Configuring the CrowdStrike Falcon Automation Action Policies

Download this manual as a PDF file

This section describes how to edit the action policies included in theCrowdStrike Falcon Automation PowerPack so that the action policies can communicate with your SL1 PowerFlow system.

Editing the CrowdStrike Falcon Automation Action Policies

The CrowdStrike Falcon Automation PowerPack includes one action policy that uses the "Run Integration Service Application" action type to trigger the PowerFlow application that collects data from CrowdStrike. You can specify the credential ID in a JSON structure that you enter in the Input Parameters field in the Action Policy Editor modal.

To edit the action policies included in the PowerPack:

  1. Go to the Action Policy Manager page (Registry > Run Book > Actions).

  1. Locate the action policy that you want to use, and then click its wrench icon (). The Editing Action page appears:

  1. In the Input Parameters field, change the values of the following parameters:
  • credential_id. Change the value to the credential ID that you noted earlier whencreating a credential for your PowerFlow system. This parameter is required.
  • include_event. Leave the value as "true".
  • application_name. Leave the default application value.
  • params. Leave the default parameter value.

  1. Click Save.