Before you begin
- An Enterprise plan or above. The Integrations hub is locked below Enterprise
- The Administrator role in Atlas to connect, configure or disconnect a connector. Integrations appears under Administration only for administrators
- A tenant selected in the tenant picker. Credentials are stored encrypted per tenant, so each tenant you manage connects its own account
- A Falcon OAuth2 API client created by a Falcon administrator, and the Falcon cloud your CID is homed in
- For Flight Control (MSSP) accounts: the 32-character member CID of the child you want this tenant to see
What you can do
- See sensor health for every host in your CID: sensor version, online and stale sensors, reduced functionality mode and containment state, with a direct link from each Falcon host to its Atlas session host.
- Review open Spotlight vulnerabilities and open endpoint detections, with severity, CVSS and ExPRT ratings, and MITRE tactic and technique.
- Install the Falcon sensor on new session hosts automatically as they are built, or generate an install script to run yourself, including a golden-image variant.
- Apply CrowdStrike's recommended FSLogix machine-learning exclusions in one click, and create IOA (behavioural) exclusions for FSLogix processes.
- Create Falcon host groups that match your host pools, and pin the sensor build a sensor-update policy rolls out.
- Run a small set of Real Time Response actions on a session host: list processes, network connections or a directory, remove a stuck FSLogix lock file, or end a process.
- When Microsoft Defender for Endpoint is not set up for the tenant, Falcon hosts and CVEs fill in Atlas's Security Posture machine list, CVE catalog, vulnerability report and CVE alerts.
Government or Commercial card
The Integrations hub shows two cards, CrowdStrike Falcon (Government) and CrowdStrike Falcon (Commercial). They connect the same thing and open the same page; they differ only in the clouds their region list offers. The Government card offers US-GOV-1 (FedRAMP High, the default) and US-GOV-2 (IL5). The Commercial card offers US-1 (the default), US-2 and EU-1. A tenant has one Falcon connection, and it shows as Connected on the card whose cloud matches the region you saved. Connecting through the other card replaces the existing connection.
Step 1: Create an API client in Falcon
In the Falcon console, go to Support and resources → API clients and keys and add a new API client for Atlas. Give it the scopes for the features you plan to use, then copy the Client ID and Client Secret. The secret is shown once.
- Hosts: Read. Required. Atlas checks this scope when you connect, and every page needs it.
- Spotlight vulnerabilities: Read, for the Vulnerabilities tab and the CVE features.
- Alerts: Read, for the Detections tab. Without it the tab says Detections are unavailable and the rest keeps working.
- Sensor download: Read, for the Customer CID and sensor build list on the Onboarding tab.
- Machine learning exclusions, IOA exclusions and Sensor visibility exclusions: Read, for the Exclusions tab; Write on Machine learning and IOA exclusions to create them.
- Host groups: Read, and Write to create groups. Sensor update policies: Read, and Write to pin a build.
- Hosts: Write, so Atlas can hide a session host's Falcon record when you delete the VM in Atlas.
- Real time response: Read for the list actions, and Real time response (admin) or active responder access for removing a lock file or ending a process.
Start with the read scopes. Add a write scope only when you want Atlas to make that change in Falcon; a page whose scope is missing shows an error and the rest of the integration keeps working.
Step 2: Connect in Atlas
Once connected, the card shows Manage, which opens the CrowdStrike Falcon page, and Disconnect. The client ID and secret are stored encrypted; the region and member CID are shown on the page.
- In Atlas, select the tenant in the tenant picker.
- Go to Administration → Integrations and click Connect on the CrowdStrike Falcon (Government) or CrowdStrike Falcon (Commercial) card.
- Choose the Falcon cloud / region your CID is homed in. The API address comes from the region; you cannot type one.
- Paste the Client ID and Client Secret. For a Flight Control child, enter its 32-character member CID; leave it blank otherwise.
- Click Connect. Atlas signs in to Falcon and reads one host before saving anything. If Falcon rejects the client, nothing is stored.
Overview and sensor-health sync
The Overview tab shows Sensors, Reduced Functionality, Open Vulnerabilities and Open Detections, the share of sensors that reported in the last 24 hours, and the sensor versions in use. Atlas records a sensor-health summary every 30 minutes; the Sensor-Health Sync card shows when it last ran and its result, and Sync now runs it straight away. The Hosts, Vulnerabilities and Detections tabs read Falcon live each time you open them.
Hosts, Vulnerabilities and Detections
- Hosts lists every host in the CID, not only session hosts, with platform, sensor version, status (normal, stale, contained, containment pending, lift pending), reduced functionality, local IP and last seen. A host is stale when it has not been seen for 24 hours. The AVD column links a Falcon host to its Atlas session host when the host name matches a VM name exactly, or when its short name matches exactly one VM.
- Vulnerabilities lists open Spotlight findings with CVE, host, severity, CVSS, ExPRT rating, product and last update, highest CVSS first.
- Detections lists new, in-progress and reopened endpoint detections with host, severity, detection, tactic and technique, state and when it was raised, and can be filtered by severity.
Onboarding: install the sensor
Falcon's own download API needs credentials a session host should never hold, so you host the sensor installer (WindowsSensor.exe) at an HTTPS address of your own, for example an Azure Storage blob with a SAS token. The Onboarding tab shows your Customer CID (CCID) with a Copy button, and offers two ways to install.
Auto-install on new session hosts: turn it on, enter the Installer URL and any sensor Grouping tags, and click Save. From then on, every new session host Atlas builds installs the sensor with the VDI flag during provisioning. A failed install never fails the build; it is written to the deployment log as a warning.
Build install script: pick a sensor build (optional, used to check the installer's SHA256), enter the Installer URL and Grouping tags, and click Generate install script. Copy the PowerShell and run it on existing hosts yourself, for example with Run Command. For pooled, non-persistent hosts, switch on Golden image (NO_START=1) and install into the golden image, then reseal: each clone starts the sensor and gets its own agent ID on first boot. For persistent hosts, install per host instead.
Atlas does not run the generated script on existing hosts for you. The script skips a host that already has the Falcon sensor service, and writes its install log to %TEMP%\WindowsSensor-install.log on the host.
Exclusions, host groups and sensor updates
- Exclusions: Atlas compares your machine-learning exclusions with CrowdStrike's FSLogix set (VHD and VHDX disks and their .lock, .meta and .metadata files, and the FSLogix drivers frxdrv.sys, frxdrvvt.sys and frxccd.sys). Apply creates only the ones that are missing, for all hosts or for the host groups you tick, and never removes an existing exclusion. You can also create an IOA exclusion from a detection's pattern ID, scoped by image-file or command-line regex, with prefills for the FSLogix processes. Sensor-visibility exclusions are listed with a warning if any cover FSLogix paths, but Atlas does not create them.
- Host groups: create a dynamic group that matches sensor grouping tags or host-name patterns (for example AVD-POOL-*), or a static group. Prefill from an Atlas host pool names it after the pool.
- Sensor updates: see each sensor-update policy with its current build and pin a specific Windows build. Only the build changes; the policy's other settings are left alone. Validate a new build on a canary policy first.
Remediation (Real Time Response)
Enter the session host's name, pick an action and click Run. The command runs on the live host and the result appears below; Atlas closes the session afterwards. The host name must match exactly one Falcon host, and the host must be online.
- List running processes, List network connections, and List a directory: read-only.
- Remove an FSLogix lock file: deletes a .lock, .meta or .metadata file only. Use it when a stuck lock keeps a user from signing in.
- Kill a process by PID: ends one process.
What the integration does not do
- It does not contain a host or lift containment. Containment state is shown, but you change it in Falcon.
- Real Time Response is limited to the five actions above. There are no free-form commands, scripts, or file get and put.
- It does not edit or delete exclusions or host groups, add members to a static group, un-pin a build back to automatic, or manage prevention policies.
- It does not change a detection's status, assign it, or close it.
- It covers Falcon Insight (hosts and detections), Spotlight, sensor downloads, exclusions, host groups, sensor-update policies and Real Time Response. It does not use Falcon Identity, LogScale, Discover or Intelligence.
- One CID per Atlas tenant. Very large CIDs are read up to 10,000 hosts, 5,000 vulnerabilities and 1,000 detections.
- When Microsoft Defender for Endpoint is set up for the tenant, Atlas's security pages use Defender, not Falcon. The CrowdStrike page itself keeps working.
- Atlas Advisor can tell you whether CrowdStrike is connected and when it last synced, but does not answer questions about Falcon hosts or detections.
When you delete a session host
When you delete a VM in Atlas, Atlas hides the matching host record in Falcon after the delete is confirmed, so retired session hosts do not linger in your console. This needs the Hosts write scope, is best-effort and never holds up the delete; the deployment log notes how many records were hidden.
GCC High tenants
On a tenant or deployment in Azure Government (GCC High), calls to CrowdStrike Falcon are blocked by default, because they can carry VM, host-pool and tenant names to a service outside the Government boundary. Connect fails with an Azure Government (GCC High) egress boundary message and nothing is stored, and pages that read from CrowdStrike Falcon stay empty. The operator who runs your Atlas deployment can approve CrowdStrike Falcon as a destination that is allowed to receive that data; once approved, the connector works normally. Running in Azure Government does not by itself make a third-party integration GCC High or CMMC compliant.
Disconnecting
Click Disconnect on the card and confirm. Atlas deletes the stored API client and stops the sensor-health sync and the automatic sensor install. Nothing in Falcon is undone: exclusions, host groups, pinned builds and hidden hosts Atlas created stay. Revoke the API client in Falcon if you no longer need it. Your auto-install settings are kept; if you later connect a different CID, open Onboarding and save auto-install again so it uses the new CCID.
Troubleshooting
- CrowdStrike Falcon rejected the supplied credentials: the client ID or secret is wrong, the member CID is wrong, the API client lacks Hosts: Read, or the region is not the cloud your CID lives in.
- Could not connect to CrowdStrike Falcon: Falcon could not be reached or returned an error. Check the region and try again.
- CrowdStrike Falcon is temporarily rate limiting requests: wait a minute and try again.
- Detections are unavailable: add Alerts: Read to the API client.
- A tab shows Failed to fetch… or an action shows Failed to…: the API client is usually missing that feature's scope (see Step 1). Add it in Falcon; no reconnect is needed.
- RTR session was not created: add the Real Time Response scope. A host name that matches several Falcon hosts cannot be targeted from Atlas; hide the stale records in Falcon first. Timed out waiting for completion means the command may still be running on the host.
- Auto-install warnings appear in the deployment log as [CrowdStrike] lines. Check the installer URL is reachable from the host, and see %TEMP%\WindowsSensor-install.log on the host.