Integrate with Britive
Overview
With the Falcon API client created and the scripts uploaded, this guide connects the two platforms. At the end, Britive knows which devices exist, which accounts were last seen on them, and which scripts it can call.
Before You Begin
- EPM enabled on your Britive tenant. If System Admin has no Endpoint Privilege Management entry, it has not been enabled — contact Customer Success.
- Britive administrator privileges.
- The Client ID, client secret, and API URL from Configure CrowdStrike.
- Your elevation scripts already uploaded to Falcon.
Steps
Open Endpoint Privilege Management
Sign in to Britive as an administrator and go to System Admin → Endpoint Privilege Management.
Start a new integration
Select New Integration, then the + button on the CrowdStrike Falcon tile.
Fill in the Application tab
| Field | Value |
|---|---|
| Application Name | A name that identifies this Falcon tenant |
| Application Description | Free text |
| Account Mapping | The Britive identity attribute holding the user’s local account name |
| Device Mapping | The Britive identity attribute holding the device ID |
Both mapping fields are optional. They exist to map identities to accounts and devices automatically during a scan. Leave them empty and you map by hand from the Data tab instead.
Choose a device mapping attribute that holds the device ID, not a hostname. One user can be mapped to many devices; only one user can be mapped to a given account.
The Account Mapping value is passed to the elevation script. Choose an attribute holding the account name as the endpoint knows it — sAMAccountName on Windows, the local short name on macOS.
A UPN (jdoe@contoso.com) is a common choice and will not resolve. On a domain-joined Windows host the reference script builds contoso.com\jdoe@contoso.com and exits with ERROR: Could not resolve account; on macOS id jdoe@contoso.com fails outright. If your identities only carry a UPN, adapt the resolver in the elevation scripts to strip the suffix.
Select Next.
Fill in the Settings tab
| Field | Value |
|---|---|
| Login URL | The API URL from your Falcon API client |
| Client ID | From your Falcon API client |
| Client Secret | From your Falcon API client |
| Filter for devices | Optional. Falcon Query Language, restricting which devices are scanned |
| Scan login history for accounts | Off scans only the last logged-in user per device. On scans login history |
| Maximum session duration for profiles | The ceiling for how long any profile on this integration can stay checked out |
The device filter uses Falcon Query Language. Setting one is worth doing on a first rollout — scanning a pilot group is far easier to reason about than scanning every endpoint in the estate.
Scan login history for accounts changes how much you discover. With it off, a shared or rotating machine only ever reports whoever used it last, and other users of that machine will not appear as mappable accounts.
Save and test
Select Save and Test. Britive authenticates to Falcon with the credentials you supplied and reports success or the error it hit. Correct and retry until it succeeds — nothing downstream works until this passes.
Run the first scan
Open the Scans tab and select Scan. Britive queries Falcon for devices, accounts, and available scripts.
Review what was discovered
Open the Data tab and check all three:
| Sub-tab | What to confirm |
|---|---|
| Devices | Your target endpoints are listed. If a filter is set, only matching devices appear |
| Accounts | The last logged-in users, or full login history if you enabled it |
| Permissions | Your uploaded grant and revoke scripts are listed |
Map identities
If you did not configure automatic mapping, map by hand now. On Accounts or Devices, use Map/Unmap in the Actions column to connect a Britive identity.
Use View Details on a device to see everything Britive holds about it.
Verify
The integration is correctly connected when all of these are true:
- Save and Test returned success.
- The Devices sub-tab lists your target endpoints.
- The Permissions sub-tab lists both the grant and the revoke script.
- At least one identity is mapped to an account and a device.
If Permissions is empty but devices are listed, the connection works and script discovery does not — check the Real Time Response Admin: Write scope on the API client. This affects discovery only; elevation itself does not need that scope, so you can proceed and name the scripts manually on the profile instead.
Troubleshoot
| Symptom | Likely cause | Fix |
|---|---|---|
| No Endpoint Privilege Management under System Admin | EPM is not enabled on the tenant | Contact Britive Customer Success |
| Save and Test fails on credentials | Wrong Client ID or secret, or the secret was regenerated | Re-copy from Falcon; the secret is shown only once at creation |
| Save and Test fails on the URL | Wrong regional base URL | Use the API URL shown for your Falcon cloud, not another region’s |
| Scan returns no devices | The device filter matches nothing | Clear the filter and re-scan, then reintroduce it |
| Devices found, no accounts | No login history available for those endpoints | Enable Scan login history for accounts and re-scan |
| Permissions sub-tab empty | API client missing Real Time Response Admin: Write | Add the scope and re-scan, or enter script names with Type Manually on the profile |
| An identity cannot be mapped to an account | That account is already mapped to another identity | Only one identity may map to an account; unmap the other first |
Elevation fails with Could not resolve account | Account Mapping passes a UPN, which the scripts do not accept | Map to sAMAccountName or the local short name, or adapt the script resolver |