove it!

[github-actions]

PREview has been updated at https://mondoo-pre-docs-1970752374.storage.googleapis.com/docs/index.html

[afiune]

The Asset scope is a must have.

https://falcon.us-2.crowdstrike.com/documentation/page/a9df69ec/asset-management-apis

I don't know where did it go, we might need to reach out to @benr but without it, we can't discover applications installed in the assets.

[github-actions]

PREview has been updated at https://mondoo-pre-docs-1970752374.storage.googleapis.com/docs/index.html

[misterpantz]

@afiune and @charlesjohnson, Assets scope is back in, and I explained the Falcon Discover requirement.

[afiune]