CrowdStrike Integration
Last updated
Was this helpful?
Last updated
Was this helpful?
Resmo streamlines real-time cybersecurity monitoring by leveraging APIs and webhooks, enabling immediate data retrieval, updates, and alert notifications about your CrowdStrike resources.
Use Resmo's SQL capabilities to ask complex questions about your CrowdStrike data, including user roles, permissions, host configurations, policy details, detection metrics, and sensor configurations.
Stay alert to changes in user roles and permissions within the CrowdStrike platform, getting notifications when new users are added or when existing roles and permissions are updated.
Receive alerts when changes occur in host statuses, policies, or group memberships.
Ensure real-time monitoring of detection statuses and updates, with alerts for any new detections or status changes, enhancing your ability to respond to potential threats promptly.
Resmo utilizes APIs to process initial data retrieval, collecting pre-existing resources from CrowdStrike. Following this initial accumulation of data, it maintains an up-to-date record by instantaneously capturing updates and changes through the use of webhooks and regular polling.
Find and select CrowdStrike from your Integrations page on Resmo.
Hit the Add Integration button from the bottom right corner.
Log in to your CrowdStrike account on a new tab.
Open Support and Resources from the left side menu, then select API clients and keys under Resources and Tools.
Enter the client name and description for the client. Then, select the following API scopes:
Detections -> Read
Device control policies -> Read
Hosts -> Read
Firewall management -> Read
Host groups -> Read
Prevention policies -> Read
Response policies -> Read
Sensor download -> Read
Sensor update policies -> Read
User management -> Read
Select the cloud environment for your CrowdStrike (e.g., US-2), which can be seen in the base URL.
Copy the Client ID and paste it into the related field on your Resmo-CrowdStrike integration screen.
Next, copy and paste the Client Secret for your Oauth app in the related field.
Click Create, and your CrowdStrike integration will be ready in a few minutes.
Select CrowdStrike on your Integrations page.
Navigate to the Connected Integrations tab on the opening modal.
Select the integrated account you want to remove.
Integrations can either be temporarily disabled or permanently deleted.
Click the Disable or Delete button based on your choice.
