Cloud Security

Overview

Manage Azure subscription and tenant registration, configuration, and monitoring for CrowdStrike Falcon Cloud Security (CSPM). These cmdlets enable you to connect Azure tenants, configure subscriptions, manage certificates, and monitor security posture across your Azure infrastructure.

Prerequisites

CSPM registration: Read - Required for retrieval operations
CSPM registration: Write - Required for account provisioning and modifications

Get-FalconCloudAzureAccount

Search for registered Falcon Cloud Security Azure accounts.

Get-FalconCloudAzureAccount

Get-FalconCloudAzureAccount [-Id <string[]>] [-TenantId <string[]>] [-ScanType <string>] [-Status <string>] [-CspmLite <boolean>] [-Limit <int32>] [-Offset <int32>] [-All] [-Total]

Parameters

string[]

Azure subscription identifier (GUID format)

TenantId

string[]

Azure tenant identifier (GUID format)

ScanType

string

Scan type. Valid values: full, dry

Status

string

Azure account status. Valid values: provisioned, operational

CspmLite

boolean

Only return CSPM Lite accounts

Limit

int32

Maximum number of results per request (1-500)

Offset

int32

Position to begin retrieving results

All

switch

Repeat requests until all available results are retrieved

Total

switch

Display total result count instead of results

Example

# Get all Azure accounts
Get-FalconCloudAzureAccount -All

# Get operational accounts
Get-FalconCloudAzureAccount -Status operational

# Get accounts by tenant
Get-FalconCloudAzureAccount -TenantId 12345678-1234-1234-1234-123456789012

New-FalconCloudAzureAccount

Provision a new Falcon Cloud Security Azure account.

New-FalconCloudAzureAccount

New-FalconCloudAzureAccount [-SubscriptionId <string>] [-TenantId <string>] [-ClientId <string>] [-AccountType <string>] [-DefaultSubscription <boolean>] [-YearsValid <int>]

Parameters

SubscriptionId

string

Azure subscription identifier (GUID format)

TenantId

string

Azure tenant identifier (GUID format)

ClientId

string

Azure client identifier

AccountType

string

Azure account type

DefaultSubscription

boolean

Account is the default Azure subscription

YearsValid

int

Number of years certificate is valid

Example

# Provision new Azure account
New-FalconCloudAzureAccount -SubscriptionId 12345678-1234-1234-1234-123456789012 -TenantId 87654321-4321-4321-4321-210987654321

# Provision as default subscription
New-FalconCloudAzureAccount -SubscriptionId 12345678-1234-1234-1234-123456789012 -DefaultSubscription $true

Edit-FalconCloudAzureAccount

Modify the default Falcon Cloud Security Azure client or subscription identifier.

Tenant ID is required when multiple tenants have been registered.

Edit-FalconCloudAzureAccount

Edit-FalconCloudAzureAccount -Id <string> [-TenantId <string>]
Edit-FalconCloudAzureAccount -SubscriptionId <string> [-TenantId <string>]

Parameters

string

Azure client identifier (GUID format)

SubscriptionId

string

Azure subscription identifier (GUID format)

TenantId

string

Azure tenant identifier (GUID format)

Example

# Update client ID
Edit-FalconCloudAzureAccount -Id 11111111-1111-1111-1111-111111111111 -TenantId 22222222-2222-2222-2222-222222222222

# Update default subscription
Edit-FalconCloudAzureAccount -SubscriptionId 33333333-3333-3333-3333-333333333333

Remove-FalconCloudAzureAccount

Remove Falcon Cloud Security Azure accounts.

Remove-FalconCloudAzureAccount

Remove-FalconCloudAzureAccount -Id <string[]> [-TenantId <string[]>] [-RetainTenant <boolean>]

Parameters

string[]

required

Azure account identifier (GUID format)

TenantId

string[]

Azure tenant identifier (GUID format)

RetainTenant

boolean

Retain Azure tenant when removing an account

Example

# Remove Azure account
Remove-FalconCloudAzureAccount -Id 12345678-1234-1234-1234-123456789012

# Remove and retain tenant
Remove-FalconCloudAzureAccount -Id 12345678-1234-1234-1234-123456789012 -RetainTenant $true

Get-FalconCloudAzureCertificate

Retrieve the base64 encoded certificate for a Falcon Cloud Security Azure tenant.

Get-FalconCloudAzureCertificate

Get-FalconCloudAzureCertificate -TenantId <string[]> [-Refresh <boolean>] [-YearsValid <string>]

Parameters

TenantId

string[]

required

Azure tenant identifier (GUID format)

Refresh

boolean

Refresh certificate (default: false)

YearsValid

string

Years the certificate should be valid (required when Refresh is true)

Example

# Get certificate for tenant
Get-FalconCloudAzureCertificate -TenantId 12345678-1234-1234-1234-123456789012

# Refresh certificate
Get-FalconCloudAzureCertificate -TenantId 12345678-1234-1234-1234-123456789012 -Refresh $true -YearsValid 5

Get-FalconCloudAzureGroup

Retrieve Falcon Cloud Security Azure management group registration.

Get-FalconCloudAzureGroup

Get-FalconCloudAzureGroup [-TenantId <string[]>] [-Limit <int32>] [-Offset <int32>]

Parameters

TenantId

string[]

Azure tenant identifier (GUID format)

Limit

int32

Maximum number of results per request (default: 100)

Offset

int32

Position to begin retrieving results

Example

# Get all management groups
Get-FalconCloudAzureGroup

# Get by tenant
Get-FalconCloudAzureGroup -TenantId 12345678-1234-1234-1234-123456789012

New-FalconCloudAzureGroup

Create a Falcon Cloud Security Azure management group.

New-FalconCloudAzureGroup

New-FalconCloudAzureGroup [-DefaultSubscriptionId <string>] [-TenantId <string>]

Parameters

DefaultSubscriptionId

string

Default Azure subscription identifier (GUID format)

TenantId

string

Azure tenant identifier (GUID format)

Example

# Create management group
New-FalconCloudAzureGroup -TenantId 12345678-1234-1234-1234-123456789012 -DefaultSubscriptionId 87654321-4321-4321-4321-210987654321

Remove-FalconCloudAzureGroup

Remove Falcon Cloud Security Azure management groups.

Remove-FalconCloudAzureGroup

Remove-FalconCloudAzureGroup [-TenantId <string[]>]

Parameters

TenantId

string[]

Azure tenant identifier (GUID format)

Example

# Remove management group
Remove-FalconCloudAzureGroup -TenantId 12345678-1234-1234-1234-123456789012

Receive-FalconCloudAzureScript

Download a Bash script which grants Falcon Cloud Security access using Azure Cloud Shell.

Receive-FalconCloudAzureScript

Receive-FalconCloudAzureScript [-TenantId <string>] [-SubscriptionId <string[]>] [-Template <string>] [-AccountType <string>] [-AzureManagementGroup <boolean>] -Path <string> [-Force]

Parameters

TenantId

string

Azure tenant identifier (default: most recently registered, GUID format)

SubscriptionId

string[]

Azure subscription identifier (default: all, GUID format)

Template

string

Template to be rendered

AccountType

string

Account type. Valid values: commercial, gov

AzureManagementGroup

boolean

Use Azure Management Group

Path

string

required

Destination path for the script (.sh extension)

Force

switch

Overwrite existing file when present

Example

# Download Azure registration script
Receive-FalconCloudAzureScript -Path ./azure-register.sh -TenantId 12345678-1234-1234-1234-123456789012

# Download for management group
Receive-FalconCloudAzureScript -Path ./azure-mgmt.sh -AzureManagementGroup $true

Overview

Authentication

Alerts & Detections

Host Management

Real-time Response

Threat Intelligence

Policy Management

Identity & Access

Security Operations

Monitoring & Analysis

Utilities

​Overview

​Prerequisites

​Get-FalconCloudAzureAccount

​Parameters

​Example

​New-FalconCloudAzureAccount

​Parameters

​Example

​Edit-FalconCloudAzureAccount

​Parameters

​Example

​Remove-FalconCloudAzureAccount

​Parameters

​Example

​Get-FalconCloudAzureCertificate

​Parameters

​Example

​Get-FalconCloudAzureGroup

​Parameters

​Example

​New-FalconCloudAzureGroup

​Parameters

​Example

​Remove-FalconCloudAzureGroup

​Parameters

​Example

​Receive-FalconCloudAzureScript

​Parameters

​Example

​Related Resources

Build docs developers (and LLMs) love

Overview

Prerequisites

Get-FalconCloudAzureAccount

Parameters

Example

New-FalconCloudAzureAccount

Parameters

Example

Edit-FalconCloudAzureAccount

Parameters

Example

Remove-FalconCloudAzureAccount

Parameters

Example

Get-FalconCloudAzureCertificate

Parameters

Example

Get-FalconCloudAzureGroup

Parameters

Example

New-FalconCloudAzureGroup

Parameters

Example

Remove-FalconCloudAzureGroup

Parameters

Example

Receive-FalconCloudAzureScript

Parameters

Example

Related Resources