Skip to main content

Connect CrowdStrike to Anzenna

Integrate Anzenna with CrowdStrike Falcon to monitor endpoint detections, alerts, device inventory, and optionally enable real-time response capabilities.

Prerequisites​

  • CrowdStrike Falcon administrator access
  • Anzenna account

  • Ability to create API clients in CrowdStrike Falcon

Step-by-Step Instructions​

Part 1: Start in Anzenna​

  1. Log into Anzenna and click Connect to CrowdStrike

Click on Connect to CrowdStrike

Part 2: Create an API Client in CrowdStrike Falcon​

  1. Log into CrowdStrike Falcon and click the Menu icon

Click on Menu

  1. Click Support and resources

Click on Support and resources

  1. Click API clients and keys

Click on API clients and keys

  1. Click Create API client

Click on Create API client

  1. Type Anzenna as the Client name

Type Anzenna in Client name

Part 3: Configure API Permissions​

  1. Set Alerts to Read

Allow Alerts to be read

  1. Set Detections to Read

Allow Detections to be read

  1. Set Hosts to Read (Write required for remediations)

Allow Hosts to be read

  1. Set Device Control Policies to Read

Allow Device Control Policies to be read

  1. Set Host Groups to Read (Write required for remediations)

  2. Set User management to Read

Allow User management to be read

  1. Set NGSIEM to Read and Write

Allow Access to NGSIEM

  1. Set Real Time Response to Read and Write, and Real Time Response (admin) to Write

Allow Real Time Response Access

  1. Click Create

Click on Create

Part 4: Copy Credentials to Anzenna​

  1. Copy the Client ID to clipboard

Click on Copy to clipboard
  1. Paste the Client ID into Anzenna
Paste the copied client ID into input

  1. Copy the Client Secret to clipboard

Click on Copy to clipboard on client secret

  1. Paste the Client Secret into Anzenna and click Save

Paste the client secret in Anzenna Click on Save
Core Setup Complete!

Anzenna is now connected to CrowdStrike. Continue below to optionally configure Device Control and Real Time Response policies for deeper visibility and remediation.

Part 5: Configure Falcon Device Control Policies (Optional)​

To get file exfiltration information, enable metadata collection in Device Control policies.

  1. Open Falcon Device Control Policies and edit your Windows policy — enable Enhanced file metadata detection and click Save

Open The Falcon Device Control Policies Edit Windows Device Control Policy

  1. Switch to Mac policy and repeat — enable Enhanced file metadata detection and click Save

Edit Mac Device Control Policy Edit Mac Device Control Policy save

Part 6: Configure Real Time Response Policies (Optional)​

  1. In the side menu, click Host setup and management

In the side menu, click on Host setup and management

  1. Click Response policies

Click on Response policies

  1. Select Mac policies and open your selected policy for editing

Select Mac policies Open Your Selected Policy for Editing

  1. Enable Real Time Response

Enable Real Time Response

  1. Enable Custom Scripts

Enable Custom Scripts

  1. Enable put, run, and put-and-run

Enable put Enable run Enable put-and-run

  1. Click Save

Click on Save

  1. Repeat these steps for Windows and Linux (if applicable)

Repeat These Steps for Windows and Linux
You are all set!

Anzenna is now fully connected to CrowdStrike Falcon.