Crowdstrike

Inventory CrowdStrike Falcon endpoint security — hosts, detections, incidents, policies — plus Falcon Cloud Security posture for Azure.

Support

Questions you can answer 100

Each one is a saved query that ships with ConfigView, reading your Crowdstrike data on your own server. Ask it in plain English, SQL, Slack or the API.

Which Macs running CrowdStrike aren't enrolled in Kandji?
Find CrowdStrike-monitored Macs that Kandji doesn't manage
Are there Macs with Falcon but no MDM enrollment in Kandji?
Show me every serial with whether it's in Kandji, CrowdStrike, or both
Give me a Kandji vs CrowdStrike coverage matrix
How does our Kandji fleet line up with CrowdStrike, device by device?
Which Kandji Macs don't have CrowdStrike installed?
Find devices in Kandji with no CrowdStrike sensor
Where are we missing the Falcon agent on Kandji-managed laptops?
Give me an Intune vs CrowdStrike coverage matrix
Which serials are in Intune only, CrowdStrike only, or both?
Compare our Intune device list against CrowdStrike, serial by serial
Which Intune devices don't have CrowdStrike?
Find Intune-managed endpoints missing the CrowdStrike sensor
Where is the EDR agent missing on our Microsoft-managed devices?
Show the Intune tenant 2 vs CrowdStrike coverage matrix
For our second Microsoft tenant, which serials are in Intune, CrowdStrike, or both?
Which devices in our second Intune tenant are missing CrowdStrike?
Find tenant 2 Intune machines with no CrowdStrike agent
Which hosts Rapid7 scanned don't have CrowdStrike?
Find Rapid7 assets with no CrowdStrike sensor
Are there vulnerability-scanned machines missing our EDR agent?
How are CrowdStrike alerts distributed across severity levels?
Break down Falcon alerts by severity
Is there a spike in high-severity CrowdStrike alerts?
Which MITRE ATT&CK tactics show up most in CrowdStrike alerts?
Break down Falcon detections by MITRE tactic
What adversary behaviors is CrowdStrike seeing most in our environment?
How many CrowdStrike alerts do we have open right now?
Give me the CrowdStrike alert totals with critical, high, medium and low counts
What's our SOC headline alert number in Falcon?
Which critical and high CrowdStrike detections are still open?
Show me the open high-severity Falcon detections, newest first
What active threats is CrowdStrike flagging that we haven't closed?
What did CrowdStrike detect in the last 24 hours?
Show me Falcon detections from the past day, newest first
Any new CrowdStrike detections since yesterday's standup?
Which hosts have the most open CrowdStrike detections?
Rank endpoints by number of open Falcon detections
Is any single machine generating a lot of CrowdStrike alerts?
Which open CrowdStrike detections have no one assigned?
List unassigned Falcon detections that nobody owns
Are there CrowdStrike alerts sitting in triage without an owner?
Which Azure subscriptions are registered in CrowdStrike Falcon Cloud Security?
List Azure subscriptions onboarded to CrowdStrike CSPM
What does our CrowdStrike cloud posture coverage look like in Azure?
Which Azure subscriptions aren't fully onboarded to CrowdStrike CSPM?
Find Azure subscriptions where Falcon Cloud Security isn't operational
Is CrowdStrike posture data stale for any Azure subscription?
Which Azure services have the most CrowdStrike misconfigurations?
Break down open Azure IOMs by service like Storage and Key Vault
Where is our Azure cloud risk concentrated according to CrowdStrike?
Which Azure subscriptions have the most misconfigurations in CrowdStrike?
Break down CrowdStrike Azure misconfigurations by subscription
Which subscription carries the most cloud posture debt?
How many Azure misconfigurations has CrowdStrike found?
Give me CrowdStrike's Azure indicator of misconfiguration counts by severity
How many open Azure IOMs are critical or high in Falcon?
Which critical Azure misconfigurations does CrowdStrike say we need to fix?
List open high-severity Azure IOMs with the affected resource
Show the CrowdStrike cloud posture remediation worklist for Azure
What CSPM policies does CrowdStrike evaluate against Azure?
List every CrowdStrike Azure posture rule with severity and enabled state
Show me the CrowdStrike CSPM policy catalog
Which high-severity CrowdStrike CSPM policies are disabled?
Find critical Azure posture rules turned off in CrowdStrike
Do we have blind spots from disabled CSPM policies in Falcon?
What host groups exist in CrowdStrike?
List every Falcon host group with its assignment rule and type
Which CrowdStrike host groups are dynamic vs static?
How many CrowdStrike incidents are open right now?
Give me total, open and high-score CrowdStrike incident counts
How many Falcon incidents scored 50 or higher?
Which CrowdStrike incidents have a fine score above 50?
List Falcon incidents over a score threshold, newest first
Show me the highest-confidence CrowdStrike incidents regardless of status
What open CrowdStrike incidents do we have, ranked by score?
Show the CrowdStrike incident queue with assignees and affected hosts
Which Falcon incidents should we work on first?
When was CrowdStrike data last collected for each table?
Show CrowdStrike ingestion freshness and row counts per table
Is the CrowdStrike collector broken or missing an API scope?
What prevention policies do we have in CrowdStrike?
List Falcon prevention policies with platform and assigned host groups
Give me an overview of our CrowdStrike protection config
Which CrowdStrike prevention policies are turned off?
List disabled Falcon prevention policies
Are any CrowdStrike prevention policies disabled?
Which CrowdStrike prevention policies aren't assigned to any host group?
Find enabled Falcon prevention policies that protect nothing
Do we have prevention policies in CrowdStrike with zero host groups?
What sensor update policies do we have in CrowdStrike?
List Falcon sensor update policies with their target build
How are CrowdStrike sensor versions pinned across the fleet?
Which CrowdStrike sensor policies don't have uninstall protection?
Find Falcon sensor update policies where a local admin could remove the sensor
Can anyone uninstall the CrowdStrike sensor on our endpoints?
Which CrowdStrike hosts haven't checked in for 30 days?
List Falcon sensors that have gone stale
Which endpoints has CrowdStrike not seen recently?

What ConfigView collects from Crowdstrike 28

Device IDs

Retrieve and manage Crowdstrike Device IDs information.
Host Details

Sensor, OS, and host metadata for every managed device.
Alerts (Detections)

EDR detections with severity, tactic/technique, host, and status.
Incidents

Correlated incidents with score, state, and affected host count.
Host Groups

Static and dynamic host groups with their assignment rules.
Prevention Policies

Prevention policy config, enabled state, and assigned host groups.
Sensor Update Policies

Sensor build targets, uninstall protection, and rollout scope.
Cloud Security — Azure Accounts

Registered Azure subscriptions and their CSPM onboarding status.
Cloud Security — Azure Misconfigurations

Indicators of Misconfiguration across Azure services and resources.
Cloud Security — Azure Policies

CSPM policy catalog for Azure with severity and enabled state.
Device Control Policies (USB)

USB and Device Control policies with the per-class action and every exempted peripheral.
Host Group Members

Which devices belong to each host group, including dynamically assigned ones.
Exclusions

Sensor visibility, machine learning, and IOA exclusions with the groups they apply to.
Device Policy Assignment

The policy of each type Falcon actually applied to each host, and which hosts have none.
Falcon Console Users

Inventory falcon console users from CrowdStrike Falcon.
Response Policies

Inventory response policies from CrowdStrike Falcon.
Content Update Policies

Inventory content update policies from CrowdStrike Falcon.
IOA Rule Groups

Inventory ioa rule groups from CrowdStrike Falcon.
IOA Rules

Inventory ioa rules from CrowdStrike Falcon.
Custom IOC Indicators

Inventory custom ioc indicators from CrowdStrike Falcon.
Sensor Build Versions

Inventory sensor build versions from CrowdStrike Falcon.
Quarantined Files

Inventory quarantined files from CrowdStrike Falcon.
Installation Tokens

Inventory installation tokens from CrowdStrike Falcon.
Scheduled Reports

Inventory scheduled reports from CrowdStrike Falcon.
Discover - Hosts

Inventory discover - hosts from CrowdStrike Falcon.
Discover - Accounts

Inventory discover - accounts from CrowdStrike Falcon.
Discover - Logins

Inventory discover - logins from CrowdStrike Falcon.
Login History (host to user)

Which users have logged in to each Falcon-managed host, and when.

Back to Integrations