Cloud Security - Azure

Overview

Manage Azure subscription and tenant registration, configuration, and monitoring for CrowdStrike Falcon Cloud Security (CSPM). These cmdlets enable you to connect Azure tenants, configure subscriptions, manage certificates, and monitor security posture across your Azure infrastructure.

Prerequisites

CSPM registration: Read - Required for retrieval operations
CSPM registration: Write - Required for account provisioning and modifications

Get-FalconCloudAzureAccount

Search for registered Falcon Cloud Security Azure accounts.

Get-FalconCloudAzureAccount

Get-FalconCloudAzureAccount [-Id <string[]>] [-TenantId <string[]>] [-ScanType <string>] [-Status <string>] [-CspmLite <boolean>] [-Limit <int32>] [-Offset <int32>] [-All] [-Total]

Parameters

string[]

Azure subscription identifier (GUID format)

string[]

Azure tenant identifier (GUID format)

string

Scan type. Valid values: full, dry

string

Azure account status. Valid values: provisioned, operational

boolean

Only return CSPM Lite accounts

int32

Maximum number of results per request (1-500)

int32

Position to begin retrieving results

switch

Repeat requests until all available results are retrieved

switch

Display total result count instead of results

Example

# Get all Azure accounts
Get-FalconCloudAzureAccount -All

# Get operational accounts
Get-FalconCloudAzureAccount -Status operational

# Get accounts by tenant
Get-FalconCloudAzureAccount -TenantId 12345678-1234-1234-1234-123456789012

New-FalconCloudAzureAccount

Provision a new Falcon Cloud Security Azure account.

New-FalconCloudAzureAccount

New-FalconCloudAzureAccount [-SubscriptionId <string>] [-TenantId <string>] [-ClientId <string>] [-AccountType <string>] [-DefaultSubscription <boolean>] [-YearsValid <int>]

Parameters

string

Azure subscription identifier (GUID format)

string

Azure tenant identifier (GUID format)

string

Azure client identifier

string

Azure account type

boolean

Account is the default Azure subscription

int

Number of years certificate is valid

Example

# Provision new Azure account
New-FalconCloudAzureAccount -SubscriptionId 12345678-1234-1234-1234-123456789012 -TenantId 87654321-4321-4321-4321-210987654321

# Provision as default subscription
New-FalconCloudAzureAccount -SubscriptionId 12345678-1234-1234-1234-123456789012 -DefaultSubscription $true

Edit-FalconCloudAzureAccount

Modify the default Falcon Cloud Security Azure client or subscription identifier.

Tenant ID is required when multiple tenants have been registered.

Edit-FalconCloudAzureAccount

Edit-FalconCloudAzureAccount -Id <string> [-TenantId <string>]
Edit-FalconCloudAzureAccount -SubscriptionId <string> [-TenantId <string>]

Parameters

string

Azure client identifier (GUID format)

string

Azure subscription identifier (GUID format)

string

Azure tenant identifier (GUID format)

Example

# Update client ID
Edit-FalconCloudAzureAccount -Id 11111111-1111-1111-1111-111111111111 -TenantId 22222222-2222-2222-2222-222222222222

# Update default subscription
Edit-FalconCloudAzureAccount -SubscriptionId 33333333-3333-3333-3333-333333333333

Remove-FalconCloudAzureAccount

Remove Falcon Cloud Security Azure accounts.

Remove-FalconCloudAzureAccount

Remove-FalconCloudAzureAccount -Id <string[]> [-TenantId <string[]>] [-RetainTenant <boolean>]

Parameters

string[]

required

Azure account identifier (GUID format)

string[]

Azure tenant identifier (GUID format)

boolean

Retain Azure tenant when removing an account

Example

# Remove Azure account
Remove-FalconCloudAzureAccount -Id 12345678-1234-1234-1234-123456789012

# Remove and retain tenant
Remove-FalconCloudAzureAccount -Id 12345678-1234-1234-1234-123456789012 -RetainTenant $true

Get-FalconCloudAzureCertificate

Retrieve the base64 encoded certificate for a Falcon Cloud Security Azure tenant.

Get-FalconCloudAzureCertificate

Get-FalconCloudAzureCertificate -TenantId <string[]> [-Refresh <boolean>] [-YearsValid <string>]

Parameters

string[]

required

Azure tenant identifier (GUID format)

boolean

Refresh certificate (default: false)

string

Years the certificate should be valid (required when Refresh is true)

Example

# Get certificate for tenant
Get-FalconCloudAzureCertificate -TenantId 12345678-1234-1234-1234-123456789012

# Refresh certificate
Get-FalconCloudAzureCertificate -TenantId 12345678-1234-1234-1234-123456789012 -Refresh $true -YearsValid 5

Get-FalconCloudAzureGroup

Retrieve Falcon Cloud Security Azure management group registration.

Get-FalconCloudAzureGroup

Get-FalconCloudAzureGroup [-TenantId <string[]>] [-Limit <int32>] [-Offset <int32>]

Parameters

string[]

Azure tenant identifier (GUID format)

int32

Maximum number of results per request (default: 100)

int32

Position to begin retrieving results

Example

# Get all management groups
Get-FalconCloudAzureGroup

# Get by tenant
Get-FalconCloudAzureGroup -TenantId 12345678-1234-1234-1234-123456789012

New-FalconCloudAzureGroup

Create a Falcon Cloud Security Azure management group.

New-FalconCloudAzureGroup

New-FalconCloudAzureGroup [-DefaultSubscriptionId <string>] [-TenantId <string>]

Parameters

string

Default Azure subscription identifier (GUID format)

string

Azure tenant identifier (GUID format)

Example

# Create management group
New-FalconCloudAzureGroup -TenantId 12345678-1234-1234-1234-123456789012 -DefaultSubscriptionId 87654321-4321-4321-4321-210987654321

Remove-FalconCloudAzureGroup

Remove Falcon Cloud Security Azure management groups.

Remove-FalconCloudAzureGroup

Remove-FalconCloudAzureGroup [-TenantId <string[]>]

Parameters

string[]

Azure tenant identifier (GUID format)

Example

# Remove management group
Remove-FalconCloudAzureGroup -TenantId 12345678-1234-1234-1234-123456789012

Receive-FalconCloudAzureScript

Download a Bash script which grants Falcon Cloud Security access using Azure Cloud Shell.

Receive-FalconCloudAzureScript

Receive-FalconCloudAzureScript [-TenantId <string>] [-SubscriptionId <string[]>] [-Template <string>] [-AccountType <string>] [-AzureManagementGroup <boolean>] -Path <string> [-Force]

Parameters

string

Azure tenant identifier (default: most recently registered, GUID format)

string[]

Azure subscription identifier (default: all, GUID format)

string

Template to be rendered

string

Account type. Valid values: commercial, gov

boolean

Use Azure Management Group

string

required

Destination path for the script (.sh extension)

switch

Overwrite existing file when present

Example

# Download Azure registration script
Receive-FalconCloudAzureScript -Path ./azure-register.sh -TenantId 12345678-1234-1234-1234-123456789012

# Download for management group
Receive-FalconCloudAzureScript -Path ./azure-mgmt.sh -AzureManagementGroup $true

​Overview

​Prerequisites

​Get-FalconCloudAzureAccount

​Parameters

​Example

​New-FalconCloudAzureAccount

​Parameters

​Example

​Edit-FalconCloudAzureAccount

​Parameters

​Example

​Remove-FalconCloudAzureAccount

​Parameters

​Example

​Get-FalconCloudAzureCertificate

​Parameters

​Example

​Get-FalconCloudAzureGroup

​Parameters

​Example

​New-FalconCloudAzureGroup

​Parameters

​Example

​Remove-FalconCloudAzureGroup

​Parameters

​Example

​Receive-FalconCloudAzureScript

​Parameters

​Example

​Related Resources

Overview

Prerequisites

Get-FalconCloudAzureAccount

Parameters

Example

New-FalconCloudAzureAccount

Parameters

Example

Edit-FalconCloudAzureAccount

Parameters

Example

Remove-FalconCloudAzureAccount

Parameters

Example

Get-FalconCloudAzureCertificate

Parameters

Example

Get-FalconCloudAzureGroup

Parameters

Example

New-FalconCloudAzureGroup

Parameters

Example

Remove-FalconCloudAzureGroup

Parameters

Example

Receive-FalconCloudAzureScript

Parameters

Example

Related Resources