Add/Remove Host from CrowdStrike Falcon Host Group
  • 10 Feb 2022
  • 1 Minute to read
  • Dark
    Light
  • PDF

Add/Remove Host from CrowdStrike Falcon Host Group

  • Dark
    Light
  • PDF

Add/Remove Hosts from Crowdstrike Host Group adds or removes each of the devices from a Crowdstrike Host Group that are the result of the saved query supplied as a trigger (or devices selected in the asset table).

To configure the Add/Remove Hosts from Crowdstrike Host Group action, from the Action Library, select Execute Endpoint Security Agent Action, and then select Add/Remove Hosts from Crowdstrike Host Group, or search for the action in the Action Library Search pane.

NOTE

To use the actions below, you must successfully configure a CrowdStrike Falcon adapter connection.

Connection Settings

  1. CrowdStrike Domain (required) - The hostname of the API server – this could be one of the following:
    • https://falconapi.crowdstrike.com (for "legacy" API)
    • https://api.crowdstrike.com or https://api.us-2.crowdstrike.com (for the latest API)
  2. User Name / Client ID and API Key / Secret (required) - The credentials for a user account that has the Required Permissions to fetch assets.

Action Settings

  1. Action type (required) - Select either Add Hosts or Remove Hosts.
  2. Host Group ID (required) - The ID of the host group to which the asset will be added or from which it will be removed.

Required Ports

Axonius must be able to communicate with the values supplied in Connection Settings via the following ports:

  • TCP Port 443

Required Permissions

The values supplied in Username / Client ID and API Key / Secret must have host-group write permissions.


To learn more about configuring Enforcement Sets, see Configuring Enforcement Sets.


First name must have atleast 2 characters. Numbers and special characters are not allowed.
Last name must have atleast 1 characters. Numbers and special characters are not allowed.
Enter a valid email
Enter a valid password
Your profile has been successfully updated.