CrowdStrike Spoke

Manage licenses for CrowdStrike Falcon protection suite by fetching details of devices with active Falcon sensors installed and checking license compliance.

Request apps on the Store

Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the ServiceNow Store version history release notes.

Integration Hub subscription

This spoke requires an Integration Hub subscription. For more information, see Legal schedules - IntegrationHub overview.

Spoke version

CrowdStrike spoke v1.1.0 is the latest version.

Spoke requirements

CrowdStrike account with a Falcon administrator role.

Spoke dependencies

If you’re having trouble installing the app, ensure that these dependent plugins are installed:

• ServiceNow Integration Hub Runtime (com.glide.hub.integration.runtime)
• ServiceNow Integration Hub Action Step - REST (com.glide.hub.action_step.rest)

Note:

Some of these plugins are licensable features and require appropriate licenses when used outside the spoke implementation.

Spoke actions

The CrowdStrike spoke provides actions to automate CrowdStrike tasks when events occur in your ServiceNow instance.

Category	Action	Description
Host Management	Look up Active Hosts	Retrieves all active hosts. Active hosts are the hosts on which the last_seen date is greater than the date provided in the Active Since field.
	Look up Host Details	Retrieves details of the hosts for the Device IDs passed in the Host IDs field.
Sensor Management	Look up Hourly Sensor Usage	Retrieves a daily breakdown of your Customer Identification (CID) average hourly sensor usage by sensor category. Note: The usage data is retrieved up to two days prior to the current date.
	Look up Weekly Sensor Usage	Retrieves a daily breakdown of your CID average weekly sensor usage by sensor category. Note: The usage data is retrieved up to two days prior to the current date.

Note:

This spoke has a Look up User action and Software Asset Management related actions only.

Connection and credential alias requirements

Integration Hub uses aliases to manage connection and credential information. Using an alias eliminates the need to configure multiple credentials and connection information profiles when using multiple environments. If the connection or credential information changes, you don't need to update any actions that use the connection. For more information, see Connections and Credentials.