Crowdstrike - Configuration of Crowdstrike Falcon Platform

A certified technical consultant of TIM will configure the Falcon Platform from Crowdstrike. These tasks will be accomplished:

1. Prepare the tenant: Create administrator accounts, enable MFA/SSO, define RBAC roles, review licensing, configure audit logging.

2. Configure host groups: Create host groups for servers, workstations, test devices, cloud workloads, etc. These groups are used to apply policies.

3. Configure policies: Configure Prevention Policies, Sensor Update Policies, Firewall Management (if licensed), Device Control, USB policies, and Sensor Protection (tamper protection).

4. Download the sensor: Download the correct Windows, macOS, or Linux sensor and note your Customer ID (CID), which is required during installation.

5. Deploy the sensor: Deploy using Intune, Microsoft Configuration Manager (SCCM), Group Policy (GPO), Workspace ONE, Jamf, scripts, or another software deployment solution. The installer requires the CID.

6. Verify deployment: Ensure endpoints appear in the Falcon console, verify sensor status, connectivity, and policy assignment.

7. Configure detection & response: Enable detection policies, configure incident workflows, define notification rules, create detection exclusions where justified, and integrate with SIEM/SOAR if used.

8. Configure identity & access: Integrate with Microsoft Entra ID (Azure AD), Okta, or another IdP for SAML SSO, enable MFA, and assign appropriate roles.

9. Configure reporting: Build dashboards, schedule reports, configure API access, and connect to Splunk, Microsoft Sentinel, QRadar, or other platforms if required.

10. Operational tuning: Review detections, create allowlists only when necessary, tune prevention policies, update sensors in phases, and monitor sensor health.