1. Expel Support Center
  2. Connect your technology
  3. Endpoint integrations

CrowdStrike Falcon Complete setup for Workbench

Sharon Burton
  • Updated

This guide is specific to the CrowdStrike Falcon Complete service. For CrowdStrike Falcon, use the CrowdStrike Falcon article instead.

Tip

This article was accurate at the time of writing, but changes happen. If you find the instructions are outdated, leave a description in the comment field below and let us know!

In this article

Before you start

  • If you plan to enroll in the Expel Hunting service, a Falcon Data Replicator subscription is required.

Console permissions in your devices overview

As you connect your devices to Workbench, you provide Workbench access to those devices through permissions in the devices. These permissions vary from 1 device technology to another, but we typically need at least Read access to your devices to pull in any logs from those devices into Workbench.

Without minimum permissions to your devices, the SOC analysts are limited in their insight into your technology. This can mean they surface more benign alerts to your team for further investigation, resulting in increasing the workload for your team, and resulting in alert fatigue.

If you grant Read access to your devices, we can investigate the device and the logs more deeply and surface relevant alerts to you in Workbench. Allowing Expel visibility into the console of your security devices helps our SOC analysts make better decisions on whether an alert is benign or malicious. It also allows our SOC analysts to perform health checks to make sure Workbench is not missing alerts from your security devices. Depending on what your organization purchased from Expel, the SOC analysts may even be able to contain and/or remediate the issues on your behalf.

Ultimately, the more permissions you can grant Workbench, the better and faster the SOC analysts can find and investigate alerts in your environment.

Step 1: Enable console access

Having read-only access to the interface of your technology allows Expel to dig deeper during incident investigations. Our device health team uses this access to investigate potential health issues with your tech.

Expel is a CrowdStrike Certified Managed Security Provider partner. To allow the Expel partner console access to your console, do the following:

  1. Print, complete, and sign the CrowdStrike MSP Authorization Form. This form can be provided by the Expel customer success engineer.

  2. Attach the completed form in an email to CrowdStrike Falcon Complete Support. An Expel customer success engineer can help and can provide a template to send to CrowdStrike Falcon Complete Support.

To integrate the technology with Expel, we need to create secure credentials to the API.

Step 2: Enabling the OAuth2 API

To enable the OAuth2 API, follow the steps below:

  1. After you log into the Falcon UI, navigate to Support > API Clients and Keys.

  2. If API Clients and Keys doesn't appear in your CrowdStrike Falcon Complete UI, we need to reach out to CrowdStrike Falcon Complete Support to get it enabled for the integration. An Expel customer success engineer can help you with this.

  3. Select Add new API Client.

  4. Type Expel as the Client Name.

  5. Type Expel API Access as the Description.

  6. Select the following permissions:

    • Read for Detections.

    • Read for Hosts.

    • Read for Incidents.

    • Read for IOCs (Indicators of Compromise).

    • Read for Real Time Response.

  7. Click Save.

  8. Make a record of your Client, Client Secret, and Base URL for the API.

  9. Go to Step 3 to type these credentials into Workbench.

Step 3: Configure the technology in Workbench

Now that we have the correct access configured and noted the credentials, we can integrate your tech with Workbench.

  1. Login to https://workbench.expel.io/settings/security-devices?setupIntegration=crowdstrike.

    mceclip0.png

  2. For Name type the host name of the device.

  3. For Location type the geographic location of the appliance.

  4. After typing the name and location, complete the remaining fields using the credentials and information you collected in Step 2 above.

    • API Username and API Key can be left blank.

    • Type OAuth2 Client ID from Step 2 in Client ID.

    • Type OAuth2 Secret from Step 2 in Client secret.

    • Leave Mark in console blank because the API access is read-only.

    • Type the Base URL from Step 2 in CrowdStrike API access.

    • Enable CrowdScore ingest, type y.

      Note

      Requires the incidents:read permission to work.

  5. Click Save.

To check if alerts are coming through, navigate to Alerts on the console page. Click the icon in the upper right to switch to grid view, then check the list for device alerts.

  • Was this article helpful?

  • 0 out of 0 found this helpful

Related articles