Hi everyone. I’m fairly new to the CrowdStrike ecosystem and have been tasked with setting up our Falcon integration to automatically tag our internal hosts based on data from our CMDB. We’re using the API for this.
The issue is that the hosts are not being tagged as expected. The script runs without errors, and the API returns a success message, but when I check the Falcon console, the tags simply don’t appear on the hosts. I’ve verified that the host IDs are correct and that the tag name matches exactly what’s defined in our prevention policy.
Could someone help me understand what might be breaking this workflow? Specifically, I’m curious about the difference in how Falcon handles host tagging via API compared to a tool like Jira, where labeling via API is usually very straightforward and immediate. Are there any common pitfalls, like a synchronization delay or a specific permission scope that’s easily overlooked?
For context, our goal is to have these tags automatically drive different prevention policies, similar to how we might use labels in Asana or Monday to route tasks to different teams. Any insight into the step I might be missing would be greatly appreciated.
Thanks!