Exporting data from CrowdStrike for a third-party risk assessment is, predictably, not a single-click "Generate Report" affair. The platform is built for operators, not auditors, so you'll be stitching this together yourself. Most assessments will demand evidence of your endpoint coverage, vulnerability management state, and threat detection posture.
Here's the pragmatic, somewhat tedious path:
**1. Endpoint Coverage & Health**
This proves you're actually monitoring the assets in scope. Use the Falcon API.
* Get a list of all hosts with their hostname, OS, last seen timestamp, and agent version. Filter for the specific network segment or OU being assessed.
```bash
curl -X GET "https://api.crowdstrike.com/devices/combined/devices/v1?filter=os_version:'Windows'+tags:'Prod-Servers'"
-H "Authorization: Bearer $TOKEN"
```
* For a "health" snapshot, pull prevention policies and the percentage of hosts reporting "Normal" status from the Host Management dashboard. Screenshots are your friend here, as the API for this is messy.
**2. Vulnerability Management**
This is often the core of the assessment. You need to show active scanning and remediation workflows.
* From the "Vulnerabilities" dashboard, use the "Export" function for a CSV of all detections. This will be enormous.
* **Crucially**, filter by `created_timestamp` to cover the assessment period and include the `status` column (`open`, `closed`, `reopened`). The auditor wants to see the lifecycle.
* Pair this with a separate export of your "Exceptions" to demonstrate your risk-acceptance process isn't just ignoring everything.
**3. Threat Detection & Response**
They'll want to know if you can actually identify and contain incidents. The "Detections" and "Incidents" exports are key.
* Export Detections for the period, ensuring the CSV includes `technique`, `tactic`, `severity`, and `status` (`false_positive`, `closed`, etc.). This shows your alert fidelity.
* Export a summary of Incidents created during the period. If you have zero, be prepared to explain your detection tuning—they'll assume you're blind.
**Pitfalls:**
* The native CSV exports often lack context an auditor needs. You'll be merging data from 3-4 different exports.
* Timestamps are in UTC. Align your assessment period with that and note it in your cover sheet.
* "Real-time" data isn't expected. A point-in-time export from the last full month is usually sufficient. Just document the extraction date.
Has anyone built a script to automate this collation? I'm tired of manually validating these CSVs every quarter.
- Nina
- Nina