CrowdStrike Falcon

How to integrate and use CrowdStrike Falcon® Exposure Management with OneSite Patch.

Adaptiva and CrowdStrike Falcon® Exposure Management have integrated CrowdStrike vulnerability metadata, including CrowdStrike Expert Prediction Rating (ExPRT), with Adaptiva Patch metadata. You can use this metadata to:

• Configure patch filters in simple strategies.

• Set a trigger to rerun an advanced strategy based on changes to specific metadata.

• Configure patch deployment bots to deploy patches based on the metadata.

To access CrowdStrike from OneSite Patch, you must have a license from CrowdStrike that allows you to access CrowdStrike Falcon.

Prerequisites

Add a CrowdStrike for OneSite Patch license key

To enable CrowdStrike integration, you will need a license key. For more information about acquiring these keys, please reach out to your Sales manager.

You can add and view your license keys in the Adaptiva Admin Portal. Please see License your Adaptiva solution page for more details.

Internet connectivity to the CrowdStrike API client

You must make sure that the Adaptiva server can access the CrowdStrike API client. This enables the Adaptiva server to:

• Verify and save your CrowdStrike Falcon Access settings.

• Regularly download updates to the vulnerability metadata. The default schedule for this is every 8 hours.

• Sync host and user data.

You can see the integration section of Plan for OneSite platform installation for a list of the URLs you must add to your allowlist.

Create a CrowdStrike API Client

On the CrowdStrike management site, you must create a CrowdStrike API Client to generate the client settings that you will need to set in OneSite Patch in order to integrate with CrowdStrike.

Create an API Client

1. Log in to your CrowdStrike Falcon Spotlight dashboard.

2. Select the hamburger icon on the upper-left of the menu bar.

   
3. Select Support and resources in the left navigation pane, and then select API clients and keys.

   
4. Select Create API Client at the upper right to open the Create API Client dialog.

Set the CrowdStrike API Client details

In the CrowdStrike Falcon Spotlight Create API Client dialog, complete the following steps:

1. Enter a Client name, and then enter a Description of the client.

2. Select Read access in the Scope column for each of the following items:

   • Host Groups: A collection of devices that Adaptiva retrieves from CrowdStrike and uses to create business units.

   • Vulnerabilities: A list of defined vulnerabilities (trigger properties) that Adaptiva retrieves from CrowdStrike. Adaptiva utilizes these properties to set automation, such as scheduling based on ExPRT.AI ratings.

   • User Management: The OneSite Platform retrieves and adds CrowdStrike users and roles to the platform. The system automatically adds all users to the read-only, All Admins role.

   There is a built-in Approval Chain for the All Admins role, and users with this role will receive approval requests if this chain is assigned to a strategy.

3. Select Create. This opens the API client created response, which contains the details you must enter in the Falcon Spotlight Access Settings. Make sure that you copy the Client ID, Secret and Base URL fields.

   

   Important

   The details for the API client created screen show these details only once. Be sure to save this information in a safe location so you can access it later, if needed.

Set up CrowdStrike integration in OneSite Patch

1. Select CrowdStrike in the left navigation menu of the Admin Portal to open the Falcon Access Settings dialog.

   
2. Enter the Client ID, Secret, and Base URL in the respective fields of the Falcon Access Settings dialog. If you do not have these details, see Create a CrowdStrike API Client.

3. Click the More dropdown and select Test Settings to make sure that your settings are valid and that the Adaptiva server can connect with the CrowdStrike API service. Any connection errors are recorded in the server error logs.

4. Select Save on the upper-left corner of the settings dialog. This saves your settings and populates Roles, Business Units, and vulnerability information in OneSite Patch related to the CrowdStrike Client ID.

Explore CrowdStrike Integration

1. In the Falcon Access Settings page, click the More dropdown.

   You can manage the Host and User Sync here, either refreshing, disabling, or deleting the data as needed.

   

   Synchronization settings
2. Select Asset Management > Business Units in the left navigation pane. You can see your CrowdStrike Host Groups under the Root Falcon Host Group Business Unit.

   

   Host group sync
3. Click the gear icon > Settings > Security > Administrators.

4. In the details pane, click CrowdStrike Users.

   You can see the synchronized CrowdStrike Users here.

5. Click a user and scroll down to Direct Roles.

   Users are automatically assigned the All Admin Role and Falcon Administrator role when imported.

6. On the top level navigation bar, click Roles.

7. In the details pane, click CrowdStrike Roles.

   You can view the imported roles and leverage them to customize permissions for your users.

   

   Users and Roles
8. In the left navigation pane, select Advanced Settings > Intent Schema > Bots > Patch Deployment Bots.

9. In the details pane, select the Falcon folder.

   When you integrate CrowdStrike Falcon Exposure Management, OneSite Patch will generate patch deployment bots using Falcon metadata.

   

   Patch Deployment Bots
10. In the results pane, click Patch Enterprise - Patch Deployment Bot - Falcon - Critical.

    Leveraging the Falcon ExPRT Score, the Patch Deployment Bot will identify Products with Critical vulnerabilities using the Falcon.ExPRT == "Critical" filter.

    

    ExPRT Integration
11. Click Home.

Metadata properties

These metadata properties can be used to filter patches when creating patch strategies.

Property	Description	Values
Falcon.ExPRT	Represents the maximum ExPRT severity assigned to any CVE (Common Vulnerabilities and Exposures) referenced by Risk.CveIds, including superseded CVEs.	Low / Medium / High / Critical
Falcon.ExploitStatus	Represents the maximum exploit status for any CVE listed in Risk.CveIds, including superseded CVEs.	Unproven / Available / Easily Accessible / Actively Used
Falcon.KnownExploitExists	CrowdStrike's indication of whether or not a known exploit exists for the vulnerability that this Object fixes.	true / false