How to Use runZero to Find Endpoints Missing Crowdstrike

runZero integrates with CrowdStrike by importing data through the CrowdStrike Falcon API. This integration allows you to sync and enrich your asset inventory. Adding your CrowdStrike data to runZero makes it easier to find things like endpoints that are missing an EDR agent.

For CrowdStrike Falcon hosts which can be matched to an existing runZero asset, asset level attributes such as operating system, hardware platform, hostname, and MAC address will be updated, and CrowdStrike-specific attributes will be added.

For hosts which cannot be matched with an existing runZero asset, a new asset will be created in the site specified when the integration task is set up.

runZero is able to merge existing assets with Falcon data when the MAC address or hostname overlaps. Falcon devices can also be manually merged into runZero assets using the Merge button on the Asset Inventory screen.

Please note that any IP address reported by Falcon will be treated as a secondary address, not a primary address, since these IPs can be stale and may not be associated with a specific network or site.

Learn more about integrating runZero with your existing IT & security tools.