CrowdStrike integration
Surface CrowdStrike Falcon endpoint inventory and enforce security policies directly inside service management workflows.
What it connects
- Managed endpoints with Falcon agent version, OS, IP address, and hardware details.
- Falcon console users and administrator accounts for access-control audits.
- Host groups configured for policy assignment and organizational segmentation.
- Dynamic group memberships to track which devices belong to which policy tiers.
What it automates
- Isolate a compromised device from the network to prevent lateral movement and attack spread.
- Remove network containment to restore connectivity after incident resolution or validation.
- Organize endpoints into policy groups for coordinated security patching and threat response.
- Tag hosts with custom labels to mark devices under investigation or affected by active incidents.
In practice
- When a malicious process is detected on a critical-asset device, STLabs isolates the endpoint via network containment while auto-creating a security ticket for the SOC team to investigate.
- A security audit identifies workstations missing a required security group; STLabs automatically assigns them to the correct policy tier and notifies the team of the compliance change.
- After an analyst confirms a detection is a false positive, STLabs lifts the network containment and tags the host with an exclusion label to prevent duplicate future alerts.
- STLabs pulls the full device inventory with agent versions and OS information to generate compliance reports showing which endpoints require urgent patching.
