Setup Remediation Connector Solution

Remediation Connector Solution allows you to scan and remediate endpoints in your security management environment.

Setup

1. Log in to your CrowdStrike Falcon® Dashboard as a Falcon Administrator. 
2. Define a CrowdStrike API client. See the Defining your first API Client section in the CrowdStrike support article Getting Access to the CrowdStrike API.
   • When creating your CrowdStrike API client, check the following required Read and Write API Scopes:
     • Detections: Read
     • Hosts: Read
     • Host Groups: Read
     • Incidents: Read
     • Real Time Response (admin): Write
     • Real Time Response: Read and Write
3. After creating your CrowdStrike API client, go to Configuration > Response Policies.
4. For the policies that will utilize Remediation Connector Solution, click Edit Policy.
5. Under the Real Time Functionality section, switch the Enable All toggles for the Custom Scripts and High Risk Commands.
6. Click Save to confirm your policy configurations.
   • To configure Network Contained endpoints, see Configure Remediation Connector Solution Network Contained endpoints.
7. Download the Remediation Connector Solution executable found in your purchase email.
   • The executable is self-updating.
   • To download the executable, click HERE.
8. Run the executable.
9. Create a Master Password upon initial registration of the product.
10. Login using the Master Password.
11. Click Managed Clients > Add Client.
12. Enter your Name, Client ID, Secret ID, and select API Server from the drop-down list. Click Ok.
13. Select your Client, then Connect.

Notes:

• If your endpoints require a proxy to connect to the Internet, click the Proxy configuration button at the top-right and enter your proxy information. 
• If shown, download the latest Remediation Connector Solution version by clicking the New version available on the top left. 

Return to Remediation Connector Solution integration.