Configure Device Profiles - CrowdStrike
-
Skyhigh SSE platform enables customers to create Zero trust device policies using a combination of native Zero Trust Assessments capabilities such as OS version, presence of registry key, Antivirus(On/Off) and more to assess device posture. CrowdStrike performs a zero trust assessment and provides various scores, like OS score, sensor score, and overall score of the client. By using a combination of these scores, we can enforce a powerful Zero Trust Assessment of devices before allowing/dropping traffic from compliant/non-compliant devices via Skyhigh Cloud Firewall.
Before you Begin
- Download the latest SCP build.
Note: Skyhigh Client Proxy 4.7.0 is the minimum supported version required to integrate the CrowdStrike feature.
-
Ensure that you have installed CrowdStrike on your system before using it as integration option.
-
Go to Setting > Infrastructure > Web Gateway Setup > Configure SCP > Manage SCP > Global Configuration > Device Risk Assessment settings to enable CrowdStrike.
Configure CrowdStrike Integration
- Go to Settings > Infrastructure > Web Gateway Setup.
- In the Configure Device Profile section, click New Device Profile.
- In the Name box, enter the name of the device profile.
- In the Select Device Risk Assessment section, select CrowdStrike from the dropdown option.
- Complete the following fields:
- CrowdStrike ID — Enter the valid CrowdStrike customer ID.
- OS Score — The possible operators are == (equals), >= (greater than or equal to), > (greater than), <= (less than or equal to), < (less than). In the Value field, specify the OS score between 0 to 100.
- Sensor Score — The possible operators are == (equals), >= (greater than or equal to), > (greater than), <= (less than or equal to), < (less than). In the Value field, specify the Sensor score between 0 to 100.
- Overall Score — The possible operators are == (equals), >= (greater than or equal to), > (greater than), <= (less than or equal to), < (less than). In the Value field, specify the Overall score between 0 to 100.
- Click Save and Publish the changes.
CrowdStrike ZTA score is not stored in a JWT on the local machine by default. Contact Crowdstrike support to enable the zta_distribute_payload setting.
Match CrowdStrike Profile with Cloud Firewall Policy
- Go to Settings > Policy > Cloud Firewall Policy.
- In the Cloud Firewall Policy page, select the Device Profile as the Criteria.
- In the Value option, select CrowdStrike to view all the configured CrowdStrike profiles.
- Click Done.
- Choose the required Action from Select Action and enable the rule.
- Publish the changes.
