CrowdStrike Falcon
Your agent works in CrowdStrike Falcon with your key, and never holds it.
- 7 days free
- Cancel anytime
- Nothing to install
- Kind of work
- Monitoring and incidents
- How you connect
- Client ID and secret
- What waits for you
- Nothing, until you turn on asking
What your agent can do there
Read errors, logs and metrics, open and resolve incidents.
- endpoint security
- EDR
- detections
- alerts
- hosts
- threat intelligence
- incident response
- vulnerabilities
- IOC
At the provider
Technical details
- Hosts
- api.crowdstrike.com, api.us-2.crowdstrike.com, api.eu-1.crowdstrike.com, api.laggar.gcw.crowdstrike.com, api.us-gov-2.crowdstrike.mil
- Key type
- oauth2-cc
- Key goes in
- Authorization
Which calls read, write or destroy
| When | Class |
|---|---|
| GET HEAD ^/(aidr/(entities|queries)/executions/v1|aspm-api-gateway/api/v1/executor_nodes(/metadata|/[^/]+/instances/csv)?|container-security/combined/runtime-detections/v2|faas-gateway/entities/execution-request-body/v2|loggingapi/entities/saved-searches/execute/v1|workflows/combined/(executions|triggers)/v1|workflows/entities/execution-results/v1)$ | read |
Without a matching rule, GET, HEAD and OPTIONS read, POST, PUT and PATCH write, and DELETE and any other method destroy. A recipe rule only raises a GET the vendor changes something with to a write. No recipe rule makes a call destructive.
Token IP filtering
If the provider can limit a token to IP addresses, allow Sallyport's outbound address. The connection form shows it, ready to copy.
Bring a service the catalogue has never seen
Add its web address and your key, and your agent uses it like any of the 827. If your agent runs into a service you haven’t added, it sends you a link.
- 7 days free
- Cancel anytime
- Nothing to install