Integrating Forescout Cloud with CrowdStrike EDR (SOAR)

Forescout Cloud integrates with CrowdStrike endpoint detection and response (EDR) to support security orchestration, automation, and response (SOAR) workflows by automating your IT tasks to reduce strain on your team.

Before integrating, note the following CrowdStrike credentials:

  • Client ID
  • Client Secret
  • An API token with both read and write permissions for both the hosts and on-demand scans (ODS)

For more information, see the CrowdStrike documentation. You must have CrowdStrike login credentials to access this content.

To integrate Forescout Cloud with CrowdStrike EDR to support SOAR:

  1. In the Forescout Cloud Console, select Administration > Integrations.
  2. Click the Add Application button.
  3. In the Category dropdown, select SOAR.
  4. In the Application dropdown, select CrowdStrike for Endpoint.
  5. In the Application Name field, enter a unique name for the integration.
  6. In the Configurations panel, enter the Client and Client Secret.
  7. Click the Add Application button to save the configuration.

After you integrate Forescout Cloud with CrowdStrike, you can configure actions. For details on configuring SOAR actions, see Configuring SOAR actions.