CrowdStrike Configuration

Background

Twingate integrates with CrowdStrike so that admins can have it as a requirement to sign in to Twingate or access private resources. When CrowdStrike is selected as a trust method within Device Security, it can be incorporated into Security Policies. Only devices that are verified through the CrowdStrike integration will be considered satisfying the Trusted Profile and thus be allowed to access private resources.

How it works

Twingate integrates with CrowdStrike by utilizing the CrowdStrike API to pull a list of devices managed under a specific customer’s tenant. Additionally, the Twingate client accesses either the Crowdstrike Agent ID on the device or the ZTA file, checking its validity and pulling the unique device identifier. If the device is verified to be managed under the customer’s Twingate client, it will be considered CrowdStrike-verified in Twingate.

Configuring the CrowdStrike integration in Twingate

1. In the CrowdStrike Falcon platform, generate a new API client token

The following scopes are required:

  • Hosts: Read
  • Zero Trust Assessment: Read

Copy and save the API Client ID and API Client Secret.

2. In Twingate, navigate to Settings and then select Device Integrations

3. Select “Connect” next to CrowdStrike

Input your API Client ID, API Client Secret, and the Base URL for your CrowdStrike tenant, which were generated in step 1.

4. The Device Integrations page will now show the current status of the integration

Incorporating CrowdStrike into Security Policies

After the CrowdStrike integration has been configured, it can be incorporated into Device Security Trusted Profiles.

For macOS, Windows, or Linux (requires version 2024.018+), create a Trusted Profile and require CrowdStrike as a Trust Method. Only devices that have CrowdStrike configured will satisfy the requirements of this Trusted Profile.

The Trusted Profile can now be incorporated into Security Policies.

Troubleshooting

After the CrowdStrike integration is set up, it can take up to 10 minutes for the initial sync to take place. During this time, devices may be missing the correct CrowdStrike verification state and the Device Integrations page will show that “Waiting to sync”. After this time, devices will correctly show the state on their device details page and the Device Integration page will show the most recent sync time.

In the case of a recoverable error (e.g. the CrowdStrike API is unresponsive), the CrowdStrike integration may show that it has failed to sync. If so, the Device Integrations page will show the time of last successful sync as well as the most recent failure to sync. When we are able to reach the CrowdStrike API, the errors will be resolved automatically.

In the case of a unrecoverable error (e.g. the API client is deleted or the permissions have been altered), the CrowdStrike integration will stop attempting to connect. Admins will be notified via email that the CrowdStrike integration needs attention. For these errors, we recommend reconfiguring the integration and inputting new API client information.

Last updated 2 months ago