CrowdStrike Falcon - Add/Remove Assets to/from Host Group

CrowdStrike Falcon - Add/Remove Assets to/from Host Group (previously Add/Remove Hosts from Crowdstrike Host Group) adds or removes each of the devices from a Crowdstrike Host Group that are the result of the saved query supplied as a trigger (or devices selected in the asset table).

To configure CrowdStrike Falcon - Add/Remove Assets to/from Host Group, from the Action Library, select Execute Endpoint Security Agent Action, and then select CrowdStrike Falcon - Add/Remove Assets to/from Host Group, or search for the action in the Action Library Search pane.

Connection Settings

1. CrowdStrike Domain (required) - The hostname of the API server – this could be one of the following:
   • https://falconapi.crowdstrike.com (for "legacy" API)
   • https://api.crowdstrike.com or https://api.us-2.crowdstrike.com (for the latest API)
2. User Name / Client ID and API Key / Secret (required) - The credentials for a user account that has the Required Permissions to fetch assets.

Action Settings

1. Action type (required) - Select either Add Hosts or Remove Hosts.
2. Host Group ID (required) - The ID of the host group to which the asset will be added or from which it will be removed.

Required Ports

Axonius must be able to communicate with the values supplied in Connection Settings via the following ports:

• TCP Port 443

Required Permissions

The values supplied in Username / Client ID and API Key / Secret must have host-group write permissions.