Headline

Red Hat Insights expands its detection capabilities with CrowdStrike integration

Red Hat Insights has expanded its recommendation capabilities to security software by integrating with CrowdStrike, a security provider which provides protection across endpoints and cloud workloads, identity and data. Insights Advisor provides Red Hat administrators proactive recommendations and early warnings for their Red Hat systems based on decades of operational expertise from Red Hat and select independent software vendor (ISV) partners. Through a new integration between Insights and the lightweight CrowdStrike Falcon® agent, organizations can have greater confidence that their Red Hat

1 month ago

Red Hat Blog

Open in Source

#linux #red_hat #js #auth #rpm

Correct deployment and maintenance of any security tool is paramount to its effective protection. While the CrowdStrike Falcon sensor is certified for RHEL and requires no local configuration, proactive guidance helps operations and security teams stay in sync on the sensor’s requirements for effective protection. The integration eliminates communication gaps between these teams by bringing CrowdStrike-specific recommendations directly to the Red Hat Hybrid Cloud Console. CrowdStrike is the first security partner of Red Hat to provide this kind of integration.

In the next few sections, we’ll explore how to set up the integration, what recommendations are available, and how to interact with CrowdStrike Falcon data using the Insights API.

Getting started with Red Hat Insights and CrowdStrike Falcon

To start protecting your RHEL systems with the CrowdStrike Falcon platform, you need to install the Falcon sensor RPM package. Red Hat customers can use the Red Hat Ansible Certified Content Collection for CrowdStrike to simplify the deployment process through automation. If you are not a CrowdStrike customer, you can start a free trial.

Enabling Insights on a RHEL system is very straightforward and typically requires just to register a host by running insights-client --register. For more information, check out the Insights getting started guide. No additional setup is required to activate the CrowdStrike Falcon integration, as Insights collects all required data and systems facts out of the box.

Recommendations available in the Insights Advisor service

The main goal of the recommendations Red Hat developed with CrowdStrike is to make sure the RHEL endpoints run a supported version of the Falcon sensor and that it’s set up correctly for optimal operation. Doing so makes sure that the handoff of the Falcon sensor from the security team to the operations team doesn’t result in any miscommunication or gap in protection.

After navigating to the Insights Advisor service, CrowdStrike recommendations will show up next to the rest of the default recommendations that Insights provides.

Ensuring compatibility between RHEL and the Falcon sensor

If the installed Falcon sensor is incompatible with the RHEL host, it will fall into Reduced Functionality Mode (RFM) in which it is unable to detect or prevent any malicious behavior, significantly limiting its security protection. RFM is highlighted to security teams in the Falcon console, and this recommendation brings that same visibility to operations teams in the Red Hat Hybrid Cloud Console. Insights Advisor mitigates this configuration issue by recommending the correct sensor mode based on the host’s kernel version.

The Falcon sensor is in Reduced Functionality Mode (RFM) when it is set to kernel mode and does not support the current kernel

Making sure you are running a fully supported Falcon sensor

CrowdStrike continually releases new sensor versions and sunsets old ones in order to provide customers the best security capabilities. The Falcon platform supports automated over-the-air updates, but some organizations may choose to manually push these updates instead. Insights Advisor is now aware of the Falcon sensor’s support lifecycle and will alert when the installed sensor version is nearing or past the end of its lifespan, and provide guidance for automatically or manually upgrading the sensor.

The installed CrowdStrike Falcon sensor version reached the End-of-Support date

Watching for a non-running Falcon sensor

Ensuring the Falcon system service is running is critical to providing enhanced protection. If Insights Advisor detects that the service is installed but not running, a recommendation will be shown to start and enable the service. Note that the Red Hat Ansible Certified Content Collection for CrowdStrike handles this automatically during Falcon sensor deployment.

The CrowdStrike Falcon sensor’s runtime protection is disabled when the Falcon sensor service is not running

Additional system facts and integration through Insights APIs

Insights users can integrate Red Hat Insights into their existing operational workflows. As part of our collaboration with CrowdStrike, we have introduced three new system facts that are now available for those who prefer to query their Insights inventory through Insights APIs:

falcon_aid - a unique identifier of the host in the Falcon platform
falcon_backend - indicates whether the Falcon sensor is running in kernel, eBPF or auto-switching mode
falcon_version - version of the Falcon sensor

To query Insights inventory for these new systems facts, you can run the following command:

curl -X 'GET' \
'https://console.redhat.com/api/inventory/v1/hosts/<system_uuid>/system_profile?fields%5Bsystem_profile%5D=third_party_services'
\
 -H 'accept: application/json' \
 -H 'Authorization: Bearer <token>'

THe JSON response will contain the following:

{
 "id": "system_uuid",
 "system_profile": {
   "third_party_services": {
     "crowdstrike": {
       "falcon_backend": "<falcon_backend_mode>",
       "falcon_aid": "<falcon_aid>",
       "falcon_version": "<falcon_sensor_version>"
     }
   }
 }
}

Check out the Red Hat Insights API Cheat Sheet to get started with Insights APIs.

Learn more