Integrating your Software Asset Management application with the CrowdStrike enables you to view CrowdStrike active host sensors information and check license compliance.

Important: Minimize security risks and protect information by granting access only to the necessary user or API permissions.
Table 1. Minimal user permissions
Process Required user role in the CrowdStrike application Authentication scopes
Download subscriptions Falcon administrator None

Register a CrowdStrike OAuth application

Register the CrowdStrike OAuth application to access the CrowdStrike API and to receive a Client ID and Client secret.

Before you begin

The CrowdStrike Integration Hub spoke must be active. For more information, see CrowdStrike spoke.

CrowdStrike Role required: Falcon administrator

Procedure

  1. Log in to Falcon using your admin credentials.
  2. Navigate to Support > API Clients and Keys.
  3. Select Add new API Client.
  4. Provide the client name and description.
  5. Select the Read check box for the Hosts scope.
  6. Select ADD.
    The API client created screen is displayed.
  7. Copy the Client ID and Client secret for later use.

Create a CrowdStrike connection

Create a connection between your CrowdStrike applications and your ServiceNow instance so that your instance can retrieve user data from your applications.

Before you begin

ServiceNow Role required: admin

Procedure

  1. Log in to your ServiceNow instance.
  2. Navigate to Connection & Credentials > Connection & Credentials Aliases.
  3. Locate your CrowdStrike connection and select Create New Connection & Credential.
  4. In the Create Connection and Credential dialog box, fill in the fields.
    Table 2. Create Connection and Credential dialog box
    Field Value
    Connection Information
    Connection Name Name of the CrowdStrike connection. This field populates automatically.
    Connection URL URL for the connection. This field is automatically set to https://api.crowdstrike.com.
    Each CrowdStrike cloud has a different base URL. Use the base URL that corresponds to the cloud where your integration is hosted.
    • US-1: https://api.crowdstrike.com
    • US-2: https://api.us-2.crowdstrike.com
    • EU-1: https://api.eu-1.crowdstrike.com
    • US-GOV-1: https://api.laggar.gcw.crowdstrike.com
    • US-GOV-2: https://api.us-gov-2.crowdstrike.mil
    Credential Information
    OAuth Client ID Client ID that you generated while configuring the CrowdStrike API settings.
    OAuth Client Secret Client Secret that you generated while configuring the CrowdStrike API settings.
    OAuth Redirect URL https://<instance name>/oauth_redirect.do, where the instance name is the name of your ServiceNow instance.
  5. Select Create and Get OAuth Token.
    Note: For the role required to perform this step, refer to the Minimal user permissions table.
    The OAuth token is generated successfully.

Create a CrowdStrike integration profile

Create a CrowdStrike integration profile to track software subscriptions and optimize licensing for your CrowdStrike applications.

Before you begin

The Software Asset Management - SaaS License Management plugin (sn_sam_saas_int) must be installed from the ServiceNow Store.

ServiceNow Role required: admin or sam_integrator

About this task

If you are using Software Asset Workspace, the option to create the CrowdStrike integration profile in Core UI is inactive.

Procedure

  1. Navigate to the integration profile.
    InterfaceAction
    Core UI
    1. Navigate to All > Software Asset > SaaS License > Direct Integration Profiles.
    2. Select New.
    3. Select CrowdStrike Integration Profile.
    Software Asset Workspace
    1. Navigate to License operations > User Subscriptions > Direct integration profiles.
    2. Select New.
    3. Select CrowdStrike from the drop-down list.
    4. Select Continue.
  2. On the form, fill in the fields.
    Table 3. Integration profile form
    FieldValue
    Display name Name of the integration profile. For example, CrowdStrike integration.
    Connection & Credential Connection and credential alias for the CrowdStrike spoke. This field is automatically set to sn_crowdstrk_spoke.CrowdStrike.
    Status Status of the integration profile.
    • If you have not published the integration profile, this field is automatically set to  Draft.
    • If you have already published the integration profile, this field is automatically set to  Published.
    Profile type Type of integration profile. This field is automatically set to CrowdStrike Subscription.
  3. On the Download Subscription Subflow tab, verify that the Subflow field is set to CrowdStrike Download Host Sensor Information.
  4. Select Save.
    A draft integration profile is created. The integration profile uses the CrowdStrike Download Subscriptions to view CrowdStrike active host sensors information from the CrowdStrike application.
  5. After the page reloads, select Publish.
    Device CAL record is automatically created, which is an average of host count across 4 weeks. CrowdStrike Falcon protection software model is created.

What to do next

If you want to set up multiple integration profiles with unique connections, create child aliases to manage different configurations and settings for each integration profile. For more information, see Create a child alias to set up multiple integration profiles.

Create software entitlements for the automatically generated software models to track used software against owned software. You must use the Device CAL license metric while creating software entitlement for CrowdStrike integration.
Reconciliation also runs on your subscriptions as a scheduled job or on-demand. You can view your reconciliation results in the License Workbench (Software Asset Management classic application) or the License usage view (Software Asset Workspace). Use these results to determine your license compliance position and to remediate any non-compliance.