Posture Condtion for CrowdStrike AV

[Matthew Martin]

Hello All,

ISE: v2.3.0.298  Patch 3

We are going to be moving from Symantec AV to CrowdStrike AV. I believe the product is called Falcon and it's currently on Version 5.

Looking through the Posture Conditions in ISE, I only see options for:

- ANY

- Falcon v2.x

- Falcon v3.x

Does my ISE version have anything to do with me not seeing Falcon v5.x ?

Thanks in Advance,

Matt

[Mike.Cifelli]

I just checked on version 2.4p9 and the AV Conditions for the CrowdStrike, Inc. vendor only have support for the products listed above. Would the ANY not suffice? What about adding additional checks such as a specific file condition or to ensure that a certain CrowdStrike service is running?

[Anurag Sharma]

Hi @Matthew Martin ,

AV is legacy (used in Compliance Module 3.x or earlier). Instead, use Anti-Malware. Your version (and others) is available.

[Matthew Martin]

Thanks for the reply.

Yup, that's right, found it yesterday. Sorry forgot to post that I found it.

Thanks Again,
Matt

[Matthew Martin]

So I created a new Posture Policy that checks for the CrowdStrike Anti-malware. I deleted my device from Context Visibility > Endpoints to force it to Reposture since it posture checks every 1 Day. When I reconnected to VPN I'm getting the System Scan Remediation window that's telling me that I don't have CrowdStrike installed.

Any ideas? It's definitely installed.

I created the Posture Requirement so that the device can have either Symantec OR CrowdStrike. It worked while I still had Symantec installed. Then after I uninstalled Symantec and installed CrowdStrike, Posture check now fails.

Thanks,

Matt

[Matthew Martin · Accepted solution]

It looks like CrowdStrike Falcon v5.x needs AnyConnect Compliance Module 4.3.770.6145

https://www.cisco.com/c/en/us/td/docs/security/ise/ac_compliance_module/cisco_anyconnect_ise_posture_win_support_charts_for_compliance_module_4_3_1280_6145.html#ISE_AM_Windows.xml

-Matt

[Anurag Sharma]

There is no reason to not use 4.x Compliance Module anyway. In fact, in my previous post, it shows in the screenshot the Compliance Module has to be 4.x or later.