- 12 Dec 2022
- 1 Minute to read
-
Print
-
DarkLight
-
PDF
CrowdStrike Falcon - Add/Remove Assets to/from Host Group
- Updated on 12 Dec 2022
- 1 Minute to read
-
Print
-
DarkLight
-
PDF
CrowdStrike Falcon - Add/Remove Assets to/from Host Group (previously Add/Remove Hosts from Crowdstrike Host Group) adds or removes each of the devices from a Crowdstrike Host Group that are the result of the saved query supplied as a trigger (or devices selected in the asset table).
To configure CrowdStrike Falcon - Add/Remove Assets to/from Host Group, from the Action Library, select Execute Endpoint Security Agent Action, and then select CrowdStrike Falcon - Add/Remove Assets to/from Host Group, or search for the action in the Action Library Search pane.
To use the actions below, you must successfully configure a CrowdStrike Falcon adapter connection.
Connection Settings
- CrowdStrike Domain (required) - The hostname of the API server – this could be one of the following:
- https://falconapi.crowdstrike.com (for "legacy" API)
- https://api.crowdstrike.com or https://api.us-2.crowdstrike.com (for the latest API)
- User Name / Client ID and API Key / Secret (required) - The credentials for a user account that has the Required Permissions to fetch assets.
Action Settings
- Action type (required) - Select either Add Hosts or Remove Hosts.
- Host Group ID (required) - The ID of the host group to which the asset will be added or from which it will be removed.
Required Ports
Axonius must be able to communicate with the values supplied in Connection Settings via the following ports:
- TCP Port 443
Required Permissions
The values supplied in Username / Client ID and API Key / Secret must have host-group write permissions.
For more details about other Enforcement Actions available, see Action Library.