CrowdStrike Falcon - Create User

CrowdStrike Falcon - Create User creates users in CrowdStrike Falcon for:

• Users that match the results of the selected saved query, and match the Enforcement Action Conditions, if defined.

General Settings

• Use stored credentials from CrowdStrike Falcon adapter - Select this option to use CrowdStrike Falcon connected adapter credentials. (add a link to adapter, only write the first when the select adapter is not there)
  • When you select this option, the Select Adapter Connection drop-down is available, and you can choose which adapter connection to use for this Enforcement Action.

📘

Note

To use this option, you must successfully configure a CrowdStrike Falcon adapter connection. Full link to adapter when relevant

Required Fields

These fields must be configured to run the Enforcement Set.

• Compute Node - The Axonius node to use when connecting to the specified host. For more details, see Working with Axonius Compute Nodes.

Additional Fields

These fields are optional.

• Draft - Create the user only in Axonius.
• Email Address - The email address of the user.
• First Name - The first name of the user.
• Last Name - The last name of the user.
• Customer ID (CID) - The customer ID (CID) where the user will be added.
• Password - The password of the user.
• Validate Only - When selected, the user attributes are validated without actually creating the user.
• Justification reason - The justification for creating this user.

💡

Connection and Credentials

When Use stored credentials from the adapter is toggled off, some of the connection fields below are required to create the connection, while other fields are optional.

• Gateway Name - Select the Gateway through which to connect to perform the action.

APIs

Axonius uses the CrowdStrike API.

Required Ports

Axonius must be able to communicate via the following ports:

• TCP Port 443

Required Permissions

The account used to access CrowdStrike must have user management write permissions.