Connect CrowdStrike

Elisity supports simple API connectivity to CrowdStrike as a method to enrich device discovery and identity. This allows data from CrowdStrike to be pulled into IdentityGraph for use as Core Effective Attributes when creating policies, enhancing the precision and accuracy of device classification and Policy Group matching. It also presents additional detail about the asset and agent such as ZTNA Scores and versioning. 

Prerequisites

  • CrowdStrike API URL
  • CrowdStrike API Client ID
  • CrowdStrike API Client Key

Steps to Connect CrowdStrike

Step 1. Create a CrowdStrike API Client and API Secret Key by following the directions below or by reading the CrowdStrike documentation here.

a) Log into the Falcon portal and navigate to Support and Resources > API Clients and Keys. 

b) Select the Create API Client button 

c) In the Create API Client window define a Client Name (any name you want) and a description (optional). Elisity only needs Read access to the following CrowdStrike API Scopes:

  • Hosts
  • Assets
  • Zero Trust Assessment

Once you are done, select the Create button. 

d) You will be presented with the CrowdStrike API URL, Client ID and Client Key. Copy these as they will be required in the next steps to configure the Cloud Control Center CrowdStrike connector. 

 

Step 2. Log into Elisity Cloud Control Center and navigate to Settings > Connectors and select + Add Connector button. 

 

Step 3. A list of tiles will slide out from the right side of the screen. Select configure on the CrowdStrike connector. 

 

Step 4. Input the API URL the Client ID and Client Secret you generated in the first step and select Submit.

 

Step 5. If all of the required connector values are correct, all checks will pass and the connector will be created. 

 

After successful configuration, you should begin to see devices enriched by CrowdStrike in IdentityGraph.

 

Leveraging CrowdStrike with Elisity

When Elisity discovers a new asset on the network and the CrowdStrike connector is active, Cloud Control Center queries the CrowdStrike platform via API for additional device attributes in order to enrich IdentityGraph. This enriched data is displayed in the IdentityGraph tab of the device and can be leveraged as Elisity Core Effective Attributes for Policy Group definition. 

To learn more about how to leverage IdentityGraph Core Effective Attributes review the IdentityGraph article. 

 

If a device discovered by Elisity is also known in CrowdStrike, the Trust Attribute flag for "Known in CrowdStrike" will be set to Yes. You can then leverage this trust attribute as match criteria in Policy Group definition. 

To learn more about how to leverage IdentityGraph Trust Attributes review the Leveraging Trust Attributes for Policy Group Definition article.

 

 

 

 

Was this article helpful?
0 out of 0 found this helpful