The sensor stays reachable
The device loses network traffic, not the connection to the Falcon cloud. Analysis can continue remotely.
← All integrations
Endpoint protection & containment Controls
CrowdStrike Falcon
Trigger network containment from the incident
This connector links containment actions to CrowdStrike Falcon. Network containment cuts the device’s traffic except for the connection to the Falcon cloud, so the sensor stays reachable. Falcon has no selective variant, so the choice of isolation type has no effect here, and the interface says so. The connector performs interventions and reads no detections.
Vendor: CrowdStrike · www.crowdstrike.com/platform/endpoint-security
What the connector performs
- Trigger network containment on a host
- Lift containment again
- Host lookup by name, aborting when ambiguous
- Regions US-1, US-2, EU-1 and GovCloud to choose from
Your benefits
A dedicated API client
Only what is needed is granted: read hosts and write host containment. No personal account that expires with a person.
Connect CrowdStrike Falcon with isidaten
We show you the connector live in your own environment – non-binding and free of charge.