> For the complete documentation index, see [llms.txt](https://docs.adaptiva.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.adaptiva.com/patch/integrations/integrate-crowdstrike.md).

# CrowdStrike Falcon

Adaptiva and CrowdStrike Falcon® Exposure Management have integrated CrowdStrike vulnerability metadata, including CrowdStrike Expert Prediction Rating (ExPRT), with Adaptiva Patch metadata. You can use this metadata to:

* Configure patch filters in simple strategies.
* Set a trigger to rerun an advanced strategy based on changes to specific metadata.
* Configure patch deployment bots to deploy patches based on the metadata.

To access CrowdStrike from OneSite Patch, you must have a license from [CrowdStrike](https://www.crowdstrike.com/) that allows you to access CrowdStrike Falcon.

### Prerequisites

#### Add a CrowdStrike for OneSite Patch license key

To enable CrowdStrike integration, you will need a license key. For more information about acquiring these keys, please reach out to your Sales manager.

You can add and view your license keys in the Adaptiva Admin Portal. Please see [License your Adaptiva solution](https://docs.adaptiva.com/platform-guide/license-solution#add-a-license) page for more details.

#### Internet connectivity to the CrowdStrike API client

You must make sure that the Adaptiva server can access the CrowdStrike API client. This enables the Adaptiva server to:

* Verify and save your CrowdStrike Falcon Access settings.
* Regularly download updates to the vulnerability metadata. The default schedule for this is every 8 hours.
* Sync host and user data.

You can see the integration section of [Plan for OneSite platform installation](https://docs.adaptiva.com/platform-install/planning-guides/onesite-platform-planning#integrations) for a list of the URLs you must add to your allowlist.

### Create a CrowdStrike API Client

On the CrowdStrike management site, you must create a CrowdStrike API Client to generate the client settings that you will need to set in OneSite Patch in order to integrate with CrowdStrike.

#### Create an API Client

1. Log in to your **CrowdStrike Falcon Spotlight dashboard**.
2. Select the hamburger icon on the upper-left of the menu bar.

   ![](/files/mrwOMtmu9qwNEM848kU4)
3. Select **Support and resources** in the left navigation pane, and then select **API clients and keys**.

   ![](/files/ZPtlZ5ogBNvMWsyz0eiX)
4. Select **Create API Client** at the upper right to open the **Create API Client** dialog.

#### Set the CrowdStrike API Client details

In the **CrowdStrike Falcon Spotlight Create API Client** dialog, complete the following steps:

1. Enter a **Client name**, and then enter a **Description** of the client.
2. Select **Read access** in the **Scope** column for each of the following items:

   * **Host Groups:** A collection of devices that Adaptiva retrieves from CrowdStrike and uses to create business units.
   * **Vulnerabilities:** A list of defined vulnerabilities (trigger properties) that Adaptiva retrieves from CrowdStrike. Adaptiva utilizes these properties to set automation, such as scheduling based on ExPRT.AI ratings.
   * **User Management:** The OneSite Platform retrieves and adds CrowdStrike users and roles to the platform. The system automatically adds all users to the read-only, **All Admins** role.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>There is a built-in Approval Chain for the <strong>All Admins</strong> role, and users with this role will receive approval requests if this chain is assigned to a strategy.</p></div>
3. Select **Create**. This opens the **API client created** response, which contains the details you must enter in the **Falcon Spotlight Access Settings**.\
   Make sure that you copy the **Client ID**, **Secret** and **Base URL** fields.

   ![](/files/xUv9SUpm4jsZff0nGh45)

   > **Important**
   >
   > The details for the API client created screen show these details only once. Be sure to save this information in a safe location so you can access it later, if needed.

### Set up CrowdStrike integration in OneSite Patch

1. Select **CrowdStrike** in the left navigation menu of the Admin Portal to open the **Falcon Access Settings** dialog.

   ![](/files/UzLGCDqjVedxEWuh82x9)
2. Enter the **Client ID**, **Secret**, and **Base URL** in the respective fields of the **Falcon Access Settings** dialog. If you do not have these details, see [Create a CrowdStrike API Client](#create-a-crowdstrike-api-client).
3. Click the **More** dropdown and select **Test Settings** to make sure that your settings are valid and that the Adaptiva server can connect with the CrowdStrike API service. Any connection errors are recorded in the server error logs.
4. Select **Save** on the upper-left corner of the settings dialog. This saves your settings and populates Roles, Business Units, and vulnerability information in OneSite Patch related to the CrowdStrike Client ID.

### Explore CrowdStrike Integration

1. In the Falcon Access Settings page, click the **More** dropdown.

   You can manage the Host and User Sync here, either refreshing, disabling, or deleting the data as needed.

   ![Synchronization settings](/files/NYLep4MCp3s8kB5c45sE)
2. Select **Asset Management > Business Units** in the left navigation pane. You can see your CrowdStrike Host Groups under the **Root Falcon Host Group Business Unit**.

   ![Host group sync](/files/kdOdEXgyCVz8y6nNuAsV)
3. Click the **gear icon > Settings > Security > Administrators**.
4. In the details pane, click **CrowdStrike Users**.

   You can see the synchronized CrowdStrike Users here.
5. Click a user and scroll down to **Direct Roles**.

   Users are automatically assigned the All Admin Role and Falcon Administrator role when imported.
6. On the top level navigation bar, click **Roles**.
7. In the details pane, click **CrowdStrike Roles**.

   You can view the imported roles and leverage them to customize permissions for your users.

   ![Users and Roles](/files/iw1rHcgaxBHru5qKjYJI)
8. In the left navigation pane, select **Advanced Settings > Intent Schema > Bots > Patch Deployment Bots**.
9. In the details pane, select the **Falcon** folder.

   When you integrate CrowdStrike Falcon Exposure Management, OneSite Patch will generate patch deployment bots using Falcon metadata.

   ![Patch Deployment Bots](/files/FrALgkcESGrXOwrE8jwO)
10. In the results pane, click **Patch Enterprise - Patch Deployment Bot - Falcon - Critical**.

    Leveraging the Falcon ExPRT Score, the Patch Deployment Bot will identify Products with Critical vulnerabilities using the `Falcon.ExPRT == "Critical"` filter.

    ![ExPRT Integration](/files/OFXFG0fydhpzW9j7HpC4)
11. Click **Home**.

### Metadata properties

These metadata properties can be used to filter patches when creating patch strategies.

| Property                  | Description                                                                                                                                            | Values                                                   |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------- |
| Falcon.ExPRT              | Represents the maximum ExPRT severity assigned to any CVE (Common Vulnerabilities and Exposures) referenced by Risk.CveIds, including superseded CVEs. | Low / Medium / High / Critical                           |
| Falcon.ExploitStatus      | Represents the maximum exploit status for any CVE listed in Risk.CveIds, including superseded CVEs.                                                    | Unproven / Available / Easily Accessible / Actively Used |
| Falcon.KnownExploitExists | CrowdStrike's indication of whether or not a known exploit exists for the vulnerability that this Object fixes.                                        | true / false                                             |