CrowdStrike Falcon Intelligence

13 April 2026

Cohesity enables seamless integration with CrowdStrike Falcon Intelligence. This integration enhances the curated feed within the Cohesity Data Cloud by incorporating threat feeds from CrowdStrike into a single scan, resulting in improved fidelity and accuracy in threat detection.

With this integration, you can:

Enhance threat hunting - Identify known indicators of compromise (IOCs) in your data estate backed up on Cohesity using continuously curated and updated threat feeds, including custom IOCs derived from the automated analysis of threats taken from your endpoints.
Increase the efficiency of your response - Leverage your backups on Cohesity to uncover hidden threats across the potential incident timeline and hunt for additional systems that have been impacted.
Manage risk during recovery – Determine the presence of IOCs, file corruption, and other vulnerabilities before restoration, minimizing the risk of re-attack while streamlining the response and recovery process.

Prerequisites

Before you integrate CrowdStrike Falcon Intelligence with Cohesity, ensure that:

You have a valid CrowdStrike Falcon Intelligence Premium license (or higher).

In the CrowdStrike Falcon portal, create an API client with the following scope:

Scope	Permission
Indicators (Falcon Intelligence)	Read
Rules (Falcon Intelligence)	Read
IOC Management	Read
OCs (Indicators of Compromise)	Read

Copy the following details of the API client:
- Client ID
- Secret
- Base URL

Integrate with CrowdStrike Falcon Intelligence

To integrate with CrowdStrike Falcon Intelligence:

From the Security Center, select Integrations.
On the Integrations page, click Browse Integrations or the Browse Integrations tab.
Under the Threat Intelligence section, click Configure under the listed CrowdStrike Falcon Intelligence application.
On the CrowdStrike Falcon Intelligence dialog, enter the following details that you had copied for your API client and click Configure:
- Client ID
- Secret
- Base URL

The integration between CrowdStrike Falcon Intelligence and Cohesity is complete. Cohesity now retrieves the threat feeds from CrowdStrike, which you can use in the threat scans. Cohesity fetches threat feeds from CrowdStrike Falcon Intelligence daily.

Start Threat Scans Using Threat Feeds from CrowdStrike Falcon Intelligence

You can configure and initiate a threat detection scan from the Security Center using the threat feeds from CrowdStrike Falcon Intelligence after successfully integrating it with Cohesity.

If you are using a user with a custom role, make sure to assign the Integrate Third Party Threat Intelligence Feed privilege to the role.

Datasecurity Documentation