Connect CrowdStrike Falcon

The CrowdStrike Falcon connector reads host inventory and alerts. With a separate write client it can propose containing a host and lifting containment. Every change still needs an approved plan.

Before you start

• In Falcon you need the Falcon Administrator role, or a custom role that can manage API clients.
• In Vigilbase OS you need the integration.manage and credential.manage permissions.

Create a read-only API client

1. 1

   Open Client Management. In the Falcon console, open Support and resources › Client Management (formerly API clients and keys), then the API clients tab.

2. 2

   Choose Create API client. Some consoles say Add new API client. Enter the client name Vigilbase OS (read-only) and the description Read-only access for Vigilbase OS security monitoring.

3. 3

   Tick Read for the scopes. Tick Read for Hosts and Alerts. Optionally tick Read for Sensor download so Vigilbase can fill in your Customer ID (CID). Leave every Write box unticked.

4. 4

   Choose Create. Copy the Client ID, Secret and Base URL. The secret is shown only once.

Connect it to Vigilbase OS

1. 1

   Open Integrations, choose Add connection and select CrowdStrike Falcon.

2. 2

   Paste what CrowdStrike shows after Create. This fills Client ID, Client secret and Falcon cloud. Nothing you paste is shown again.

3. 3

   Check the Falcon cloud. The Base URL names it, for example api.eu-1.crowdstrike.com is EU-1. Choose it to keep your credentials in your region; if you leave it blank, Vigilbase detects it by asking CrowdStrike's US-1 address first. US-GOV-1 must be chosen. US-3 and US-GOV-2 are not supported yet.

4. 4

   Finish the wizard. Validate the connection, then choose datasets.

Optional details:

• Customer ID (CID): leave blank and Vigilbase reads it from Falcon. If you enter it, Vigilbase checks it matches the API client.
• Flight Control child CID: for MSSPs only, when the API client was created in the Flight Control parent.

Add containment (optional)

Use a second API client just for response actions, kept separate from the read-only one.

1. 1

   In Client Management, create another API client. Name it Vigilbase OS (response actions).

2. 2

   Tick Write for Hosts only. Leave everything else unticked.

3. 3

   Choose Create, then copy its Client ID and Secret.

4. 4

   In Vigilbase OS, open the connection and choose Add write access. Paste the write client's details.

Containing a host and lifting containment are reversible actions. Both are marked critical, so the person who proposes them can never approve them.

What is not collected

• Incidents: CrowdStrike retired the Incidents API.
• Falcon Data Replicator telemetry.