CrowdStrike
Visualize Crowdstrike endpoint agents and protected devices, map agents to devices and their respective owners, and monitor changes through queries and alerts.
- Installation guide
- CrowdStrike data model
- CrowdStrike types
Installation
You will need to create an API client ID and an API client secret on Crowdstrike. See their documentation for more information.
When creating the API client ID and API client secret, provide (at minimum) read access to the following API Scopes:
- Hosts
- Prevention policies
An additional scope is needed for ingesting vulnerabilities (Spotlight Vulnerabilities). Future additions may require additional scopes.
The query used to ingest vulnerabilities limits to the date/time of the last successful integration or to the last 30 days for the initial run. Similarly, only crowdstrike_sensors seen by CrowdStrike in the last 30 days will be ingested.
To install the Crowdstrike integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Crowdstrike. Click New Instance to begin configuring your integration.
Creating a configuration requires the following:
The Account Name used to identify the Crowdstrike account in JupiterOne. Ingested entities will have this value stored in
tag.AccountName
when theAccountName
toggle is enabled.Description to assist in identifying the integration instance, if desired.
Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as
DISABLED
and manually execute the integration.Your Crowdstrike API client ID and API client secret to authenticate with the CrowdStrike Falcon and Spotlight APIs.
Enter the Availability Zone you'd like to use for API calls. Leave blank to use the main API endpoint. For example, entering
us-2
as the availability zone will result in the use of a CrowdStrike API endpoint ofapi.us-2.crowdstrike.com
.
Click Create once all values are provided to finalize the integration.
The CrowdStrike integration only ingests information on applications that have vulnerabilities. Applications without vulnerabilities will not be ingested into JupiterOne.
Next steps
Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.
Data Model
Entities
The following entities are created:
Resources | Entity _type | Entity _class |
---|---|---|
Account | crowdstrike_account | Account |
Application | crowdstrike_detected_application | Application |
Device Sensor Agent | crowdstrike_sensor | HostAgent |
Discover Application | crowdstrike_discover_application | Application |
Prevention Policy | crowdstrike_prevention_policy | ControlPolicy |
Prevention Policy Setting | crowdstrike_prevention_policy_setting | Configuration |
Service | crowdstrike_endpoint_protection | Service |
Vulnerability | crowdstrike_vulnerability | Finding |
Zero Trust Assessment | crowdstrike_zero_trust_assessment | Assessment |
Relationships
The following relationships are created:
Source Entity _type | Relationship _class | Target Entity _type |
---|---|---|
crowdstrike_account | HAS | crowdstrike_endpoint_protection |
crowdstrike_account | HAS | crowdstrike_sensor |
crowdstrike_detected_application | HAS | crowdstrike_vulnerability |
crowdstrike_prevention_policy | ENFORCES | crowdstrike_endpoint_protection |
crowdstrike_prevention_policy | HAS | crowdstrike_prevention_policy_setting |
crowdstrike_sensor | HAS | crowdstrike_discover_application |
crowdstrike_sensor | ASSIGNED | crowdstrike_prevention_policy |
crowdstrike_sensor | HAS | crowdstrike_zero_trust_assessment |
crowdstrike_vulnerability | EXPLOITS | crowdstrike_sensor |
Mapped Relationships
The following mapped relationships are created:
Source Entity _type | Relationship _class | Target Entity _type | Direction |
---|---|---|---|
crowdstrike_vulnerability | IS | *cve* | FORWARD |
Crowdstrike Account
crowdstrike_account
inherits from Account
Crowdstrike Endpoint Protection
crowdstrike_endpoint_protection
inherits from Service
Crowdstrike Sensor
crowdstrike_sensor
inherits from HostAgent
Property | Type | Description | Specifications |
---|---|---|---|
firstSeenOn | number | ||
macAddress | string | A normalized MAC address for the device's network interface | |
originalMacAddress * | The original MAC address for the device's network interface | ||
ec2InstanceArn | string | ||
ingestedOn * | number |
Crowdstrike Prevention Policy
crowdstrike_prevention_policy
inherits from ControlPolicy
Crowdstrike Prevention Policy Setting
crowdstrike_prevention_policy_setting
inherits from Configuration
Property | Type | Description | Specifications |
---|---|---|---|
categoryName * | string | ||
description * | string | ||
enabled | boolean | ||
configured | boolean | ||
type * | string |
Crowdstrike Vulnerability
crowdstrike_vulnerability
inherits from Finding
Property | Type | Description | Specifications |
---|---|---|---|
id * | string | ||
cid * | string | ||
aid | string | ||
closedOn | number | ||
publishedOn | number | ||
vendorAdvisory | array of string s | ||
cveId | string | ||
exploitStatus | number | ||
exprtRating | string | ||
productNameVersion | string |
Crowdstrike Detected Application
crowdstrike_detected_application
inherits from Application
Property | Type | Description | Specifications |
---|---|---|---|
open * | boolean | ||
remediationIds | array of string s | ||
evaluationLogicId * | string |
Crowdstrike Zero Trust Assessment
crowdstrike_zero_trust_assessment
inherits from Assessment
Property | Type | Description | Specifications |
---|---|---|---|
cid * | string | ||
aid | string | ||
productTypeDescription * | string | ||
sensorFileStatus * | string | ||
systemSerialNumber * | string | ||
sensorConfigScore * | number | ||
osScore * | number | ||
overallScore * | number | ||
version * | string | ||
eventPlatform * | string | ||
metSensorSignals * | array of string s | ||
unmetSensorSignals * | array of string s | ||
metOsSignals * | array of string s | ||
unmetOsSignals * | array of string s |
Crowdstrike Discover Application
crowdstrike_discover_application
inherits from Application
Property | Type | Description | Specifications |
---|---|---|---|
agentId | string | ||
vendor | string | ||
version | string | ||
versioningScheme | string | ||
architectures | array of string s | ||
isSuspicious | boolean | ||
isNormalized | boolean | ||
installationPaths | array of string s | ||
installedOn | number | ||
firstSeenOn | number | ||
lastUpdatedOn | number | ||
lastUsedOn | number |