CrowdStrike Falcon

runZero imports CrowdStrike data through the CrowdStrike Falcon API to sync and enrich your asset inventory, pull vulnerability data from Falcon Spotlight, and pull software data from Falcon Discover. With CrowdStrike data in runZero, finding endpoints that are missing an EDR agent takes one query.

Getting started

To set up the CrowdStrike integration, you’ll need to:

Configure CrowdStrike to allow API access to runZero.
Add the CrowdStrike credentials to runZero: the client ID, the client secret, and the CrowdStrike base API URL.
Choose whether to run the integration as a scan probe or connector task.
Activate the CrowdStrike integration to sync your data with runZero.

Requirements

Before you set up the CrowdStrike integration:

Make sure you have access to the CrowdStrike admin portal.

Step 1: Configure CrowdStrike to allow API access to runZero

Sign in to CrowdStrike.
Go to Support > API Clients and Keys. When the API Key page appears, add a new API client.
Fill in the API client details:
- For Client name, enter a name such as runZero.
- For API scope, choose the permissions for the data you want to ingest:
  - To ingest host details, include read permissions for Hosts and Host Groups.
  - To ingest vulnerability data, include read permissions for Vulnerabilities.
  - To ingest software data, include read permissions for Assets.
Add the client. A window confirms the API client was created and shows the client ID and client secret. You’ll need both to configure the integration in runZero.
Copy the client ID and client secret now. You may not be able to get them later.

Step 2: Add the CrowdStrike credentials to runZero

Go to the Credentials page in runZero. Give the credentials a name, like CrowdStrike Falcon.
Choose CrowdStrike Falcon API key from the list of credential types.
Fill in the connection details:
- For CrowdStrike client ID and CrowdStrike client secret, enter the pair you generated under Support > API Clients and Keys > OAuth2 API clients > Add new API Client in your CrowdStrike portal.
- For CrowdStrike API URL, enter your organization’s base URL. It depends on your account type, and the CrowdStrike API Swagger documentation lists it.
  - For a US-1 account, use api.crowdstrike.com
  - For a US-2 account, use api.us-2.crowdstrike.com
  - For a US-GOV-1 account, use api.laggar.gcw.crowdstrike.com
  - For an EU-1 account, use api.eu-1.crowdstrike.com
To let other organizations use these credentials, select Make this a global credential. Otherwise, you can configure access per organization.
Save the credentials.

Step 3: Choose how to configure the CrowdStrike integration

You can run the CrowdStrike integration as either a scan probe or a connector task. A scan probe gathers integration data during a scan task. A connector task runs on its own, from the cloud or from one of your Explorers, and performs only the integration sync.

Step 4: Set up and activate the CrowdStrike integration to sync data

With your CrowdStrike credential saved, set up a connector task or scan probe to sync your data.

Step 4a: Configure the CrowdStrike integration as a connector task

A connection needs a schedule and a site. The schedule sets when the sync runs, and the site is where runZero creates any new CrowdStrike-only assets.

Activate a connection to CrowdStrike. You can reach every available third-party connection from the integrations page, your inventory, or the tasks page.
Choose the credential you added earlier. If it isn’t listed, check that it has access to the organization you’re currently in.
Set the severity and risk levels you want to import (optional).
Set the Fingerprint only toggle to Yes to ingest vulnerability records for fingerprint analysis without storing them in your runZero vulnerability inventory (optional).
Add a filter for imported assets (optional).

If the CrowdStrike API key has access to Falcon Discover or Falcon Spotlight, runZero imports software and vulnerability data only for the assets in the filtered results.

6. Enter a name for the task, like `CrowdStrike sync` (optional). 7. Choose the Explorer that runs this connector task (optional). 8. Choose the site for your assets. runZero stores all newly discovered assets in this site. 9. Enter a description for the task (optional). 10. To leave out assets that runZero has not scanned, switch the _Exclude unknown assets_ toggle to _Yes_. By default, the integration includes assets runZero has not scanned. 11. Schedule the sync to run once or on a recurring schedule. It starts on the date and time you set. 12. Activate the connection when you're done. The sync runs on the schedule you defined, and [Scheduled tasks](https://console.runzero.com/tasks) shows when the next sync will occur.

Step 4b: Configure the CrowdStrike integration as a scan probe

Create a new scan task, or select a future or recurring scan task from your Tasks page.
Add or update the scan parameters to fit any additional requirements.
On the Probes and SNMP tab, choose which additional probes to include, set the CrowdStrike toggle to Yes, and change any default options if needed.
On the Credentials tab, set the CrowdStrike toggle to Yes for the credential you want to use.
Click Initialize scan to save the scan task. It runs immediately or at the scheduled time.

Step 5: View CrowdStrike assets and vulnerabilities

After a successful sync, go to your inventory to view your CrowdStrike assets and vulnerabilities. They show a CrowdStrike icon in the Source column.

To filter by CrowdStrike attributes, try these queries:

View all CrowdStrike assets
```
source:crowdstrike
```
Find assets that have a CrowdStrike EDR agent installed
```
edr.name:crowdstrike  
```
Find Windows assets, excluding servers, that are missing a CrowdStrike EDR agent
```
os:windows and not type:server and not edr.name:CrowdStrike
```
View all CrowdStrike vulnerabilities
```
source:crowdstrike
```
View all CrowdStrike software results
```
source:crowdstrike
```

Click into an asset or vulnerability to see its individual attributes. runZero shows the attributes the CrowdStrike API returned, except policies. If missing EDR agents are what you’re after, continue with the Finding gaps in endpoint protection playbook.

Filtering CrowdStrike assets

You can add a filter to CrowdStrike integration tasks. runZero filters with CrowdStrike’s Falcon Query Language (FQL), which follows the syntax <property>:[operator]<value>. Combine expressions with a + between them for more complex filters, or separate them with commas for an OR expression.

Properties

These CrowdStrike properties are useful in FQL filters. CrowdStrike’s API documentation lists the other attributes you can filter on.

CrowdStrike Property	runZero Attribute	Description	Example
`external_ip`	externalIP	The external IP address of the device	18.191.169.203
`first_seen`	firstSeen	The timestamp of when CrowdStrike first saw the device	2022-01-08T19:42:34Z
`hostname`	hostname	The hostname of the device	EXPLORER-01
`last_seen`	lastSeen	The timestamp of when CrowdStrike last saw the device	2022-09-13T19:14:30Z
`local_ip`	localIP	The local IP address of the device	192.168.1.100
`mac_address`	macAddress	The MAC address of the interface communicating with CrowdStrike	0a-6e-20-4a-e6-56
`os_version`	osVersion	The operating system version of the device	Ubuntu 20.04
`platform_name`	platformName	The platform running on the device	Linux
`product_type_desc`	productTypeDesc	The type of device	Server

Operators

FQL filters accept these operators.

Operator	Description
!	Not equal to
>	Greater than
>=	Greater than or equal to
<	Less than
<=	Less than or equal to
~	Text match. Tokenizes the string, ignoring spaces, case and punctuation
!~	Does not text match. Tokenizes the string, ignoring spaces, case and punctuation
*	Wildcard matching. Matches one or more characters

Example filters

You can apply filters like these to the CrowdStrike sync.

Search Filter	Description
`hostname:'WIN10*'`	Import all devices where the hostname starts with WIN10
`platform_name:'Linux'`	Import all Linux devices
`product_type_desc:'Server'`	Import all devices that CrowdStrike identifies as a Server
`hostname:'PROD*'+platform_name:'Linux'`	Import all Linux devices with a hostname that starts with PROD
`local_ip:'192.168.1.100'`	Import only the device with a local IP address of 192.168.1.100
`local_ip:!'192.168.1.100'`	Import all devices, excluding 192.168.1.100
`local_ip.raw:'192.168.1.'`	Import all devices with a local IP address in the 192.168.1.0/24 range
`(local_ip.raw:'192.168.1.'),(local_ip.raw:'192.168.2.')`	Import all devices with a local IP address in the 192.168.1.0/24 or 192.168.2.0/24 range
`local_ip.raw:!'192.168.1.'`	Import all devices, excluding devices with a local IP address in the 192.168.1.0/24 range
`local_ip.raw:!'192.168.1.'+local_ip.raw:!'192.168.2.'`	Import all devices, excluding devices with a local IP in the 192.168.1.0/24 and 192.168.2.0/24 ranges

Troubleshooting

If you’re having trouble with this integration, start with the questions and answers below.

Why is the CrowdStrike integration unable to connect?

Check whether the CrowdStrike integration is returning any data.
- Query the inventory rather than the task details to review all the data available from this integration.
- In some cases, an integration’s configuration limits how much data reaches the runZero console.
Some integrations require specific actions that are easy to overlook. If you miss a step during setup, the integration may not work correctly. Review this page and follow the steps exactly.
If the CrowdStrike integration can’t connect, check the task log for errors. Common errors include:
- 500: server error, unable to connect to the endpoint
- 404: hitting an unknown endpoint on the server
- 403: not authorized, likely a credential issue
If the integration endpoint is on-premises, verify that the integration task runs from an Explorer with access to the CrowdStrike host.

How can I solve the following CrowdStrike error?

Unable to collect software data for CrowdStrike devices: invalid response 403 Forbidden

This error occurs when your API client is missing the Assets API scope. To fix it, return to step 1 above and enable read permissions for Assets. The integration needs read-only permissions for Assets to collect software information. Host and vulnerability data should still come through.