NinjaOne Integrations: CrowdStrike Falcon Complete Provisioning for Multi-Tenancy

Topic

This article explains how to set up multi-tenancy for your CrowdStrike integration in NinjaOne if you use Falcon Complete.

Environment

• NinjaOne Integrations
• CrowdStrike Falcon Complete

Description

Falcon Complete is a managed detection and response (MDR) service offered by CrowdStrike. NinjaOne supports provisioning Falcon Complete companies for CrowdStrike multi-tenancy, and this article provides the required workflow for configuration. This article assumes you have already  created a parent CID as described in NinjaOne and CrowdStrike: Multi-tenancy Integration,

• Prerequisites
• Create Falcon Complete Credentials
• Enter the New Client Credentials
• Mapping NinjaOne Organizations to CrowdStrike Customers
• Manage Your Mapping Configurations
• Additional Resources

Prerequisites

You will need two sets of credentials to set up the multi-tenancy CrowdStrike integration with Falcon Complete. First, set up the CrowdStrike integration as described in NinjaOne and CrowdStrike: Multi-tenancy Integration, and complete the section titled "Enable Multi-tenancy." After you complete those steps and return to the NinjaOne integration, you'll see a banner indicating that Falcon Complete provisioning is incomplete. You'll then need to click Add Authentication Credentials and enter the Falcon Complete credentials you'll create in the steps below.

Create Falcon Complete Credentials

NinjaOne leverages CrowdStrike Flight Control APIs (application programming interfaces) to implement a multi-tenant architecture for the integration. The multi-tenancy feature allows companies to act as a parent account and manage their customers as child components. 

To create the child CID for Falcon Complete, follow these steps:

1. Log in to your account in CrowdStrike. 
2. Change the scoped Customer ID (CID) in the top right corner of the page to one suffixed with -FC parent. You will need to generate an API client for this new client ID.

3. Select Support and resources, and then click API client and keys to generate a new set of partner account API credentials.

4. Click Create API client. Provide a unique identifier for the client name and use the following table to complete the applicable fields. 

5. Click Create.

Enter the New Client Credentials

You can now enter the new Falcon Complete client you have created into NinjaOne by clicking Add Authentication Credentials on the CrowdStrike Integration page in NinjaOne as follows.

1. From the CrowdStrike configuration page in NinjaOne, open the Mappings tab and click Add customer.
2. Complete all required fields and select Falcon Complete from the MSSP bundle drop-down menu. Click Create. 
3. NinjaOne will validate the information to ensure that no duplicate or invalid data is provided (this usually takes approximately 30 minutes to complete).
4. Refresh the CrowdStrike configuration page in NinjaOne. You should see a banner stating that Falcon Complete credentials must be provided. 
5.  In the Falcon Complete Provisioning Incomplete banner, click Add authentication credentials.
6. Enter the credentials and click Submit Credentials.

Mapping NinjaOne Organizations to CrowdStrike Customers

The "mapping" process associates NinjaOne organizations with CrowdStrike CIDs, ensuring the proper device group or policies are set and reporting in NinjaOne. Only system administrators and technicians with permissions enabled for System → Configure CrowdStrike can manage mapping settings. 

When NinjaOne obtains the CrowdStrike-enabled policy, this includes the Custom ID Checksum (CCID) for the specified child CID and enables the correct CCID to be tagged during installation for each host.

To initiate the mapping process, perform the following steps: 

1. From the CrowdStrike configuration page in NinjaOne, open the Mappings tab and click Add customer.
2. Complete all required fields and select Falcon Complete from the MSSP bundle drop-down menu. Click Create. 

NinjaOne will validate the information to ensure that no duplicate or invalid data is provided (this usually takes approximately 30 minutes to complete).

3. Refresh the CrowdStrike configuration page in NinjaOne. You should see a banner stating that Falcon Complete credentials must be provided. 
4. Click the link and input the credentials that you generated in the previous section. 

Once you provide valid credentials, you can map users to their previously created Falcon Complete company.

Manage Your Mapping Configurations

In addition to adding the mapping configurations, you can remove and confirm pending operations from the CrowdStrike Mappings page.

There are three statuses for mapped configurations:

To manage your mappings, select an option to learn more:

• Add Mapping
• Remove Mapping
• Confirm Pending Operations

Add Mapping

To add mapping for your customers, select the checkbox next to one or more unmapped organizations. Click the Add mapping button that appears after you select the checkbox.

In the Add mapping configuration dialog, select the CrowdStrike customer from the drop-down menu and click Add.

Remove Mapping

Once a mapping has been confirmed, you can remove it by selecting the checkbox next to the organization name and then clicking the Remove mapping button. The Remove mapping dialog will display, and you must click Remove to confirm.

Confirm Pending Operations

If a mapping status reflects a Needs confirmation status, select the checkbox next to the organization name and then click Confirm mapping. 

When the Confirm selected mapping modal displays, ensure the correct CrowdStrike customer is populated and click Confirm. If the dialog shows the incorrect customer, you can use the drop-down menu to select a different one.

Additional Resources

Refer to Integrations and Third-Party Apps: Resource Catalog to learn more about third-party applications that can integrate with NinjaOne.