Set up IoT Security and XSOAR for CrowdStrike Integration
Set up IoT Security and Cortex XSOAR to integrate with CrowdStrike.
To set up IoT Security to integrate through Cortex XSOAR with CrowdStrike, you need the following:
- CrowdStrike client ID
- URL of the CrowdStrike API
- Log in to the IoT Security portal and then access CrowdStrike integration settings in Cortex XSOAR.
- Because IoT Security uses XSOAR to integrate with CrowdStrike, you must configure settings for the CrowdStrike integration instance in the Cortex XSOAR interface. To access XSOAR, log in to IoT Security and select.IntegrationsLaunch Cortex XSOAR
- ClickSettingsin the left navigation menu, search forcrowdstriketo locate it among other instances.
- Configure the CrowdStrike integration instance.
- Add instanceto open the settings panel.
- Enter the following and leave other settings at their default values:Name: Enter a name for the CrowdStrike integration instance.Server URL: Copy the base URL that you saved earlier in a text file and paste it here.Client ID: Copy the client ID text string that you previously saved and paste it here.Secret: Copy the text string of the secret and paste it here.Single engine: ChooseNo engine.
- When finished, clickTest.If the test is successful, a Success message appears. If not, check that the settings were entered correctly and then test the configuration again.
- After the test succeeds, copy the name of the integration instance to use in the job you create next, and then clickSave & exitto save your changes and close the settings panel.
- To enable the CrowdStrike integration instance, clickEnable.
- Create a job to retrieve device attributes from CrowdStrike every 15 minutes.
- ClickJobsnear the bottom of the left navigation menu to open the Jobs page.
- ClickNew Jobat the top of the Jobs page.
- Enter the following, leave the other fields at their default values:Time triggered: (select)Recurring: Select this because you want to periodically import device attributes from CrowdStrike.Every: Enter a number and set the interval value (Minutes, Hours, Days, or Weeks) and select the days on which to run the job. (If you don’t select anything, the job runs everyday.) This determines how often XSOAR imports data from CrowdStrike. It’s important to set an interval that allows enough time for the job to complete, considering factors such as the number of devices that are active on the network. You might start by running the job every 15 minutes and then increasing it as necessary until each job completes before the next one starts. You can see the run status of a recurring job on the Jobs page. When in progress, its status isRunning. When done, its status changes toCompleted.Name: Type a name for the job such asCrowdStrike device attributes retrieval.Playbook:Incremental Import of CrowdStrike Falcon - PANW IoT 3rd Party IntegrationIntegration Instance Name: Paste the integration instance name that you copied in the previous step. If this field is empty or an entered name doesn’t match an instance, the job won’t run successfully.Playbook Poll Interval: Enter a number (the value, though unspecified, is minutes) defining the period of time during which IoT Security must see newly discovered devices or network activity from previously discovered devices to import device attributes from CrowdStrike. It’s common to use the same interval as the one for running the recurring job. However, if you increase the interval between jobs, you can set a shorter interval for polling than that for the job. If you leave it blank, the default poll interval is 15 minutes.The default value is 15 minutes, which is the interval that XSOAR will use if the field is left blank.Site Names: Leave the field empty to import device attributes for all sites. To limit imports to devices at one or more sites, enter comma-separated site names.
- ClickCreate new job.XSOAR begins an automated process that retrieves incrementally updated device attributes from CrowdStrike occurring within the last 15 minutes.
- Select the job and clickRun now.The first time you run a job that references an integration instance triggers XSOAR to report the instance to IoT Security, which then displays the integration instance on the Integrations page.
- Continue creating and enabling more integration instances and jobs as needed for IoT Security to import device attributes from other CrowdStrike instances.Be sure to run each job you create at least once to populate the Integrations page with all the integration instances you’re using.
- Return to the IoT Security portal and check the status of the CrowdStrike integration instances you created and enabled.An integration instance can be in one of four states, which you can see in the Status column on the Integrations page:
When you see the status of an integration instance has changed fromDisabledtoActive, its setup is complete.
- Disabledmeans that either the integration was configured but intentionally disabled or it was never configured and a job that references it is enabled and running.
- Errormeans that the integration was configured and enabled but is not functioning properly, possibly due to a configuration error or network condition.
- Inactivemeans that the integration was configured and enabled but no job has run for at least the past 60 minutes.
- Activemeans that the integration was configured and enabled and is functioning properly.
Recommended For You
Recommended videos not found.