NinjaOne Integrations: Enable CrowdStrike

Topic

NinjaOne integrates with CrowdStrike Falcon (FalconInsight XDR and Falcon Prevent), an integrated cloud-based endpoint detection and response (EDR) and endpoint protection platform (EPP) solution.

Environment

• NinjaOne Integrations
• CrowdStrike

Description

The CrowdStrike integration is policy-driven from within NinjaOne when activated. NinjaOne maps organizations automatically to CrowdStrike Dynamic Host Groups (groups of standard devices) based on Falcon Grouping tags.

The policy triggers the NinjaOne remote monitoring and management (RMM) agent to detect the existing CrowdStrike Sensor installation on the endpoint and automatically install it if the sensor is not present. If a device already has CrowdStrike installed before you activate the integration, the NinjaOne agent can read the existing agent ID.

View additional tutorials in our video library.

Select a category to learn more:

• Before You Begin
• Prerequisites
• Main Features
• Activate the CrowdStrike Integration
• Map NinjaOne Organizations to CrowdStrike Host Groups
• Configure API Scopes for Multi-tenancy
• Additional Resources

Before You Begin

When deploying the CrowdStrike Falcon integration, it's important to keep the following information in mind:

• The available Falcon Sensor version is 7.19.18910 on Microsoft Windows and Apple macOS.
• NinjaOne does not support CrowdStrike installation tokens. Instead, this process will use access tokens.
• NinjaOne does not uninstall the antivirus from devices if you deactivate CrowdStrike in NinjaOne.
• NinjaOne uses the generally available version of the CrowdStrike Falcon Sensor cached installer, as it is known to be compatible with devices. The NinjaOne CrowdStrike integration follows CrowdStrike Falcon sensor policies so that the Falcon sensor will be upgraded or downgraded after installation, depending on your CrowdStrike settings.

Prerequisites

You must meet the following requirements before proceeding with the integration:

• Maintain an existing CrowdStrike Falcon license.
• Be able to generate Application Programming Interface (API) tokens in the CrowdStrike Falcon console.
• Have access to CrowdStrike applications: Falcon Prevent and Falcon Insight XDR (extended detection and response).
• Have a CrowdStrike parent account (NinjaOne does not currently monitor inherited accounts in CrowdStrike Flight Control for organizations).

If your CrowdStrike instance requires the allowlisting of Internet Protocol (IP) addresses, refer to NinjaOne Global Allowlist Information.

Main Features

The CrowdStrike integration in NinjaOne provides the following benefits.

• Access CrowdStrike Sensor activity logs on the organization and device dashboards. When the API client scope is missing, an event log returns in the Activities tab on the dashboard.
• Manage CrowdStrike multi-tenant client authentication or host groups.
• Review device details and the health section for threats, viruses, and installation issues. When CrowdStrike detects a device threat, NinjaOne immediately displays an alert. By clicking the alert in NinjaOne, the technician can navigate to that device in the CrowdStrike console for investigation and remediation.

Activate the CrowdStrike Integration

To activate the CrowdStrike integration in NinjaOne, perform the following steps:

1. Navigate to Administration → Apps and click Add Apps. Select CrowdStrike from the list of available third-party apps.

Figure 1: Add third-party apps in NinjaOne

The application settings page displays.

2. Click Enable—the application setup dialog displays.
3. Thoroughly read the terms outlining the migration process in the CrowdStrike Setup dialog, and then select the checkbox to activate the Accept button.
4. Navigate to https://falcon.{domain}.crowdstrike.com/support/api-clients-and-keys (base URL will differ based on geo-location or cloud license) and select an API client or create a new one. You can reset your client secret from this page if you have forgotten it. Enter the required details to confirm your API client and then provision your API scopes:

• Each API client is assigned one or more API scopes. Scopes are permissions that specify the endpoints and methods an API client can access. When creating an API client, choose from Read and Write actions that you can execute on different groups of API endpoints. The scopes you set are applied to access tokens generated by the API client credentials, and access is granted only to those endpoints authorized for use.

• API clients have one or more API scopes. Scopes grant access to specific CrowdStrike APIs and define the actions an API client can perform. Use scopes to fine-tune the permissions of your API clients. OAuth 2.0 access tokens scope to the resources configured in the API client.

  If an API Client does not have the minimum permissions scoped to it, the integration may not be functional. At a minimum, ensure you provision the following scopes to the API Client. These scope permissions are necessary for the integration to be successful.

Scopes required on version 7.0:

5. Click Enable.

Your CrowdStrike status should now show as activated and connected, and you can check whether the authentication credentials used are valid by clicking the Edit button in the Settings widget.

Figure 2: CrowdStrike integration status in NinjaOne

Map NinjaOne Organizations to CrowdStrike Host Groups

The "mapping" process associates NinjaOne organizations with CrowdStrike Host Management Groups, ensuring that the proper device group or policy is set and that reporting is available in NinjaOne. This process is automated and performed without user or administrator interaction.

When you activate the CrowdStrike integration in NinjaOne, Host Management Groups are automatically created in CrowdStrike for every existing NinjaOne organization as soon as you activate the CrowdStrike integration. Creating a Host Group in CrowdStrike does not require enabling it in the policy or deploying the CrowdStrike antivirus. These new Dynamic Group Hosts reflect the organization name used in NinjaOne and are seamlessly updated when NinjaOne organizations are created or deleted.

NinjaOne assigns a Falcon Grouping Tag (unique identifier) to any device with the NinjaOne agent and a CrowdStrike Sensor installed in the NinjaOne organization. Tagging allows activities and threats to be properly associated with the corresponding CrowdStrike Host Group.  

Configure Technician Notifications or Tickets for CrowdStrike Errors

Credentials experiencing temporary authentication failures will show as Verifying while automated background retries are attempted. Error notifications inform administrators when an action cannot proceed while credentials are being verified. If your end users encounter invalid credentials for the CrowdStrike and NinjaOne integration, you can configure system activities in NinjaOne to send alerts to technicians or to create tickets for resolution.

If invalid credentials result from HTTP status codes 403 or 401, this will trigger the Invalid CrowdStrike Credential activity. However, if the NinjaOne agent determines that a missing API client scope caused Error 403, it will trigger the CrowdStrike Integration Missing API Client Scope with the corresponding API client scope in the message.

Use the instructions described in NinjaOne Endpoint Management: Device and System Activity Notification Feed to configure the Invalid CrowdStrike Credential and CrowdStrike Integration Missing API Client Scope activities.

Configure API Scopes for Multi-tenancy

If you are using multi-tenancy in NinjaOne, you must set up new scopes for the API client. To learn more, refer to NinjaOne and CrowdStrike: Multi-tenancy Integration.

Additional Resources

To learn more about the NinjaOne integration with CrowdStrike, refer to the following resources:

• CrowdStrike Antivirus – NinjaOne Dojo
• Integrations and Third-Party Apps: Resource Catalog