CrowdStrike

CrowdStrike Falcon protects your customers’ computers. Connect it once with a Falcon API client, and Neo agents can work Falcon from the ticket: on a single CID that holds every customer, or across the child CIDs of your Falcon Flight Control parent.

​

What Neo can do with CrowdStrike

• Server and workstation maintenance: confirm the computer shows in Falcon, is online and checked in recently, and runs the latest sensor
• Compare a sensor’s version with the newest build and the sensor update policy it follows, and move it onto a current policy
• Audit a customer’s computers: list the ones in your RMM but missing from Falcon, and the ones in Falcon but missing from the RMM
• Read Falcon alerts and incidents with their host, process and file; update, comment on or close them
• Contain or release a host, and run Real Time Response commands on it
• Read and change prevention, sensor update and other policies, host groups, exclusions and IOCs
• Read Spotlight vulnerabilities, threat intelligence, Identity Protection, cloud security and the rest of the Falcon API

​

One CID or Flight Control

One CID. All your customers’ computers are in one Falcon CID. With One CID, Neo cannot keep customers apart in Falcon: it finds a customer’s computers by host name, or by the host group or tag you use per customer. Flight Control. Each customer has a child CID under your parent CID. Neo gets a separate token for each child CID it works in, from the one API client you connect in the parent, so a call for one customer never acts in another’s CID. On a ticket, Neo acts only in the child CID the ticket’s company is mapped to.

​

Your child CIDs are mapped to companies

With Flight Control, Neo matches your child CIDs to the companies in your PSA and keeps the mapping on the CrowdStrike card’s Organization Mapping tab, refreshed on each PSA metadata sync. Matching uses the child CID’s domains, then its name: exact, then after stripping a legal-form suffix (Ltd, Inc, LLC). Last comes an AI match for the long tail. An exact name that matches exactly one of your PSA companies, or a match you confirm, is handed straight to your agents. A mapping lets an agent on that company’s tickets act in the child CID, so every other match waits for you on the Organization Mapping tab: a domain match, a match after stripping a legal-form suffix, a name two of your PSA companies share, two child CIDs on one company, an inactive child CID, and an AI match. Confirm or correct each there. Anything Neo could not match stays unmapped and visible on the same tab, where you can set the right company by hand. A mapping you set by hand survives every later sync. See CrowdStrike API for the permission groups.

​

Next steps