Already a NinjaOne customer? Log in to view more guides and the latest updates.

Set up CrowdStrike as Your Antivirus in NinjaOne

  • Last Updated November 3, 2026

Topic

This article explains how to deploy CrowdStrike to your devices after you activate the integration in NinjaOne, enable notifications for antivirus activities, and enable your technicians to take action on discovered threats.

Environment

  • NinjaOne integrations
  • CrowdStrike antivirus

Description

With the CrowdStrike integration activated in NinjaOne, the integration is policy-driven. The policy triggers the NinjaOne agent to detect the existing CrowdStrike Sensor installation on the endpoint and automatically install it if the sensor is not present. If a device already has CrowdStrike installed before NinjaOne integration, the NinjaOne agent can read the existing agent ID.

Before you can deploy CrowdStrike as your endpoint antivirus tool, you must enable the integration in NinjaOne. To do so, refer to NinjaOne Integrations: Getting Started With CrowdStrike.

Then, select a category to learn more:

Deploy CrowdStrike at the Policy Level

Selecting CrowdStrike as the policy's antivirus prompts the NinjaOne agent to install the CrowdStrike sensor on the affected endpoint(s).

  1. Go to Administration → Policies and select the policy that needs the CrowdStrike antivirus or create a new one.

  2. Open the Antivirus tab and select CrowdStrike from the drop-down. If another antivirus is already selected, you must first select Disabled before selecting CrowdStrike.

    Important Note: If you are switching from a different antivirus to CrowdStrike, NinjaOne does not uninstall when you change the antivirus. You must go to the antivirus portal to uninstall. If you attempt to install CrowdStrike as your antivirus and the devices associated with that policy already have an antivirus installed, you will receive an activity for that device stating that the CrowdStrike installation failed and you must uninstall the other antivirus.
  3. Select from the options next to Installation to configure.
policy_antivirus_crowdstrike.png
Figure 1: Installation options for the CrowdStrike antivirus in NinjaOne (click to enlarge)
  • If another antivirus software is installed, then notify: Select whether you want to proceed with installation or take no action.
  • If CrowdStrike installation fails, reattempt: You can turn this off by flipping the toggle or setting the schedule to daily (at a specified time) or interval (every [#] hour).
  1. Click Save.

When you set the antivirus to CrowdStrike at the policy level, the CrowdStrike application card displays on the device dashboard in Settings. Click the CrowdStrike Device Link hyperlink to select a specific host to display in the side panel on the CrowdStrike console.

If you deactivate CrowdStrike at the policy level or change the device's policy to one that does not use CrowdStrike, NinjaOne will remove all threats from the device's Health section; however, the CrowdStrike Falcon Sensor will not be uninstalled from those devices until you follow the uninstall instructions from the CrowdStrike Falcon vendor console.

If the installation fails, a notification appears in the Overview tab in the Health section. Click the arrow to use the Retry Install option.

device_retry install.png
Figure 2: Retry a failed installation in NinjaOne (click to enlarge)

Enable Notifications for Activities

  1. Navigate to the policy configuration page.
  2. From the policy Activities tab, expand the CrowdStrike section and click any activity for which you want to enable notifications or create tickets.
CS_policy_activities.png
Figure 3: Configure notification and ticket actions for CrowdStrike in NinjaOne (click to enlarge)
  1. For more about configuring the activity fields, refer to NinjaOne Endpoint Management: Device and System Activity Notification Feed.
  2. Click Save in the policy page to set the changes.

Set User Permissions for CrowdStrike

NinjaOne automatically grants system administrators access to CrowdStrike. To enable other technicians and users, follow the steps below. Additional resource: User Permissions: Permission Options.

  1. Navigate to Administration → Accounts and select a technician account or role.
  2. Open the System tab and select "Allowed" for Configure CrowdStrike.
  3. Click Save.

View CrowdStrike Health Statuses and Activity Logs

Once you install the CrowdStrike Sensor or the NinjaOne agent detects an existing CrowdStrike Sensor, CrowdStrike Falcon activities appear from the NinjaOne organization level down to the device level.

Technicians can filter or search for only CrowdStrike events. These events could include agent installation/uninstallation feedback, threats, and others. NinjaOne continuously monitors the CrowdStrike Sensor of every device in each NinjaOne organization where you deployed CrowdStrike.

NinjaOne identifies and displays potential threats in the Health section of the device dashboard. When a potential threat is detected, NinjaOne links to the threat in CrowdStrike, allowing NinjaOne users to quickly navigate to their CrowdStrike Falcon console for research and threat remediation.

CS health and activity.png
 Figure 4: Location of health status and activity for CrowdStrike in NinjaOne (click to enlarge)
In alignment with updates to CrowdStrike Falcon’s threat reporting model, NinjaOne ingests and tracks threats at the individual threat indicator level rather than grouping them under a single parent detection ID. Threats detected prior to release 16.0.0 will continue to be displayed in groups at the detection ID level (which may represent multiple individual threats) until they are resolved or aged out. Newly ingested threats will automatically benefit from more granular, individual-level tracking.

Take Action on Threats

All threat remediation occurs within the CrowdStrike Falcon console.

When a potential threat is detected, CrowdStrike provides NinjaOne with a unique threat identifier used in remediation. Click the health status on the device dashboard to navigate to the threat in the CrowdStrike platform, where you can take action.

CS remediation.png
 Figure 5: Remediate a threat for CrowdStrike from NinjaOne (click to enlarge)

Once you remediate a threat from within CrowdStrike with one of the status labels listed below, NinjaOne logs the activity and removes the threat from the device Health section in the NinjaOne UI.

CrowdStrike remediation statuses:

  • True Positive
  • False positive
  • Closed
  • Ignored

You can also take action on a threat from the system and/or organization dashboard. Select the affected device from the Devices → Threats tab on the organization dashboard and then click Remediate Threat in CrowdStrike at the top of the list. You can remediate only one threat at a time.

CS_remediate threat from org dash.png
Figure 6: Remediate a threat for CrowdStrike from the NinjaOne organization dashboard (click to enlarge)

Filter for CrowdStrike Activity

Users can filter the activity logs for CrowdStrike events.

  1. On the device dashboard, click the Activities tab and select All.
  2. Select "CrowdStrike" from the Type(s) drop-down to see all CrowdStrike events in the Filter drop-down.

Additional Resources

FAQ

Next Steps