Crowdstrike to JSM Assets Integration Guide

This guide explains how to use OnLink to import Crowdstrike Falcon data into JSM Assets. It covers the Crowdstrike Falcon API connection, sample data, field mapping, validation, and optional query parameters.

Prerequisites

A JSM Assets schema and object type for the data you want to import.
OnLink installed and available from Manage your apps.
Crowdstrike Falcon API endpoints.
Permission in JSM Assets to configure data sources, mappings, and imports.
The Fleet API endpoint URL for the object type you plan to import.

1. Prepare Crowdstrike Falcon credentials

Before configuring OnLink, confirm that you have a OAUTH credentials to access Crowdstrike Falcon API endpoints. For Fleet authentication details, see https://developer.crowdstrike.com/api-reference/ .

2. Configure the OnLink data source

In OnLink, add an Assets Data Source.
Set Authentication Type to OAUTH
Provide client id and client secret.
Set Scope to Hosts: READ

3. Configure the API method

Use a GET request to retrieve records from the Crowdstrike Falcon API. For example, to fetch devices, configure the request as follows:
Crowdstrike Falcon requires two API calls - first one to fetch ids and second one to get the details of the hosts.

Set Method to GET.
Set URL to the Fleet API endpoint, for example: https://developer.crowdstrike.com/api-reference/collections/hosts/#querydevicesbyfilterscroll . The screenshot has a placeholder {api-url}. Replace with your actual hostname when configuring.
Set Response data path to resources.
Leave other settings at their defaults unless the endpoint requires query parameters.

GET /devices/queries/devices-scroll/v1

Pagination notes

Set Pagination to none

Configure the Asset import to fetch Devices

config:connection_name=Crowdstrike
config:detail_api=https://<base>/devices/entities/devices/v2
config:detail_api_method=post
config:detail_api_body={"ids": [{id}]}
config:detail_data_path=resources

Mapping	Purpose

Mapping	Purpose
`config:connection_name=Crowdstrike`	No need to set, select from the connection list.
`config:detail_api=<https://<base>>/devices/entities/devices/v2`	This the second API call to fetch details. You can use this to fetch devices, applications etc.
`config:detail_api_method=post`	Set to GET or POST depending on the API structure.
`config:detail_api_body={"ids": [{id}]}`	Usually is set to ids. Refer to documentation to set the parent name.
`config:detail_data_path=resources`	The response path name to parse to get ids

5. Configure the Assets import and mapping

After the connection is established, create the Assets import by following the JSM Assets Data Synchronization guide.

Use the fetched API sample to identify the Fleet JSON field names and map them to the corresponding JSM Assets attributes. The key: mapping should identify the stable unique value used to match and update existing Assets objects.

`key:hostname=cid`	Uses the hostname field as the unique correlation identifier (CID) for matching and identifying assets.
`map:hostname=Hostname`	Maps the source hostname value to the Hostname field.
`map:mac_address=MAC Address`	Maps the source MAC address value to the MAC Address field.
`map:os_product_name=OS Name`	Maps the source operating system product name to the OS Name field.
`map:os_version=OS Version`	Maps the source operating system version to the OS Version field.
`map:serial_number=Serial Number`	Maps the source serial number value to the Serial Number field.

Mapping guidance

Start with one unique key: mapping so OnLink can identify whether to create or update an Assets object.
Add map: entries for each Fleet field you want to store in Assets.
Compare the Fleet sample JSON with the Assets object type attributes before running an import.
If a value is nested in the JSON response, inspect the sample output carefully and use the field path supported by the OnLink mapping configuration.

6. Validate and run the import

Use Get Data to preview the data returned by Fleet.
Confirm that the sample records contain the expected fields and values.
Use Get Data to preview the data returned by Fleet.
Review object type mappings and attribute names for spelling and case consistency.
Run the import only after the previewed data and mapping are correct.