Configure CrowdStrike Falcon Identity Protection for Arctic Wolf monitoring

You can configure CrowdStrike Falcon® Identity Protection to send the necessary logs to Arctic Wolf® for security monitoring.

Note: If you are configuring log monitoring for CrowdStrike Falcon endpoint and CrowdStrike Falcon Identity Protection, you only need to complete these instructions once.

These resources are required:

  • A Falcon Administrator role for the CrowdStrike Falcon environment that you want Arctic Wolf to monitor.
  • A CrowdStrike Falcon Complete license, including the Falcon Next-Gen Identity Security add-on.

    For more information about pricing, see CrowdStrike pricing.

Create the API client

  1. Sign in to the CrowdStrike Falcon platform.
  2. Navigate to Support and resources > API clients and keys Support and resources.
  3. Click Create API client.
  4. In the Create API client dialog, configure these settings:
    • Client name — Enter a name for the API client.
    • Description — (Optional) Enter a description.
  5. In the API client scopes section, select Read access for all scopes, including the Alerts scope.
  6. Click Create.
  7. Copy these values, and then save them in a safe, encrypted location to provide to Arctic Wolf later:
    • Client ID
    • Secret
    • Base URL
      Note:

      The API client secret is only available to view during the API client creation. If this information is lost before you provide it to Arctic Wolf, you must create a new client to get a new API client secret.

  8. Click Done.

Provide CrowdStrike Falcon Identity Protection credentials to Arctic Wolf

Note:

Time-based events are polled with a delay to make sure that data is available. If API credentials fail, for example due to expired credentials, Arctic Wolf notifies you and requests a new set of credentials. Provide refreshed credentials promptly to ensure complete data polling and coverage.

  1. Sign in to the Arctic Wolf Unified Portal.
  2. ナビゲーションメニューで、［データ収集］ > ［クラウドセンサ］をクリックします。
  3. Click Add Account +.
  4. On the Add Account page, click CrowdStrike.
  5. Configure these settings:

    • Account Name — Enter a unique and descriptive name for the account.

    • Client ID — Enter the client ID from Create the API client.
    • Client Secret — Enter the secret from Create the API client.
    • API Hostname — Enter base URL from Create the API client.

    • Credential Expiry — Enter the credential expiration date, if applicable.

  6. Click Test and submit credentials.