CrowdStrike Zero Trust Assessment feature must be enabled
This integration requires that the CrowdStrike Falcon Zero Trust Assessment feature is enabled. Without this feature, the ZTA file described below will not be deployed on devices. CrowdStrike customers can ask that this Enterprise functionality be enabled by reaching out to the CrowdStrike customer support team directly.
Prior to following the steps below you can verify this feature is enabled by checking for the contents of the file
%ProgramData%\CrowdStrike\ZeroTrustAsssessment\data.zta (Windows) or
/Library/Application Support/Crowdstrike/ZeroTrustAssessment/data.zta (macOS) on a CrowdStrike endpoint device to confirm that the ZTA file is being created.
Twingate integrates with CrowdStrike so that admins can have it as a requirement to sign in to Twingate or access private resources. When CrowdStrike is selected as a trust method within Device Security, it can be incorporated into Security Policies. Only devices that are verified through the CrowdStrike integration will be considered satisfying the Trusted Profile and thus be allowed to access private resources.
Twingate integrates with CrowdStrike by utilizing the CrowdStrike API to pull a list of devices managed under a specific customer’s tenant. Additionally, the Twingate client accesses the ZTA file on the device, checking its validity and pulling the unique device identifier. If the device is verified to be managed under the customer’s Twingate client, it will be considered CrowdStrike verified in Twingate.
The following scopes are required:
- Hosts: Read
- Zero Trust Assessment: Read
Copy and save the API Client ID and API Client Secret.
Input your API Client ID, API Client Secret, and the Base URL for your CrowdStrike tenant, which were generated in step 1.
After the CrowdStrike integration has been configured, it can be incorporated into Device Security Trusted Profiles.
For macOS or Windows, create a Trusted Profile and require CrowdStrike as a Trust Method. Only devices that have CrowdStrike configured will satisfy the requirements of this Trusted Profile.
The Trusted Profile can now be incorporated into Security Policies.
After the CrowdStrike integration is set up, it can take up to 10 minutes for the initial sync to take place. During this time, devices may be missing the correct CrowdStrike verification state and the Device Integrations page will show that “Waiting to sync”. After this time, devices will correctly show the state on their device details page and the Device Integration page will show the most recent sync time.
In the case of a recoverable error (e.g. the CrowdStrike API is unresponsive), the CrowdStrike integration may show that it has failed to sync. If so, the Device Integrations page will show the time of last successful sync as well as the most recent failure to sync. When we are able to reach the CrowdStrike API, the errors will be resolved automatically.
In the case of a unrecoverable error (e.g. the API client is deleted or the permissions have been altered), the CrowdStrike integration will stop attempting to connect. Admins will be notified via email that the CrowdStrike integration needs attention. For these errors, we recommend reconfiguring the integration and inputting new API client information.
Last updated 3 minutes ago