CrowdStrike Falcon
Proofroom reads CrowdStrike Falcon with a Falcon API client’s read scopes. Add it on Integrations → Catalogue → CrowdStrike Falcon → Connect.
What each collector shows
| Collector | Kind | Default cadence | What it shows | Suggested controls |
|---|---|---|---|---|
| Anti-malware coverage | snapshot | monthly | Every host with its sensor version, last seen, containment status and the prevention policy applied to it. A policy blocks when its cloud or sensor machine-learning anti-malware slider has a prevention level and quarantine is on (Quarantine & Security Center Registration or Quarantine on write); otherwise it only detects. The slider levels and quarantine settings are shown; a disabled policy is off; a policy assigned but not yet applied is unknown. A sensor in reduced functionality mode shows as out of date. Each agent’s problems are listed: detect only, protection off, not seen for 7 days (or the number you set), out of date; agents whose currency the vendor does not report are counted as currency unknown, not as current. | PCI DSS 5.2.1, 5.2.2, 5.3.1; SOC 2 CC6.8 |
| Endpoint alerts and response | window | monthly | Falcon alerts raised in the window (every product, named in brackets), and high or critical ones (severity 60 and up) raised earlier and not closed. A closed alert’s resolved time is its last update. Counts by severity, median days to resolve, and every high or critical alert still open with its age. | PCI DSS 12.10.5; SOC 2 CC7.2, CC7.3 |
The agent list feeds the Endpoint coverage built-in, which compares it with your device manager’s inventory, and the Endpoints posture score.
Create the API client
- In the Falcon console, go to Support and resources → API clients and keys → Create API client. Name it “Proofroom”.
- Tick Read only for: Hosts, Prevention policies and Alerts. Save.
- Copy the Client ID and Secret; the secret is shown once. Note the Base URL: it tells you the cloud (US-1, US-2, US-3, EU-1, US-GOV-1, US-GOV-2).
If your API clients use an IP allowlist, add this Proofroom server’s outbound address.
Connect
| Field | Value |
|---|---|
| Cloud | From step 3 |
| Client ID, Client secret | From step 3 |
staleDays |
7 by default |
Test connection gets a token and reads one host, one prevention policy and one alert, naming any scope that is refused.
Known limits
- Reading “prevent” from the machine-learning sliders is Proofroom’s reading of the policy, not a CrowdStrike definition. The policy name and slider levels are shown so an auditor can check.
- Falcon reports no sensor currency per host, so “up to date” is unknown unless the sensor is in reduced functionality mode.
- UNVERIFIED: how long a host-list paging token stays valid. A very large estate may need the run retried.
- Rate limits are waited out using CrowdStrike’s
X-RateLimit-RetryAfter.