Import CrowdStrike Falcon Data into Jira Service Management Assets

This guide covers how to connect Crowdstrike Falcon to Assets in Jira Service Management.

CrowdStrike Falcon API connection

CrowdStrike exposes Falcon data through a REST API secured with OAuth2 client credentials. Full reference: developer.crowdstrike.com/api-reference.

Create an API client

1. In the Falcon console, go to Support and resources → API clients and keys.
2. Click Create API client and give it a clear name, e.g. OnLink – JSM Assets.
3. Grant read-only scopes for the data you want to import:
   
   • Hosts: READ – managed devices with a Falcon sensor
   • Assets: READ – optional, for Falcon Discover applications, unmanaged hosts, and accounts
4. Save the Client ID and Client Secret. The secret is shown only once.

Pick your base URL

Your API base URL depends on the cloud your Falcon tenant runs in:

The access token is issued from POST {base}/oauth2/token. OnLink handles the token exchange and refresh for you.

How Falcon returns host data

Falcon uses a two-step pattern:

1. A query endpoint returns device IDs matching a filter: GET /devices/queries/devices-scroll/v1
2. An entities endpoint returns full details for those IDs: POST /devices/entities/devices/v2 with body {"ids": [...]}

OnLink supports this pattern natively, which you’ll see in the configuration below.

Configuration in OnLink

Before you start, make sure you have:

• A JSM Assets schema with an object type for devices (e.g. Computers or Endpoints)
• OnLink installed from the Atlassian Marketplace (available under Manage your apps)
• Permission in JSM Assets to configure data sources, mappings, and imports
• The Falcon Client ID and Client Secret from step 1

Step 1 – Add the data source

1. In OnLink, add an Assets Data Source.
2. Set Authentication Type to OAUTH.
3. Enter the Client ID and Client Secret.
4. Set Scope to Hosts: READ.

Step 2 – Configure the API method (fetch device IDs)

1. Method: GET
2. URL: https://{your-base-url}/devices/queries/devices-scroll/v1
3. Response data path: resources
4. Pagination: None
5. Leave other settings at their defaults unless you want to add query parameters (see FAQ).

Step 3 – Configure the detail call (fetch device details)

In the Assets import, add these config lines so OnLink takes each batch of IDs and fetches full host records:

config:connection_name=Crowdstrike
config:detail_api=https://{your-base-url}/devices/entities/devices/v2
config:detail_api_method=post
config:detail_api_body={"ids": [{id}]}
config:detail_data_path=resources

Asset field mapping

Use Get Data in OnLink to preview a sample of the Falcon response, then map the JSON fields to your Assets attributes.

key:device_id=Device ID
map:hostname=Hostname
map:mac_address=MAC Address
map:os_product_name=OS Name
map:os_version=OS Version
map:serial_number=Serial Number

Other useful fields to consider: local_ip, external_ip, platform_name, system_manufacturer, system_product_name, agent_version, last_seen, status, and tags.

Mapping tips

• Start with one key: mapping. It’s what keeps re-imports from creating duplicates.
• Compare the sample JSON against your object type’s attributes before running the first import. Attribute names are case sensitive.
• For nested values, inspect the sample output and use the field path OnLink supports.
• Run the import once manually, review the objects, then turn on the schedule.

Full import walkthrough: JSM Assets Data Synchronization. Step-by-step guide for this integration: CrowdStrike to JSM Assets.

Why use OnLink for Crowdstrike to Assets?

You could write a script against the Falcon API. Then you’d need somewhere to run it, a way to rotate secrets, retry logic for rate limits, and someone to fix it when a field changes. OnLink takes that off your plate.

• Native Forge app, nothing on-premise. OnLink runs on Atlassian Forge, inside Atlassian’s cloud. No servers, agents, or middleware to install or patch.
• Pagination, error handling, retries, and scheduling built in. The integration framework handles these, so you configure an import once and let it run.
• Configurable API methods. Import devices, applications, hosts, or any other data object the Falcon API exposes by pointing OnLink at the right endpoint.
• Query parameter support. Pass FQL filters, pagination limits, sort order, and other parameters to import only what you need.
• Reusable connection templates. Save a connection as a template and reuse it, e.g. one for your Falcon sandbox and one for production.

Try it

If you’re running JSM Assets and CrowdStrike Falcon, you can have endpoint data flowing into your CMDB today.

Try OnLink on the Atlassian Marketplace → and follow the CrowdStrike to JSM Assets guide. Need help with your schema or mappings? Talk to the Onward team.

Crowstrike to Assets FAQ

1. Which CrowdStrike API scopes does OnLink need? Read-only access is enough. Use Hosts: READ for managed devices. Add Assets: READ if you also want Falcon Discover data such as installed applications, unmanaged hosts, or accounts. OnLink doesn’t need any write scopes.

2. Can I import only some devices, e.g. Windows servers or one host group? Yes. Add an FQL filter query parameter to the query call. For example, filter=platform_name:'Windows'+product_type_desc:'Server' imports only Windows servers. You can also use sort and limit to control the order and batch size.

3. How does OnLink avoid creating duplicate assets? The key: mapping. OnLink matches each incoming record on the key attribute (we recommend Falcon’s device_id). If a matching object exists it’s updated; if not, a new one is created.

4. Can I import installed applications as well as devices? Yes. With the Assets: READ scope, point the query call at /discover/queries/applications/v1 and the detail call at /discover/entities/applications/v1, then map the application fields to an Applications object type. You can link applications to devices using an object reference attribute.

5. How often does the data sync, and what happens if the API is unavailable? You set the schedule in OnLink (hourly, daily, or whatever suits your environment). If Falcon returns an error or rate-limits a request, OnLink’s framework retries automatically and logs the result, so a temporary outage doesn’t leave you with a half-finished import