question Re: Crowdstrike Falcon Endpoint for Security Incident - API Rate Limit being crossed in SecOps forum

Crowdstrike Falcon Endpoint for Security Incident - API Rate Limit being crossed

Community Alums — Mon, 22 Apr 2024 22:39:58 GMT

We are trying to integrate ServiceNow with Crowdstrike Falcon Endpoint for Security Incident but integration gets disabled each day or so. Integration works for sometime but then it fails. In logs we are receiving error that Rate Limit has increased.

We raised a case with Crowdstrike as plugin is supported by them. Their answer was that all ServiceNow customers connecting through this plugin is striking same CrowdStrike endpoint hence API RATE Limit is being crossed. They suggested us to use Mid Server for API Call.

This seems ridiculous design to me but anyway we configured OAuth authentication to go through Mid Server but I do not think there is any way to send actual REST API calls (to get Detections/Incidents/Behaviors) through Mid Server. Our customer contends that ServiceNow must send all API Calls through Mid Server for this integration to work. Please correct me , If my udnerstanding is wrong

My thinking is that CrowdStrike being major player on Security Scan side and ServiceNow being major player on Ticketing side, There would be many customers who use this integration and might have faced this issue. Is there anyone who can help me in solving this puzzle ?

Re: Crowdstrike Falcon Endpoint for Security Incident - API Rate Limit being crossed

Tim Boswell — Tue, 23 Apr 2024 15:14:40 GMT

There are many customers using the CrowdStrike+ServiceNow integration, and I've not heard this from any of them, can you please request a case with ServiceNow Tech Support?

Re: Crowdstrike Falcon Endpoint for Security Incident - API Rate Limit being crossed

Tim Boswell — Tue, 23 Apr 2024 15:21:30 GMT

I've also double-checked the install guide, and nowhere does it mention Mid Server requirement: https://store.servicenow.com/sn_appstore_store.do#!/store/application/022ade67db1bc740bc1fd001cf96193c/1.2.2?referer=%2Fstore%2Fsearch%3Flistingtype%3Dallintegrations%26q%3Dcrowdstrike%26searchDetail%26pagetype%3Dintegration&sl=sh

Re: Crowdstrike Falcon Endpoint for Security Incident - API Rate Limit being crossed

Community Alums — Tue, 23 Apr 2024 21:02:43 GMT

I have raised the ServiceNow HI Case. First time I heard this from Crowdstrike, I was kind of laughing. Hopefully this is not the issue.

Re: Crowdstrike Falcon Endpoint for Security Incident - API Rate Limit being crossed

Milindsecops — Tue, 14 May 2024 05:24:15 GMT

Hi @Community Alums

Thank god, there is some discussion happening on this side of integration.
This is the only post highlighting the issue.

As a customer who have integrated the falcon endpoint for security with servicenow, I can confirm this is definitely a thing - we have been facing this for almost 3 months.
I have a open case with CS on this currently,
but @Tim Boswell can you please check this from servicenow side as well.

Thanks

Re: Crowdstrike Falcon Endpoint for Security Incident - API Rate Limit being crossed

vilmarsteur — Thu, 30 May 2024 07:14:12 GMT

@Community Alums

Thank you for posting this question, we are also contemplating to use this integration. Is the issue solved in mean time?

Re: Crowdstrike Falcon Endpoint for Security Incident - API Rate Limit being crossed

Milindsecops — Mon, 03 Jun 2024 03:12:16 GMT

Just adding:
We had our issue resolved- CS team had pushed a updated version around Mid of May , which includes to disable the connection timeout logic - which i believe was the issue from the start within our environment.

Re: Crowdstrike Falcon Endpoint for Security Incident - API Rate Limit being crossed

eviljack — Sat, 13 Jul 2024 08:05:01 GMT

Same problem here, I use mid server and it is ok. After installing that mentioned update I had to reconfigure all application to correct endpoints from api.crowd to our api.eu-1. because it didnt reflected. Looks ok now.