Tulip's CrowdStrike Falcon integration allows you to:
Fetch CrowdStrike Falcon endpoint security configuration data, such as firewall and prevention policies, ML exclusions, and host groups
Compare CrowdStrike tenants
Add configuration elements to a version control system such as GitHub, BitBucket, or others, via the application connection's settings page in the "Version control" tab
Monitor specific changes of interest, e.g., device control policies, using Tulip's History page with detailed change tracking
Analyze your CrowdStrike Falcon security posture, validate compliance with frameworks like CIS, NIST 800-53, SOC2, and ISO 27001, and automatically remediate common security issues
Provide a structured workflow for changing configuration, integrated with your existing ticket workflow, while assessing operational and security risk of changes
Assist forensics, root cause analysis, and audit processes by showing a complete history of all configuration changes
Supported Types
Exclusions
Cert-based
ML exclusions
Firewall
Firewall Rule Groups and Rules
Custom IOA Rule Groups
Policies
Prevention Policies
Sensor Update Policies
Sensor Visibility Policies
Locations
Cloud Connect Accounts
Connect your CrowdStrike Falcon instance
In the CrowdStrike Falcon menu, go to "Support and resources" --> "API clients and keys", then click on "Create API client".
Add read and write permissions for the following scopes:
Content Update Policy
Correlation Rules
CSPM registration
Custom IOA rules
D4C registration
Channel File Control Settings
Device control policies
Hosts
Assets
Falcon Container Image
Firewall management
Host groups
Identity Protection Policy Rules
IOC Management
Machine Learning Exclusions
Prevention policies
Response policies
IOA Exclusions
Sensor Download
Sensor update policies
Sensor Visibility Exclusions
User management
Workflow
To add CrowdStrike Falcon to Tulip, go to the Applications view, then click the "Connect new application" button in the top right. Enter an app connection name (e.g., "CrowdStrike Production"), click next, then choose "CrowdStrike Falcon" as the application.
You will be asked to provide the base URL (according to the CrowdStrike region of your account, e.g., https://api.us-2.crowdstrike.com), the client ID, and client secret you created.