CrowdStrike Falcon End Point Protection, is a popular enterprise grade security platform offered by CrowdStrike ,that helps organization with a centralized management system through which security administrators can monitor, protect, and investigate vulnerabilities across all endpoints, including computers, mobile devices, servers and connected devices.
The Solution unifies the technologies required to successfully stop breaches, including true next-gen antivirus and endpoint detection and response (EDR), managed threat hunting, and threat intelligence automation, delivered via a single lightweight agent.
CrowdStrike Falcon Architecture
ServiceNow already offers an integration with CrowdStrike Falcon, for security related use cases through the Sec Ops Product . You can read them here.
In addition, ServiceNow SAM offers an integration with CrowdStrike through the SaaS License Management Integration. More on this here.
The Outcomes from this feature are as follows:
- Determine the License compliance for CrowdStrike Falcon End Point Protection Products viz. Falcon Pro, Falcon Enterprise etc.
- Showcase weekly and average number of active sensors deployed, which provides more context to SAM Managers
- Provide Remediation Actions for customers to become compliant
Licensing Model used by CrowdStrike
License usage is based on an average of peak usage of active sensors. Specifically, CrowdStrike takes the count of all unique Host IDs in a 7-day period, do that for the prior 4 weeks, and take the average.
Active Sensors are those that are registered with the CrowdStrike Cloud, each device where the agent registers with the CS cloud is marked active.
Example as below:
Solution Architecture of CrowdStrike and ServiceNow SAM Integration
On ServiceNow SAM
Using the SaaS License Integration, SAM Manager can determine the License compliance of CrowdStrike Falcon End Point Solutions. In addition, they can determine the Average Sensor Count and List of Active Sensors to get more context om how Licenses were calculated.
Lastly, based on purchased rights and Licenses required- automatic Remediation Actions are generated for SAM Managers to act on the same.
SAM Workspace showcasing CrowdStrike License Compliance
List of Active Sensors shown on ServiceNow SAM
2 Comments
