baton-crowdstrike

baton-crowdstrike

baton-crowdstrike is a connector for CrowdStrike built using the Baton SDK. It works with the CrowdStrike Falcon API to sync users, roles, identity risk scores, and shadow MCP servers, with provisioning support for account creation/deletion, role membership, and user profile updates.

Check out Baton to learn more about the project in general.

Prerequisites

The connector requires a client ID and secret to exchange for an access token that is used throughout communication with the API. To obtain these credentials, create an API client in CrowdStrike. You must be designated as a Falcon Administrator to create an API client (more info on obtaining access and creating clients here).

Required API Scopes

Getting Started

Along with credentials, you can specify the region to use. By default, the connector uses the us-1 region. Change this by setting BATON_REGION or passing the --region flag.

brew

brew install conductorone/baton/baton conductorone/baton/baton-crowdstrike

BATON_CROWDSTRIKE_CLIENT_ID=client_id BATON_CROWDSTRIKE_CLIENT_SECRET=client_secret baton-crowdstrike
baton resources

docker

docker run --rm -v $(pwd):/out -e BATON_CROWDSTRIKE_CLIENT_ID=client_id -e BATON_CROWDSTRIKE_CLIENT_SECRET=client_secret ghcr.io/conductorone/baton-crowdstrike:latest -f "/out/sync.c1z"
docker run --rm -v $(pwd):/out ghcr.io/conductorone/baton:latest -f "/out/sync.c1z" resources

source

go install github.com/conductorone/baton/cmd/baton@main
go install github.com/conductorone/baton-crowdstrike/cmd/baton-crowdstrike@main

BATON_CROWDSTRIKE_CLIENT_ID=client_id BATON_CROWDSTRIKE_CLIENT_SECRET=client_secret baton-crowdstrike
baton resources

Environment variables

export BATON_CROWDSTRIKE_CLIENT_ID="client_id"
export BATON_CROWDSTRIKE_CLIENT_SECRET="client_secret"
export BATON_REGION="us-1"

baton-crowdstrike
baton resources

Data Model

baton-crowdstrike syncs the following resources:

• Users (user) — Falcon console users; uuid is the stable resource ID and uid is the login/email
• Roles (role) — Falcon roles (e.g. falcon_administrator, falcon_analyst, falcon_read_only) with a member assignment entitlement
• Identity Risk Scores (security_insight) — Falcon Identity Protection risk scores (C1 opt-in capability)
• Shadow MCP Servers (mcp_server) — unsanctioned Model Context Protocol servers observed running on endpoints via EDR detections, correlated to the identity that ran them (C1 opt-in capability; enable together with endpoint_user so runner grants resolve)
• Endpoint Users (endpoint_user) — the endpoint OS users that ran a shadow MCP server, modeled as app accounts; each holds the runner grant on the servers it ran and is matched to a ConductorOne identity by email (or assigned manually) (C1 opt-in capability; enable together with mcp_server)
• AI Coding Tools (ai_tool) — AI harness inventory from EDR detections, correlated to identities (C1 opt-in capability)

Provisioning

Provisioning actions require the --provisioning (-p) flag and User Management: Write scope. Resource IDs (UUIDs) can be found via baton resources after a sync.

Create / delete a user account

# Create (idempotent: an existing uid/email returns AlreadyExists, not an error)
baton-crowdstrike -p \
  --create-account-login "jane.doe@example.com" \
  --create-account-profile '{"email":"jane.doe@example.com","first_name":"Jane","last_name":"Doe"}'

# Delete (hard delete; deleting an already-deleted user succeeds)
baton-crowdstrike -p \
  --delete-resource "<user-uuid>" --delete-resource-type user

Grant / revoke role membership

baton-crowdstrike -p \
  --grant-entitlement "role:falcon_read_only:member" \
  --grant-principal "<user-uuid>" --grant-principal-type user

baton-crowdstrike -p \
  --revoke-grant "role:falcon_read_only:member:user:<user-uuid>"

Update a user's first/last name

The connector exposes two profile-update actions: update_profile (resource-scoped, user_id is a ResourceId) and update_user (global, used by C1 push rules, with a user_profile JSON string). Omitted name fields are preserved.

# Resource-scoped action
baton-crowdstrike \
  --invoke-action update_profile --invoke-action-resource-type user \
  --invoke-action-args '{"user_id":{"resource_type_id":"user","resource_id":"<user-uuid>"},"first_name":"Caroline"}'

# Global action
baton-crowdstrike \
  --invoke-action update_user \
  --invoke-action-args '{"user_id":{"resource_type_id":"user","resource_id":"<user-uuid>"},"user_profile":"{\"first_name\":\"Caroline\"}"}'

Note: CrowdStrike's REST API has no disable/deactivate flag on the user object. When C1 deprovisions a user it revokes all of the user's role grants (soft deprovisioning); hard deletion of the account is permanent and only happens when an explicit delete is requested.

Local development

A mock of the CrowdStrike Falcon user-management API ships in test-server/. It lets you exercise the full sync and provisioning lifecycle without a real Falcon tenant:

# Terminal 1 — start the mock (writes ./test-server-cert.pem)
go run ./test-server

# Terminal 2 — point the connector at the mock
go build -o baton-crowdstrike ./cmd/baton-crowdstrike
export SSL_CERT_FILE="$PWD/test-server-cert.pem"
./baton-crowdstrike --crowdstrike-client-id test --crowdstrike-client-secret test \
  --base-url 127.0.0.1:8443 --sync-resource-types user,role

See test-server/README.md for seed data and all lifecycle commands, and docs/API/ for the Postman collection (it works against both the real Falcon API and the local mock — see the test-server README for the mock override values).

Documentation

• docs/docs-info.md — Setup guide: capabilities, credentials, resource reference, and API endpoint links
• docs/connector.mdx — Customer-facing setup documentation
• test-server/README.md — Mock API usage, seed data, and Postman collection

Security Insights

The connector can sync identity risk scores from CrowdStrike Identity Protection. This includes:

• Risk Score: A numerical score (0-1) indicating the identity's risk level
• Risk Factors: The factors contributing to the risk score (e.g. "WEAK_PASSWORD (HIGH)", "MFA_NOT_ENABLED (MEDIUM)")

To sync security insights, your CrowdStrike API client must have the Identity Protection Entities: Read and Identity Protection GraphQL: Write scopes enabled. The security_insight resource type is disabled by default and can be enabled through ConductorOne.

Shadow MCP Servers

The connector discovers unsanctioned ("shadow") Model Context Protocol servers running on managed endpoints and correlates each to the identity that ran it — surfacing ungoverned AI-agent tooling that never passed through a sanctioned gateway.

An MCP server is an ordinary npx / uvx / node / python process whose command line carries a recognizable package (@modelcontextprotocol/server-*, mcp-server-*, mcp_server_*) — the MCP signature. The connector reads CrowdStrike EDR detections (via the Alerts API), matches that signature, deduplicates by (host, endpoint user, server), and emits one mcp_server resource per instance with:

• an App-trait profile: server_name, package, launcher, transport, host, aid, local_ip, endpoint_user, sample_command_line, detection_count, ioa_rule, falcon_link, sanctioned (always false), plus first_seen when a detection timestamp is available and identity_email / identity_external_id / identity_display_name when the endpoint user resolves to an Identity Protection entity;
• a security-insight issue (always High) bound to that identity (AppUser target), so the finding flows into the identity's risk in ConductorOne.

Account & grant chain

Correlation is also modeled as a normal account/entitlement/grant chain, so a shadow MCP shows up against a real person in access reviews — not just as profile metadata:

• each shadow-MCP instance produces an endpoint_user account resource (the OS user that ran it), matched to a ConductorOne identity by email when the endpoint user resolves to an Identity Protection entity, or assignable manually otherwise;
• each mcp_server resource exposes a runner assignment entitlement, granted to the endpoint_user account that ran it.

The result is a c1 identity → endpoint_user account → runner grant → mcp_server chain, alongside the identity-risk security insight above.

To detect the servers natively, author a Custom IOA rule (Process Creation, Detect disposition) matching the command-line signature (@modelcontextprotocol/server-|mcp-server-|mcp_server_) so CrowdStrike raises a detection the connector can read. Endpoint users are resolved to identities via Identity Protection samAccountName (or email local-part). The mcp_server and endpoint_user resource types both require the Alerts: Read scope (plus the Identity Protection scopes above for correlation). Enable both capabilities in C1 so the runner grant graph resolves.

Inventory is a recent epp Alerts scan window (capped by page limits), not full historical state — high alert volume can shorten lookback and drop older detections from a later sync without a hard failure.

Contributing, Support and Issues

We started Baton because we were tired of taking screenshots and manually building spreadsheets. We welcome contributions, and ideas, no matter how small -- our goal is to make identity and permissions sprawl less painful for everyone. If you have questions, problems, or ideas: Please open a Github Issue!

See CONTRIBUTING.md for more details.

baton-crowdstrike Command Line Usage

baton-crowdstrike

Usage:
  baton-crowdstrike [flags]
  baton-crowdstrike [command]

Available Commands:
  capabilities       Get connector capabilities
  completion         Generate the autocompletion script for the specified shell
  config             Get the connector config schema
  health-check       Check the health of a running connector
  help               Help about any command

Flags:
      --crowdstrike-client-id string       required: The CrowdStrike client ID used to generate the access token. ($BATON_CROWDSTRIKE_CLIENT_ID)
      --crowdstrike-client-secret string   required: The CrowdStrike client secret used to generate the access token. ($BATON_CROWDSTRIKE_CLIENT_SECRET)
      --region string                      CrowdStrike region to connect to. Options include 'us-1', 'us-2', 'eu-1', and 'us-gov-1'. ($BATON_REGION) (default "us-1")
      --client-id string                   The client ID used to authenticate with ConductorOne ($BATON_CLIENT_ID)
      --client-secret string               The client secret used to authenticate with ConductorOne ($BATON_CLIENT_SECRET)
  -f, --file string                        The path to the c1z file to sync with ($BATON_FILE) (default "sync.c1z")
  -h, --help                               help for baton-crowdstrike
      --log-format string                  The output format for logs: json, console ($BATON_LOG_FORMAT) (default "json")
      --log-level string                   The log level: debug, info, warn, error ($BATON_LOG_LEVEL) (default "info")
  -p, --provisioning                       This must be set in order for provisioning actions to be enabled ($BATON_PROVISIONING)
      --skip-full-sync                     This must be set to skip a full sync ($BATON_SKIP_FULL_SYNC)
      --sync-resource-types strings        The resource type IDs to sync ($BATON_SYNC_RESOURCE_TYPES)
      --ticketing                          This must be set to enable ticketing support ($BATON_TICKETING)
  -v, --version                            version for baton-crowdstrike

Use "baton-crowdstrike [command] --help" for more information about a command.