This article helps you integrate CrowdStrike Falcon Identity Protection with Workbench.
New CrowdStrike Falcon integration
Existing CrowdStrike Falcon integration
Viewing security device details
To complete this procedure, you must have:
-
A CrowdStrike Falcon Identity Protection subscription.
-
API credentials from your CrowdStrike Falcon integration (existing integrations only).
New CrowdStrike Falcon integration
If you are creating a new CrowdStrike Falcon integration to Workbench, and you want to include Identity Protection, do this:
-
Follow the instructions in the CrowdStrike Falcon setup for Workbench guide.
-
During Step 2, select these additional permissions for the OAuth2 API:
-
Alerts: Read
-
Identity Protection Entities: Read
-
Identity Protection Detections: Read
-
Identity Protection Timeline: Read
-
Identity Protection Assessment: Read
-
Identity GraphQL: Write
-
-
During Step 3, select Yes for Enable crowdstrike falcon identity protection alert aggregation?
Existing CrowdStrike Falcon integration
If you are adding an Identity Protection subscription to an existing CrowdStrike Falcon integration in Workbench, do this:
-
In CrowdStrike, open the Expel API Client and select these additional permissions for the OAuth2 API:
-
If you can't edit the existing API client:
-
Follow the instructions in Step 2 of the CrowdStrike Falcon setup for Workbench guide to create a new API client and credentials.
-
Select the permissions listed above in addition to the permissions listed in the guide.
-
Save the new API client and record the Client ID and Client Secret.
-
-
Log into Workbench, and click Organization Settings in the left navigation.
-
Click Security Devices. A table listing your security devices appears.
-
Find your CrowdStrike Falcon security device, open the list on the left, and select Edit. The Edit Security Device screen appears.
-
If you created a new API client, replace the Client ID and Client Secret.
-
Select Yes for Enable crowdstrike falcon identity protection alert aggregation?
-
Verify that your security device has a healthy connection. To check device health, follow the Viewing security device details instructions below.
-
If you see an unhealthy connection message, your CrowdStrike Falcon Identity Protection subscription may not be active. Please confirm with your CrowdStrike account representative that your company has it enabled.
After your devices are connected to Workbench, you can view details about them. To open the device details, click Organization Settings > Security Devices. Locate the device you want more details for. Click the arrow next to the name and click View details.
The side panel that appears looks like this:
The side panel contains the following sections:
-
Device Health: you see an Alerts Analysis dashboard snapshot for the selected device along with the device’s health status, connection, data, and alerts data. This at-a-glance information let's you stay on top of the device and what it's doing.
Tip
If you have a AWS CloudTrail device, you also see a Last data received time stamp that shows you when we last polled for log data. You also see a Last successful poll time stamp. These help you know if your AWS CloudTrail device is communicating with Workbench, even if alerts aren't being generated. We're working on deploying the last data received capability to other devices.
If you have a AWS CloudTrail, you also see View Inaccessible Accounts. Clicking this button shows you the AWS accounts that are inaccessible to Workbench. This can highlight gaps in service delivery for AWS CloudTrail. To provide access, login to your AWS environment associated with the device and grant permission.
-
Information: you see general device data, including the device name, location, GUID, and so on. These are the data points associated with creating or editing a device.
-
History: you see the history of changes in health status or edits made by a Workbench user. You know what changed, who made the change, and when.
In these sections you can click buttons to copy information or go directly to other areas in Workbench. Additionally, we include tool tips to help you understand what you're seeing.
In the side panel, you can edit the selected device by clicking Edit Device. You can also navigate to the previous or next device in the list by clicking the arrows.
Comments
0 comments
Article is closed for comments.