Configuring Action Policy Credentials

Download this manual as a PDF file

This section describes how to configure CrowdStrike for monitoring by SL1 using the CrowdStrike Falcon Automation PowerPack.

Creating a SOAP/XML Credential to Access SL1 PowerFlow

After you have integrated your CrowdStrike and PowerFlow systems, you must create a SOAP/XML credential so that the action policies included in the PowerPack can access your PowerFlow system. The CrowdStrike Falcon Automation PowerPack includes a template for a SOAP/XML credential that you can edit for use with your SL1 PowerFlow system.

NOTE: If you are on an SL1 system prior to version 11.1.0, you will not be able to duplicate the sample credential. It is recommended that you create your new credentials using the SL1 classic user interface so you do not overwrite the sample credential(s).

To create a SOAP/XML credential:

  1. Go to the Credentials page (Manage > Credentials).
  2. Locate the PowerFlow CrowdStrike sample credential, then click its Actions icon () and select Duplicate. A copy of the credential, called PowerFlow CrowdStrike copy appears.

  1. Supply values in the following fields:
  • Profile Name. Type a new name for the credential.
  • All Organizations. Toggle on (blue) to align the credential to all organizations, or toggle off (gray) and then select one or more specific organizations from the What organization manages this service? drop-down field to align the credential with those specific organizations.
  • URL. Type the host name for your PowerFlow system.
  • HTTP Auth User. Type the administrator username for your PowerFlow
  • HTTP Auth Password. Type the administrator password for your PowerFlow system.
  1. Click Save & Close .
  2. SL1 assigns the credential an ID number. Take note of the ID number for the new credential on the Credentials page, in the ID column. You will need the ID number when editing the input parameters of the automation actions included in the CrowdStrike Falcon Automation PowerPack.

Creating a SOAP/XML Credential to Access SL1PowerFlow in the Classic User Interface

To create a SOAP/XML credential:

  • Go to the Credential Management page (System > Manage > Credentials).
  • Locate the PowerFlow CrowdStrike sample credential and click its wrench icon (). The Credential Editor modal window appears.

  • Supply values in the following fields:
  • Profile Name. Type a new name for the credential.
  • Content Encoding. Select text/xml.
  • Method. Select POST.
  • HTTP Version. Select HTTP/1.1.
  • URL. Type the host name for your PowerFlow system.
  • HTTP Auth Password. Type the administrator password for your PowerFlow system.
  • Timeout (seconds). Type "5"
  • Click the Save As button to save the new SOAP/XML credential.
  • SL1 assigns the credential an ID number. Take note of the ID number for the new credential on the Credentials page in the ID column or at the top of the Credential Editor modal. You will need the ID number when editing the input parameters of the automation actions included in the CrowdStrike Falcon Automation PowerPack.