SeatReaper reads every Falcon host and when it was last seen, across your Flight Control child CIDs. It never changes hosts, policies or detections.
Create an API client
- Sign in to the Falcon console. With Flight Control, use the parent CID.
- Open Support and resources > API clients and keys and choose Create API client.
- Give it read-only scopes: Hosts: Read, and Flight Control: Read if you manage child CIDs.
- Copy the client ID and secret. The secret is shown once.
Note your cloud from the console address: falcon.crowdstrike.com is US-1, falcon.us-2.crowdstrike.com is US-2, falcon.eu-1.crowdstrike.com is EU-1, and falcon.laggar.gcw.crowdstrike.com is US-GOV-1.
Connect
An owner opens Settings > Integrations > CrowdStrike Falcon, chooses the cloud, pastes the client ID and secret, and chooses Connect CrowdStrike. SeatReaper signs in to check them, saves them encrypted, and runs the first sync. After that it syncs every day, and Sync now checks at any time.
How hosts are linked to clients
- With Flight Control, each child CID is linked to the client with the same name (ignoring capitals, punctuation and endings like Inc or LLC), or to the client an owner or tech picks under CrowdStrike CIDs. A picked link is kept on every sync.
- A host in a CID that is not linked still links to a client when exactly one client has a device with the same name in N-central, Datto RMM or Cove, or in a NinjaOne organization linked to a client. This is how a single CID shared by all your clients works too.
What SeatReaper does with it
- Dead devices: a host not seen for the device threshold (60 days unless you change it) is flagged, but only if every other tool it appears in also considers it dead. One item lists every tool still billing. See What SeatReaper flags.
- Offboarding: Falcon hosts appear in the device list when you offboard someone, and are confirmed once they leave Falcon.
- Prices: set your monthly cost per protected device in the price book.
Disconnect
An owner chooses Disconnect on the card. SeatReaper deletes the CIDs and hosts it synced. Delete the API client in Falcon to revoke access completely.
In compliance reports
On Growth and Pro, CrowdStrike Falcon is one of the EDR tools in the Device inventory and gaps report in the compliance evidence reports. A device another tool has seen recently but no EDR tool knows about is listed as missing EDR.