CrowdStrike Falcon software inventory for LICENSEWARE

CrowdStrike Falcon is an API integration. Connect it before you export a file.

In the Falcon console, open Support and resources, then API clients and keys, and add an API client. Copy the client ID and the secret. The secret is shown once.

Give the client read scopes only. The hosts collection uses Hosts: Read. Installed applications in Falcon Discover use Assets: Read, on the Discover collection.

1. Open Datasources from the sidebar and click CrowdStrike Falcon.
2. Click Connect. Documentation is at the top right of the source page.
3. Fill the required fields. Each one is marked with *.
   • Client ID
   • Client Secret
   • Cloud Region. Use us-1, us-2, eu-1 or us-gov-1.
4. Verify connection and Save credentials stay disabled until every required field is filled. Click Verify connection first, then Save credentials.

See Data sources for how to check a connection.

Export the software inventory from Falcon yourself and upload it to the SIM template.

CrowdStrike Falcon collects and stores device and application information across managed endpoints. The data comes from two places:

• Hosts (devices): hostname, device ID and platform.
• Installed applications (host apps): application name, version and vendor, as the Falcon sensor detects them.

You can export both from the CrowdStrike Falcon Console or through the Falcon REST API.

• Access to the CrowdStrike Falcon Console with the Device Inventory or Application Inventory modules enabled.
• Permission to generate and export inventory reports.
• Endpoints that are active and have recent sensor check-ins.

• Administrative access to CrowdStrike Falcon with permission to create API clients.
• An API client ID and client secret with at least read-only access to:
  • Device Inventory
  • Hosts
  • Host Applications
• PowerShell 5.1 or later, or an equivalent REST API tool such as curl or Postman.
• Internet access to the Falcon API endpoint, https://api.crowdstrike.com.

Use this for smaller environments or an ad-hoc export.

1. Log in to the CrowdStrike Falcon Console.
2. Go to Hosts → Device Inventory.
3. Apply filters to include all relevant devices.
4. Select a host and open the Applications tab. This needs Host Inventory visibility.
5. From the top-right menu, click Export → CSV.
6. Save the file as CrowdStrike_SIM_Export.csv.

Make sure the export includes these columns:

Use this for large environments or a scheduled export.

# Obtain OAuth2 access token
$BaseUrl = "https://api.crowdstrike.com"
$ClientId = "YOUR_CLIENT_ID"
$ClientSecret = "YOUR_CLIENT_SECRET"

$TokenResponse = Invoke-RestMethod -Method Post -Uri "$BaseUrl/oauth2/token" -Body @{
    client_id = $ClientId
    client_secret = $ClientSecret
}
$Token = $TokenResponse.access_token

# Retrieve device IDs
$Headers = @{ "Authorization" = "Bearer $Token" }
$DeviceIds = (Invoke-RestMethod -Uri "$BaseUrl/devices/queries/devices-scroll/v1" -Headers $Headers).resources

# Initialize export object
$ExportData = @()

foreach ($DeviceId in $DeviceIds) {
    $Apps = Invoke-RestMethod -Uri "$BaseUrl/devices/entities/installed-apps/v1?ids=$DeviceId" -Headers $Headers
    $Device = Invoke-RestMethod -Uri "$BaseUrl/devices/entities/devices/v1?ids=$DeviceId" -Headers $Headers
    $Hostname = $Device.resources[0].hostname

    foreach ($App in $Apps.resources) {
        $ExportData += [PSCustomObject]@{
            "Device Name"        = $Hostname
            "Software Name"      = $App.name
            "Software Version"   = $App.version
            "Software Publisher" = $App.vendor
        }
    }
}

# Export to CSV
$ExportPath = "C:\Exports\CrowdStrike_SIM_Export.csv"
$ExportData | Export-Csv -Path $ExportPath -NoTypeInformation -Encoding UTF8

Write-Host "Export complete: $ExportPath"

The script saves the file to the path you set in $ExportPath.

The CSV header row must be exactly Device Name,Software Name,Software Version,Software Publisher.

1. Open the Licenseware SIM Template.
2. Go to the Software Inventory tab.
3. Paste or import the CSV data.
4. Check that the columns line up:

Save the template, then upload it on the SIM - Template data source. See SIM template.

Device Name,Software Name,Software Version,Software Publisher
LAPTOP-001,Google Chrome,129.0.6668.90,Google LLC
SERVER-01,Microsoft SQL Server 2022,16.0.432,Microsoft Corporation
LAPTOP-002,Slack,4.39.95,Slack Technologies
LAPTOP-003,Adobe Acrobat DC,24.002.20933,Adobe Inc.