CrowdStrike é uma plataforma de cibersegurança que oferece proteção de endpoints, inteligência de ameaças e segurança de identidade por meio do suite Falcon. Esta integração conecta-se à API Falcon Identity Protection para consultar dados de sensores.
Com esta integração, você pode:
- Pesquisar sensores: Consulte sensores de proteção de identidade do CrowdStrike por hostname, IP ou campos relacionados usando filtros Falcon Query Language
- Obter detalhes do sensor: Recupere detalhes documentados do sensor, incluindo status de proteção, atribuições de política e configuração de protocolo, para um ou mais IDs de dispositivo
- Executar agregações de sensores: Execute consultas de agregação JSON documentadas para resumir dados de sensores em buckets e métricas
No Zoen, a integração com o CrowdStrike permite que seus agentes pesquisem sensores de proteção de identidade, consultem registros detalhados de sensores por ID de dispositivo e executem consultas de agregação sobre dados de sensores — tudo autenticado com um client ID e secret da API Falcon em uma região de nuvem especificada. Isso permite que os agentes mostrem o status de proteção do dispositivo, a cobertura de políticas e a configuração de protocolo (Kerberos, LDAP, NTLM, RDP, SMB) como parte de workflows de monitoramento e relatórios de segurança.
Usage Instructions
Integrate CrowdStrike Identity Protection into workflows to search sensors, fetch documented sensor details by device ID, and run documented sensor aggregate queries.
Actions
crowdstrike_get_sensor_aggregates
Get documented CrowdStrike Identity Protection sensor aggregates from a JSON aggregate query body
Input
| Parameter | Type | Required | Description |
|---|---|---|---|
clientId | string | Yes | CrowdStrike Falcon API client ID |
clientSecret | string | Yes | CrowdStrike Falcon API client secret |
cloud | string | Yes | CrowdStrike Falcon cloud region |
aggregateQuery | json | Yes | JSON aggregate query body documented by CrowdStrike for sensor aggregates |
Output
| Parameter | Type | Description |
|---|---|---|
aggregates | array | Aggregate result groups returned by CrowdStrike |
↳ buckets | array | Buckets within the aggregate result |
↳ count | number | Bucket document count |
↳ from | number | Bucket lower bound |
↳ keyAsString | string | String representation of the bucket key |
↳ label | json | Bucket label object |
↳ stringFrom | string | String lower bound |
↳ stringTo | string | String upper bound |
↳ subAggregates | json | Nested aggregate results for this bucket |
↳ to | number | Bucket upper bound |
↳ value | number | Bucket metric value |
↳ valueAsString | string | String representation of the bucket value |
↳ docCountErrorUpperBound | number | Upper bound for bucket count error |
↳ name | string | Aggregate result name |
↳ sumOtherDocCount | number | Document count not included in the returned buckets |
count | number | Number of aggregate result groups returned |
crowdstrike_get_sensor_details
Get documented CrowdStrike Identity Protection sensor details for one or more device IDs
Input
| Parameter | Type | Required | Description |
|---|---|---|---|
clientId | string | Yes | CrowdStrike Falcon API client ID |
clientSecret | string | Yes | CrowdStrike Falcon API client secret |
cloud | string | Yes | CrowdStrike Falcon cloud region |
ids | json | Yes | JSON array of CrowdStrike sensor device IDs |
Output
| Parameter | Type | Description |
|---|---|---|
sensors | array | CrowdStrike identity sensor detail records |
↳ agentVersion | string | Sensor agent version |
↳ cid | string | CrowdStrike customer identifier |
↳ deviceId | string | Sensor device identifier |
↳ heartbeatTime | number | Last heartbeat timestamp |
↳ hostname | string | Sensor hostname |
↳ idpPolicyId | string | Assigned Identity Protection policy ID |
↳ idpPolicyName | string | Assigned Identity Protection policy name |
↳ ipAddress | string | Sensor local IP address |
↳ kerberosConfig | string | Kerberos configuration status |
↳ ldapConfig | string | LDAP configuration status |
↳ ldapsConfig | string | LDAPS configuration status |
↳ machineDomain | string | Machine domain |
↳ ntlmConfig | string | NTLM configuration status |
↳ osVersion | string | Operating system version |
↳ rdpToDcConfig | string | RDP to domain controller configuration status |
↳ smbToDcConfig | string | SMB to domain controller configuration status |
↳ status | string | Sensor protection status |
↳ statusCauses | array | Documented causes behind the current status |
↳ tiEnabled | string | Threat intelligence enablement status |
count | number | Number of sensors returned |
pagination | json | Pagination metadata when returned by the underlying API |
↳ limit | number | Page size used for the query |
↳ offset | number | Offset returned by CrowdStrike |
↳ total | number | Total records available |
crowdstrike_query_sensors
Search CrowdStrike identity protection sensors by hostname, IP, or related fields
Input
| Parameter | Type | Required | Description |
|---|---|---|---|
clientId | string | Yes | CrowdStrike Falcon API client ID |
clientSecret | string | Yes | CrowdStrike Falcon API client secret |
cloud | string | Yes | CrowdStrike Falcon cloud region |
filter | string | No | Falcon Query Language filter for identity sensor search |
limit | number | No | Maximum number of sensor records to return |
offset | number | No | Pagination offset for the identity sensor query |
sort | string | No | Sort expression for identity sensor results |
Output
| Parameter | Type | Description |
|---|---|---|
sensors | array | Matching CrowdStrike identity sensor records |
↳ agentVersion | string | Sensor agent version |
↳ cid | string | CrowdStrike customer identifier |
↳ deviceId | string | Sensor device identifier |
↳ heartbeatTime | number | Last heartbeat timestamp |
↳ hostname | string | Sensor hostname |
↳ idpPolicyId | string | Assigned Identity Protection policy ID |
↳ idpPolicyName | string | Assigned Identity Protection policy name |
↳ ipAddress | string | Sensor local IP address |
↳ kerberosConfig | string | Kerberos configuration status |
↳ ldapConfig | string | LDAP configuration status |
↳ ldapsConfig | string | LDAPS configuration status |
↳ machineDomain | string | Machine domain |
↳ ntlmConfig | string | NTLM configuration status |
↳ osVersion | string | Operating system version |
↳ rdpToDcConfig | string | RDP to domain controller configuration status |
↳ smbToDcConfig | string | SMB to domain controller configuration status |
↳ status | string | Sensor protection status |
↳ statusCauses | array | Documented causes behind the current status |
↳ tiEnabled | string | Threat intelligence enablement status |
count | number | Number of sensors returned |
pagination | json | Pagination metadata (limit, offset, total) |
↳ limit | number | Page size used for the query |
↳ offset | number | Offset returned by CrowdStrike |
↳ total | number | Total records available |