name: CrowdStrike API FinOps
specification: FinOps Framework
specificationVersion: '1.0'
schema: https://www.finops.org/framework/
alignedWith:
  framework: FinOps Foundation Framework
  frameworkUrl: https://www.finops.org/framework/
  dataSpec: FOCUS
  dataSpecVersion: '1.3'
  dataSpecUrl: https://focus.finops.org/focus-specification/v1-3/
provider: CrowdStrike
providerId: crowdstrike
publisherName: CrowdStrike, Inc.
serviceCategory: Cybersecurity
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Cybersecurity
  - Endpoint Security
  - FinOps
  - Cost Management
  - FOCUS
description: 'FOCUS-aligned FinOps for CrowdStrike Falcon: per-device subscription bundles (Go / Pro /
  Enterprise / Complete) billed monthly or annually, with module add-ons for Identity, Cloud, and SIEM.'
sources:
  - https://www.crowdstrike.com/en-us/pricing/
principles:
  - name: Visibility
    description: Use the Falcon console host inventory and Subscription Management API to reconcile licensed
      device counts against deployed sensors; export billing line items via the customer support portal.
  - name: Allocation
    description: Tag hosts with business unit / environment via Falcon host groups and sensor grouping
      tags so per-device cost can be attributed to the consuming team.
  - name: Optimization
    description: Right-size bundles per device class (Go for SMB, Enterprise for high-risk endpoints);
      retire dormant sensors promptly since billing is per provisioned device, and prefer annual billing
      for the published discount.
  - name: Accountability
    description: Assign a security/IT budget owner who reviews monthly device counts, adds-on (Identity
      Threat Protection, Cloud Workload Protection), and triggers true-up at renewal.
domains:
  - name: Understand Usage and Cost
    capabilities:
      - Data Ingestion
      - Allocation
      - Reporting and Analytics
      - Anomaly Management
  - name: Quantify Business Value
    capabilities:
      - Planning and Estimating
      - Forecasting
      - Budgeting
      - Benchmarking
      - Unit Economics
  - name: Optimize Usage and Cost
    capabilities:
      - Rate Optimization
      - Workload Optimization
      - Licensing and SaaS
  - name: Manage the FinOps Practice
    capabilities:
      - FinOps Practice Operations
      - Invoicing and Chargeback
      - Onboarding Workloads
billingModel:
  pricingCategory: Tiered Subscription
  billingFrequency: Monthly
  billingCurrency: USD
  chargeCategories:
    - Usage
    - Purchase
    - Tax
    - Credit
    - Adjustment
  chargeFrequency: Recurring
focusColumns:
  ServiceName: CrowdStrike Falcon
  ServiceCategory: Cybersecurity
  ProviderName: CrowdStrike
  PublisherName: CrowdStrike, Inc.
  InvoiceIssuerName: CrowdStrike, Inc.
  PricingCategory: Subscription
  PricingUnit: device-month
  BillingCurrency: USD
  ChargeCategory: Usage
meters:
  - name: device_subscriptions
    description: Count of licensed Falcon-protected devices
    unit: device-month
    aggregation: sum
    dimensions:
      - bundle
      - billing_term
      - host_group
      - environment
  - name: module_addons
    description: Add-on modules layered onto a base bundle (Identity, Cloud Workload, LogScale, Discover)
    unit: module-month
    aggregation: sum
    dimensions:
      - module
      - bundle
  - name: managed_service
    description: Falcon Complete managed detection and response coverage
    unit: device-month
    aggregation: sum
    dimensions:
      - host_group
  - name: api_requests
    description: API calls against the Falcon OAuth2 APIs (not separately billed; observed for capacity)
    unit: request
    aggregation: sum
    dimensions:
      - api
      - endpoint
      - consumer
apis:
  - name: CrowdStrike API
    baseURL: https://api.crowdstrike.com
    tags:
      - Cybersecurity
      - Endpoint Security
    serviceName: CrowdStrike API
    serviceCategory: API
unitEconomics:
  - name: Cost per Protected Device
    metric: billed_cost / device_subscriptions
  - name: Cost per Detected Threat
    metric: billed_cost / detections
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com