CrowdStrike, part of CrowdStrike Falcon® Exposure Management, brings IT and Security teams together and improves visibility by combining CrowdStrike Expert Prediction Rating Artificial Intelligence (ExPRT) data with OneSite Patch deployment and management capabilities. Rather than exporting vulnerability data from CrowdStrike Falcon for patching, the integration includes ExPRT ratings from CrowdStrike directly in OneSite Patch, so you can prioritize patching preferences according to your organizations requirements and remediate vulnerabilities faster.
Adaptiva and CrowdStrike Falcon® Exposure Management have integrated CrowdStrike vulnerability metadata with Adaptiva Patch metadata to allow Patch Deployment Bots to deploy patches based on Spotlight vulnerability metadata.
To access CrowdStrike from OneSite Patch, you must have a license from CrowdStrike that allows you to access CrowdStrike Falcon.
-
Select Falcon Access Settings in the left navigation menu of the OneSite Patch Dashboard.
This opens the Falcon Access Settings dialog.
-
Enter the Falcon Access Settings. If you do not have these details, see Create a CrowdStrike API Client.
-
Enter the Client ID, Secret, and Base URL in the respective fields of the Falcon Access Settings dialog.
-
Select Save on the upper-left corner of the settings dialog. This populates Roles, Business Units, and vulnerability information in OneSite Patch related to the CrowdStrike Client ID.
-
Select Business Units in the left navigation pane of the OneSite Patch Dashboard to verify that your client Business Units and templates exist.
Create a CrowdStrike API Client to generate the client settings needed to access CrowdStrike.
-
Log in to your CrowdStrike Falcon Spotlight dashboard.
-
Select the Stack icon on the upper-left of Dashboards and reports.
-
Select Support and resources in the left navigation pane, and then select API clients and keys.
-
Select Create API Client at the upper right.
This opens the Create API Client dialog.
In the CrowdStrike Falcon Spotlight Create API Client dialog, complete the following steps:
-
Enter a Client name, and then enter a Description of the client.
-
Select Read access in the Scope column for each of the following items:
-
Host Groups: A collection of devices that Adaptiva retrieves from CrowdStrike and uses to create business units.
-
Vulnerabilities: A list of defined vulnerabilities (trigger properties) that Adaptiva retrieves from CrowdStrike. Adaptiva utilizes these properties to set automation, such as scheduling based on ExPRT.AI ratings.
-
User Management: The OneSite Platform retrieves and adds CrowdStrike users and roles to the platform. The system automatically adds all users to the read-only, All Admins role.
Important
There is a built-in Approval Chain for the All Admins role, and users with this role will receive approval requests if this chain is assigned to a strategy.
-
-
Select Create. This opens the API client created response, which contains the details you must enter in the Falcon Spotlight Access Settings.
Important
The details for the API client created screen show these details only once. Be sure to save this information in a safe location so you can access it later, if needed.
-
Copy and paste the API client created details directly into the fields of the Falcon Spotlight Access Settings dialog in the Adaptiva OneSite Admin Portal.
-
Select Save on the upper-left of the settings dialog. This populates Roles, Business Units, and vulnerability information in OneSite Patch related to the CrowdStrike Client ID.
-
Select Business Units in the left navigation pane of the OneSite Patch Dashboard to verify the availability of your Hosts.
View, create, or modify Administrators and Roles, enable OIDC or SAML providers, and assign permissions to Roles. Changes made here affect all licensed OneSite products. How to assign Class Permissions to a role is coming soon.
You can view your list of CrowdStrike users and their assigned roles.
-
Select
on the upper-right of the Admin Portal dashboard.
-
Open the Settings page with the Administrators tab selected to manage accounts, roles, OIDC Providers, SAML Providers, and Class Permissions.
-
Select the Roles tab of Security Settings.
-
Select the Roles tab of Access Security Settings to view the list of roles.
Comments
0 comments
Article is closed for comments.