Skip to main content

CrowdStrike Falcon Cloud Security

Visualize your cloud security posture across AWS, Azure, and GCP with CrowdStrike Falcon Cloud Security. Ingest cloud accounts and resources, map Indicators of Misconfiguration (IOM) findings to the rules that detect them, and monitor compliance controls through queries and alerts.

Installation​

info

You will need to create an API client ID and an API client secret in CrowdStrike. See their documentation for more information.

CrowdStrike Falcon Cloud Security ingests cloud security posture data. When creating the API client ID and API client secret, grant read access to the following API Scopes:

  • CSPM registration (cspm-registration:read)
  • Cloud security assets (cloud-security-assets:read)

🎯 2. Data Filtering Options

These options control which findings and controls are ingested. Leave defaults for a focused, high-signal first run.

FieldTypeDescriptionDefault
CSPM Cloud ProvidersMultiSelectCloud providers to monitor for CSPM findings.AWS, Azure
IOM Severity FilterMultiSelectSeverity levels to include for Indicator of Misconfiguration (IOM) findings.Critical
Compliance Control SeveritiesMultiSelectSeverity levels to include for compliance controls.Critical, High

To install the CrowdStrike Falcon Cloud Security integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select CrowdStrike Falcon Cloud Security. Click New Instance to begin configuring your integration.

Creating an instance requires the following:

  • The Account Name used to identify the CrowdStrike account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

  • Your CrowdStrike API client ID and API client secret to authenticate with the CrowdStrike Falcon API.

  • Enter the Availability Zone you'd like to use for API calls. Leave blank to use the main API endpoint. For example, entering us-2 as the availability zone will result in the use of a CrowdStrike API endpoint of api.us-2.crowdstrike.com.

Click Create once all values are provided to finalize the integration.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.