MENU
When creating an API key, which scope should be selected to retrieve Identity Protection detection and incident information?
To retrieve identity-based detections and incident-related data using the CrowdStrike APIs, the API key must include the correct permission scope. According to the CCIS curriculum, the Identity Protection Detections scope is required to access identity-based detection and incident information through GraphQL.
This scope allows API queries to retrieve:
Identity-based detections
Associated incident metadata
Detection attributes such as severity, status, and related entities
Incident data in Falcon Identity Protection is derived from detections, making the Detections scope the authoritative permission set for this information. Without this scope, GraphQL queries related to identity detections and incidents will fail authorization.
The other scopes are either too narrow or unrelated to detection retrieval. Therefore, Option A is the correct and verified answer.