Skip to main content

Connect CrowdStrike to Anzenna

Integrate Anzenna with CrowdStrike Falcon to monitor endpoint detections, alerts, device inventory, and optionally enable real-time response capabilities.

Prerequisites​

  • CrowdStrike Falcon administrator access
  • Anzenna account

  • Ability to create API clients in CrowdStrike Falcon

Step-by-Step Instructions​

Part 1: Start in Anzenna​

  1. Log into Anzenna and click Connect to CrowdStrike

Part 2: Create an API Client in CrowdStrike Falcon​

  1. Log into CrowdStrike Falcon and click the Menu icon

  1. Click Support and resources

  1. Click API clients and keys

  1. Click Create API client

  1. Type Anzenna as the Client name

Part 3: Configure API Permissions​

  1. Set Alerts to Read

  1. Set Detections to Read

  1. Set Hosts to Read (Write required for remediations)

  1. Set Device Control Policies to Read

  1. Set Host Groups to Read (Write required for remediations)

  2. Set User management to Read

  1. Set NGSIEM to Read and Write

  1. Set Real Time Response to Read and Write, and Real Time Response (admin) to Write

  1. Set Assets to Read (optional). Anzenna uses this to show applications that Falcon Discover saw running on a device without an installation record, such as portable executables. It requires the Falcon Discover module. Without it, Anzenna skips this data and the rest of the integration works as usual.

  1. Click Create

Part 4: Copy Credentials to Anzenna​

  1. Copy the Client ID to clipboard

  1. Paste the Client ID into Anzenna

  1. Copy the Client Secret to clipboard

  1. Paste the Client Secret into Anzenna and click Save

Core Setup Complete!

Anzenna is now connected to CrowdStrike. Continue below to optionally configure Device Control and Real Time Response policies for deeper visibility and remediation.

Part 5: Configure Falcon Device Control Policies (Optional)​

To get file exfiltration information, enable metadata collection in Device Control policies.

  1. Open Falcon Device Control Policies and edit your Windows policy: enable Enhanced file metadata detection and click Save

  1. Switch to Mac policy and repeat: enable Enhanced file metadata detection and click Save

Part 6: Configure Real Time Response Policies (Optional)​

  1. In the side menu, click Host setup and management

  1. Click Response policies

  1. Select Mac policies and open your selected policy for editing

  1. Enable Real Time Response

  1. Enable Custom Scripts

  1. Enable put, run, and put-and-run

  1. Click Save

  1. Repeat these steps for Windows and Linux (if applicable)

Part 7: Enable Falcon Discover on an existing connection (Optional)​

If Anzenna is already connected and you want to see the applications Falcon Discover observed running on a device with no installation record, add the Assets scope to the API client you created earlier. There is no need to create a new client or re-enter credentials in Anzenna.

  1. In CrowdStrike Falcon, open Support and resources then API clients and keys

  2. Find the Anzenna API client and edit it

  3. Set Assets to Read and save

The Client ID and Client Secret do not change, so nothing needs updating in Anzenna. The data appears on the next scheduled run; the first run can take longer while it catches up on history.

This covers Windows devices. Falcon Discover does not report Apple bundle identifiers, so macOS applications cannot be identified from it. It also requires the Falcon Discover module; without it, Anzenna skips this data and the rest of the integration keeps working.

You are all set!

Anzenna is now fully connected to CrowdStrike Falcon.