---
title: CrowdStrike Falcon Endpoint Protection Actions
description: "## Actions for CrowdStrike Falcon Endpoint Protection - ***Send Data to CrowdStrike Falcon Endpoint Protection***. Sends a custom set of Lucidum data to CrowdStrike Falcon Endpoint Protection. ## Use Cases Below are the possible use cases for these actions: -…"
url: "https://lucidum.io/docs/crowdstrike-falcon-endpoint-protection-actions/"
updated: "2026-08-12"
category: Actions / List of Actions / C
---

# CrowdStrike Falcon Endpoint Protection Actions

## Actions for CrowdStrike Falcon Endpoint Protection

- ***Send Data to CrowdStrike Falcon Endpoint Protection***. Sends a custom set of Lucidum data to CrowdStrike Falcon Endpoint Protection.

## Use Cases

Below are the possible use cases for these actions:

- If you want to run Lucidum “headless”, you can send relevant data to CrowdStrike Falcon Endpoint Protection on a regular schedule.
- You can send normalized, enriched Lucidum data to CrowdStrike Falcon Endpoint Protection to be indexed, searched, and analyzed.

## Prerequisites

To execute CrowdStrike Falcon Endpoint Protection actions, you must:

- Configure a CrowdStrike Falcon Endpoint Protection API connection beforehand. The required parameters are described in the instructions for creating a CrowdStrike Falcon Endpoint Protection connector in Lucidum [https://lucidum.io/docs/crowdstrike-falcon-endpoint-protection-platform/](https://lucidum.io/docs/crowdstrike-falcon-endpoint-protection-platform/).

**NOTE**: The specified account should have **read and write**permissions.

## Workflows

- [Creating a new Configuration and a new Action](https://lucidum.io/docs/overview-of-actions#workflow_for_creating_configurations_and_actions_in_lucidum)
- [Cloning an Existing Action](https://lucidum.io/docs/overview-of-actions#workflow_using_clone_to_create_a_new_action)
- [Creating a new Action from the Location Results page](https://lucidum.io/docs/overview-of-actions#alternative_workflow_for_creating_an_action)
- [Editing a Configuration](https://lucidum.io/docs/overview-of-actions#workflow_for_editing_a_configuration)
- [Editing an Action](https://lucidum.io/docs/overview-of-actions#workflow_for_editing_an_action)
- [Viewing Information about an Action](https://lucidum.io/docs/overview-of-actions#viewing_information_about_an_existing_action_and_executing_an_action_on_demand)

## CrowdStrike Falcon Endpoint Protection Configuration

To create a configuration for CrowdStrike Falcon Endpoint Protection? actions:

![crowdstrike_falcon_endpoint_protection_configuration_2.png](https://lucidum.cloud/docs/crowdstrike_falcon_endpoint_protection_configuration_2.png)

- ***Configuration Name***. Identifier for the Configuration. This name will appear in the Lucidum Action Center.
- ***URL***. The URL for the CrowdStrike API. By default, this value is https://api.crowdstrike.com. Other possible values are:

  - For legacy CrowdStrike API: https://falconapi.crowdstrike.com.
  - Alternate URL for the current API: https://api.us-2.crowdstrike.com.
- ***Client ID***. For the current version of the CrowdStrike API, enter the API Client ID. For previous versions of the CrowdStrike API, enter the user name.
- ***API Secret***. For current versions of the CrowdStrike API, enter the API Secret. For previous versions of the CrowdStrike API, enter the user API Key.To test the configuration, click **Test**.
- ***Max # of Records per Payload***. The maximum number of records to send to CrowdStrike Falcon Endpoint Protection in each action. The default value is “50”.

## Create a New Action

To create an action for CrowdStrike Falcon Endpoint Protection, contact Lucidum customer care.