Important Note: If you are a CrowdStrike Complete customer, do NOT use this guide. Use the CrowdStrike Falcon Complete getting started guide instead. 

Step 1: Enable console access

Having read-only access to the interface of your technology allows Expel to dig deeper when performing incident investigations. Our device health team uses this access to investigate potential health issues with your tech.

Expel is a CrowdStrike Certified Managed Security Provider partner. To allow the Expel partner console access to your console, you need to do the following:

1. Print, complete, and sign the CrowdStrike MSP Authorization Form. This form can be provided by the Expel Solutions Architect, Engagement Manager or Customer Success Engineer.
2. Create a CrowdStrike support ticket, attaching the completed form.  

Step 2: Enabling the OAuth2 API 

1. After you're logged into the Falcon UI, navigate to Support > API Clients and Keys.
2. Select Add new API Client.
3. Enter Expel as the Client Name.
4. Enter Expel API Access as the Description.
5. Select the following permissions:

   • Read and Write for Detections.

   • Read and Write (optional) for Hosts. Note: Write permission for Hosts is required for Auto Host Containment. For more information, see the CrowdStrike Auto Host Containment getting started guide.

   • Read for IOCs (Indicators of Compromise).

   • Read and Write for Real Time Response.

   • Read and Write for IOC Manager APIs. Note: Write permission is required to block hashes through auto-remediation. For more information, see the Auto Block Bad Hashes Getting Started Guide.

6. Click Save.
7. Make a record of your Client ID and the Client Secret for the API.
8. Go to Step 3 to type these credentials into Workbench.

Step 3: Configure the technology in Workbench

Now that we have the correct access configured and noted the credentials, we can integrate CrowdStrike Falcon with Expel.  

Register device in Expel Workbench

1. Login into https://workbench.expel.io/settings/security-devices?setupIntegration=crowdstrike. 
   
2. For Name type the hostname of the device.  
3. For Location type the geographic location of the appliance.
4. After typing the name and location, complete the remaining fields using the credentials and information you collected in Step 2.
   
   • • API username (Legacy API), leave this blank.
     • API key (Legacy API), leave this blank.
     • Client secret (OAuth2), type the secret from Step 2.
     • Client ID (OAuth2), type the ID from Step 2.
     • Mark in console, type y = yes to mark the events on the console to in-progress status. 
5. Click Save.

After a few minutes, refresh the Security Devices page and you see your device status reporting as Healthy, or if there is an issue, you see details of what the issue may be.

To check if alerts are coming through, navigate to Alerts on the console page. Click the icon in the upper right to switch to grid view, then check the list for device alerts.