Cloud Security

Overview

Manage AWS account registration, configuration, and monitoring for CrowdStrike Falcon Cloud Security (CSPM). These cmdlets enable you to connect AWS accounts, configure cloud trails, enable behavior assessment, and manage security posture across your AWS infrastructure.

Prerequisites

CSPM registration: Read - Required for retrieval operations
CSPM registration: Write - Required for account provisioning and modifications

Get-FalconCloudAwsAccount

Search for registered Falcon Cloud Security AWS accounts.

A properly provisioned AWS account will display the status Event_DiscoverAccountStatusOperational.

Get-FalconCloudAwsAccount

Get-FalconCloudAwsAccount [-Id <string[]>] [-OrganizationId <string[]>] [-ScanType <string>] [-Status <string>] [-GroupBy <string>] [-IamRoleArn <string[]>] [-Migrated <boolean>] [-CspmLite <boolean>] [-Limit <int32>] [-Offset <int32>] [-All] [-Total]

Parameters

string[]

AWS account identifier (12-digit format)

string[]

AWS organization identifier (format: o-[0-9a-z]{10,32})

string

Scan type. Valid values: full, dry

string

AWS account status. Valid values: provisioned, operational

string

Field to group by. Valid values: organization

string[]

AWS IAM role ARNs

boolean

Only return migrated Discover for Cloud accounts

boolean

Only return CSPM Lite accounts

int32

Maximum number of results per request (1-500)

int32

Position to begin retrieving results

switch

Repeat requests until all available results are retrieved

switch

Display total result count instead of results

Example

# Get all operational AWS accounts
Get-FalconCloudAwsAccount -Status operational -All

# Get specific AWS account by ID
Get-FalconCloudAwsAccount -Id 123456789012

# Get accounts by organization
Get-FalconCloudAwsAccount -OrganizationId o-abc123def456

New-FalconCloudAwsAccount

Provision a new Falcon Cloud Security AWS account.

New-FalconCloudAwsAccount

New-FalconCloudAwsAccount -AccountId <string> -CloudtrailRegion <string> [-OrganizationId <string>] [-AccountType <string>] [-IsMaster <boolean>] [-IamRoleArn <string>] [-UseExistingCloudtrail <boolean>] [-BehaviorAssessmentEnabled <boolean>] [-SensorManagementEnabled <boolean>] [-TargetOu <string[]>] [-DspmEnabled <boolean>] [-DspmRole <string>] [-RootStackId <string>] [-DeploymentMethod <string>] [-ClientId <string>]

Parameters

string

required

AWS account identifier (12-digit format)

string

required

AWS region where the account resides

string

AWS organization identifier (12-digit format)

string

AWS account type

boolean

Master account designation

string

AWS IAM role ARN

boolean

Use existing CloudTrail log

boolean

Enable behavior assessment for account

boolean

Enable sensor management for account

string[]

Target organizational units

boolean

Enable DSPM (Data Security Posture Management)

string

DSPM role ARN

string

Root Stack ID

string

Deployment method

string

Falcon client ID

Example

# Provision a new AWS account
New-FalconCloudAwsAccount -AccountId 123456789012 -CloudtrailRegion us-east-1 -BehaviorAssessmentEnabled $true

# Provision with organization
New-FalconCloudAwsAccount -AccountId 123456789012 -CloudtrailRegion us-west-2 -OrganizationId 987654321098 -IsMaster $true

Edit-FalconCloudAwsAccount

Modify an existing Falcon Cloud Security AWS account.

Edit-FalconCloudAwsAccount

Edit-FalconCloudAwsAccount -AccountId <string> [-CloudtrailRegion <string>] [-IamRoleArn <string>] [-BehaviorAssessmentEnabled <boolean>] [-SensorManagementEnabled <boolean>] [-RemediationRegion <string>] [-RemediationTouAccepted <string>] [-Environment <string>] [-TargetOu <string[]>] [-DspmEnabled <boolean>] [-DspmRole <string>] [-RootStackId <string>] [-DeploymentMethod <string>] [-ClientId <string>]

Parameters

string

required

AWS account identifier (12-digit format)

string

AWS region where the account resides

string

AWS IAM role ARN

boolean

Enable behavior assessment for account

boolean

Enable sensor management for account

string

Region where remediation occurs

string

Remediation terms-of-use acceptance date

string

Environment designation

string[]

Target organizational units

boolean

Enable DSPM

string

DSPM role ARN

string

Root Stack ID

string

Deployment method

string

Falcon client ID

Example

# Enable behavior assessment
Edit-FalconCloudAwsAccount -AccountId 123456789012 -BehaviorAssessmentEnabled $true

# Update CloudTrail region
Edit-FalconCloudAwsAccount -AccountId 123456789012 -CloudtrailRegion eu-west-1

Remove-FalconCloudAwsAccount

Remove Falcon Cloud Security AWS accounts.

Remove-FalconCloudAwsAccount

Remove-FalconCloudAwsAccount -Id <string[]>
Remove-FalconCloudAwsAccount -OrganizationId <string[]>

Parameters

string[]

AWS account identifier (12-digit format)

string[]

AWS organization identifier (format: o-[0-9a-z]{10,32})

Example

# Remove specific AWS account
Remove-FalconCloudAwsAccount -Id 123456789012

# Remove by organization
Remove-FalconCloudAwsAccount -OrganizationId o-abc123def456

Get-FalconCloudAwsLink

Retrieve a URL to grant Falcon Cloud Security access in AWS.

Once logged into the provided link using your AWS administrator credentials, use the Create Stack button to grant access.

Get-FalconCloudAwsLink

Get-FalconCloudAwsLink

Example

# Get AWS registration URL
$Link = Get-FalconCloudAwsLink
Start-Process $Link.url

Receive-FalconCloudAwsScript

Download a Bash script which grants Falcon Cloud Security access using the AWS CLI.

Receive-FalconCloudAwsScript

Receive-FalconCloudAwsScript [-Id <string[]>] [-OrganizationId <string>] [-Template <string>] [-Account <string[]>] [-AccountType <string>] [-AwsProfile <string>] [-CustomRole <string>] [-BehaviorAssessment <boolean>] [-SensorManagement <boolean>] [-ExistingCloudtrail <boolean>] [-DspmEnabled <boolean>] [-DspmRole <string>] [-DspmRegion <string[]>] -Path <string> [-Force]

Parameters

string[]

AWS account identifier (12-digit format)

string

AWS organization identifier

string

Template to be rendered. Valid values: aws-bash, aws-terraform

string[]

List of AWS accounts to register

string

Type of account. Valid values: commercial, gov

string

AWS profile to use during registration

string

Custom IAM role to be used during registration

boolean

Enable behavior assessment

boolean

Enable sensor management

boolean

Use existing CloudTrail

boolean

Enable DSPM

string

DSPM role ARN

string[]

DSPM regions

string

required

Destination path for the script (.sh extension)

switch

Overwrite existing file when present

Example

# Download AWS registration script
Receive-FalconCloudAwsScript -Path ./aws-register.sh -Template aws-bash -BehaviorAssessment $true

# Download Terraform template
Receive-FalconCloudAwsScript -Path ./aws-terraform.sh -Template aws-terraform -Account 123456789012

Overview

Authentication

Alerts & Detections

Host Management

Real-time Response

Threat Intelligence

Policy Management

Identity & Access

Security Operations

Monitoring & Analysis

Utilities

Cloud Security - AWS

Overview

Prerequisites

Get-FalconCloudAwsAccount

Parameters

Example

New-FalconCloudAwsAccount

Parameters

Example

Edit-FalconCloudAwsAccount

Parameters

Example

Remove-FalconCloudAwsAccount

Parameters

Example

Get-FalconCloudAwsLink

Example

Receive-FalconCloudAwsScript

Parameters

Example

​Overview

​Prerequisites

​Get-FalconCloudAwsAccount

​Parameters

​Example

​New-FalconCloudAwsAccount

​Parameters

​Example

​Edit-FalconCloudAwsAccount

​Parameters

​Example

​Remove-FalconCloudAwsAccount

​Parameters

​Example

​Get-FalconCloudAwsLink

​Example

​Receive-FalconCloudAwsScript

​Parameters

​Example

​Related Resources

Overview

Prerequisites

Get-FalconCloudAwsAccount

Parameters

Example

New-FalconCloudAwsAccount

Parameters

Example

Edit-FalconCloudAwsAccount

Parameters

Example

Remove-FalconCloudAwsAccount

Parameters

Example

Get-FalconCloudAwsLink

Example

Receive-FalconCloudAwsScript

Parameters

Example

Related Resources