CrowdStrike is a cloud security tool with products including endpoint protection and cloud monitoring. You can connect CrowdStrike to Vanta to ensure user access to CrowdStrike is managed following your company's policies. You can also connect to CrowdStrike Spotlight to ingest and display vulnerabilities on the vulnerabilities page.
Please note: If you have already integrated with CrowdStrike and you need to update the permissions, you may skip many of the steps in the instructions below and edit the existing Vanta Client in CrowdStrike.
About this Integration
This integration automates the collection of evidence for vulnerability scan results and proof of subsequent vulnerability remediation within your committed SLAs.
Vanta requires read-only access to user, hosts, and policies information through OAuth.
Estimated setup time: Less than 10 minutes
Use Cases
Connecting CrowdStrike will allow Vanta to perform the following tests:
Ensure CrowdStrike accounts are linked in Vanta
Ensure CrowdStrike accounts are deprovisioned when personnel leaves
Critical vulnerabilities identified in packages are addressed
CrowdStrike hosts have a non empty prevention policy
CrowdStrike is installed on all cloud instances
CrowdStrike is installed on all workstations
High vulnerabilities identified in packages are addressed
Low vulnerabilities identified in packages are addressed
Medium vulnerabilities identified in packages are addressed
Requirements
You'll need access Falcon Spotlight vulnerability management solution (additional add-on)
Administrator permissions to set up an API Client
1. Set up an API Client in CrowdStrike
You'll need Falcon Administrator permissions to set up an API Client.
Using the top-left menu, navigate to Support and Resources and select API Clients and keys.
Create a new API Client by clicking Add new API client
Wait to exit the Add new API client window until you finish setting up the CrowdStrike integration in Vanta.
Name the client a recognizable name, e.g., "Vanta Client." You can leave the description blank.
In the API Scopes section, check the boxes User Management, Hosts, and Prevention Policies in the Read Column. This will grant Vanta read-only access to User information in CrowdStrike. Click Add to create the API Client.
CrowdStrike will show you the three pieces of data you need to connect CrowdStrike to Vanta. Don't exit the window where these data are shown -- you'll need them to connect to Vanta.
Client ID: The public API Client ID
Client Secret: A secret shared between CrowdStrike and Vanta. This secret is only shown once.
Base URL: The URL Vanta will use for API requests. This is usually https://api.crowdstrike.com, but it may be different for your instance.
2. Connect CrowdStrike to Vanta
In a separate window or tab, open Vanta and navigate to Integrations
Search for CrowdStrike in the Available Integrations section and select Connect
Paste the Client ID, Client Secret, and Base URL from the previous steps into Vanta.
Click Done. Vanta will now fetch data from CrowdStrike regularly.
Monitoring Access
You can use Access to see which users are authorized to access your CrowdStrike instance and which roles these users are assigned.
Vanta will also run tests to ensure that you've linked users in CrowdStrike with users in Vanta and removed users from CrowdStrike when they are offboarded.
Monitoring Device Security
When using CrowdStrike as the antivirus solution on an MDM monitored computer, Vanta will test to ensure CrowdStrike is installed on your monitored devices.
To pass the test, all monitored devices must be scoped into Vanta from both the MDM and CrowdStrike integrations.
For more information about resource scoping in Vanta, see our documentation here
Monitoring Vulnerabilities
You can also use the CrowdStrike integration to monitor for vulnerabilities from CrowdStrike Spotlight. If you have not enabled the CrowdStrike integration already, ensure that you enable Spotlight during configuration.
If you have already enabled the CrowdStrike integration and want to ingest vulnerabilities, you will need to reconnect the integration and select Spotlight during configuration.
For more information on vulnerability management in Vanta, see our documentation here
Updating an Existing API Client
Do the below if you have already integrated but need to add more permissions to the Vanta Client.
You'll need Falcon Administrator permissions to set up an API Client.
Using the top-left menu, navigate to Support and resources followed by API Clients and Keys.
Edit the Vanta API Client
In the API Scopes section, check the boxes User Management, Hosts, and Prevention Policies in the Read Column. This will grant Vanta read-only access to User information in CrowdStrike. Click Add to create the API Client.
Click Save
Permissions
Vanta accesses the following data from your CrowdStrike account:
Vanta will be able to view:
Data about your users
Data about your user details
Data about your user groups
Crowdstrike Monitored Host
Crowdstrike Prevention Policy
Crowdstrike Vulnerability Management Vulnerability
Vanta will be able to change:
N/A