What does the integration do?
EasyNAC can use CrowdStrike Falcon management and supported protection-status information to inform network access decisions. Eligible managed devices can be recognized through default Auto Trust, while access outcomes follow your configured requirements.
This combines endpoint-security context with network access control; it does not replace Falcon protection or incident investigation.
The official CrowdStrike Marketplace listing describes device-enrollment recognition and checks for sensor currency, firewall status and Device Control. Confirm the checks available for your current platform, licensing, connector and release.
Prepare a small, representative pilot.
- An EasyNAC appliance or VM connected to the network being evaluated.
- A supported Falcon environment and an administrator authorized to configure its integration.
- The connector settings, API permissions and connectivity required by your current release.
- A managed test endpoint with a matching device record, plus an unapproved test device.
- AD integration if your evaluation includes AD-joined status.
- Agreed access outcomes, a recovery path and essential services to preserve during restrictions.
Keep credentials in the product’s approved connector configuration. Never put client secrets into public pages, screenshots or the deployment simulator.
Connect Falcon and confirm recognition.
- Bring EasyNAC online. Deploy the appliance or VM, configure its IP and review discovered devices.
- Connect CrowdStrike Falcon. Configure the CrowdStrike API access URL, client ID and client secret. The appliance help lists Hosts, Sensor Update Policies and Zero Trust Assessment API scopes. Set the query interval, test the connection and validate the returned device match.
- Connect AD where required. Confirm that the directory information and Falcon record identify the actual endpoint being tested.
- Confirm default Auto Trust. The default policy includes AD-joined and XDR-managed checks; you do not need to create separate Windows and macOS authentication profiles for this agentless workflow.
Current setup requirements take precedence over an older demonstration. Use the compatibility guide and confirm the required API access with the EasyNAC team before production rollout.
Use the documented Falcon checks.
The CrowdStrike connector documents separate conditions for:
- Devices running the CrowdStrike agent.
- Devices that have not reported within a configured number of days, or whose sensor update is older than a configured number of days.
- Disabled Device Control or firewall, as reported by CrowdStrike.
- Zero Trust Assessment scores below configured high-risk and low-risk thresholds.
The connector applies tags when enabled conditions match the information reported by the source. EasyNAC uses those tags in Auto Trust and role-based access decisions. Managed-device recognition and additional health requirements serve different purposes: the resulting access follows the policy in use.
For example, a recognized Falcon-managed endpoint can be distinguished from one with stale sensor information, disabled firewall or a reported Zero Trust score below the threshold your team has chosen. These are source-reported conditions, not a guarantee that enrollment establishes complete endpoint compliance.
Checks refresh on the configured query interval; they are not an instantaneous live assessment of every endpoint. After correcting a condition, confirm the source has reported the change and EasyNAC has refreshed its information before checking restored access.
Demonstrate the access decisions.
| Test | What to demonstrate | Evidence to record |
|---|---|---|
| Managed device | An eligible, recognized endpoint receives its intended access. | Device match, policy reason and access result. |
| Unapproved device | A test device without approved access is restricted. | Discovery event and blocked-resource test; portal access if configured. |
| Health requirement | A supported failed health requirement produces the configured restriction. | Reported status, refresh time and policy decision. |
| Recovery | Access returns after the required evidence is restored. | Updated status, authorization reason and recovery time. |
| Missing information | The agreed behavior occurs when connector data cannot be used. | Alert, access outcome and administrator recovery procedure. |
Use the editable Evaluation Kit scorecard to record actual outcomes. This checklist is a pilot plan, not a claim that every Falcon configuration exposes identical checks.
Maintain the connection and the evidence.
- Review connector permissions and credential rotation with the Falcon administrator.
- Check integration health, device matching and data freshness.
- Retest after relevant product, API or policy changes.
- Keep approval exceptions and recovery procedures current.
- Retain enough event information to explain access decisions.
Network-deception and other automated threat-response workflows are separate capabilities. Do not assume that a Falcon management check automatically implements every containment or incident-response action.
See the recorded workflow, then try the lab.
The CrowdStrike integration video page includes the demonstration, chapter links and a condensed transcript. It shows an earlier interface and a configured policy; your current release includes the default Auto Trust workflow described here.
The lab is a local simulation. It does not connect to Falcon, retrieve real device records or change your network.
Common integration questions.
Do I need another NAC agent on Falcon-managed endpoints?
The supported agentless integration uses evidence from your existing tools without adding a dedicated NAC agent for that workflow. Local application or deeper assessment requirements may use a different method; confirm your exact checks.
Does Falcon enrollment automatically mean the device is compliant?
No. Enrollment establishes management context. Compliance depends on the supported status information and requirements used in your policy.
Can I deploy this through branches?
Plan appropriate EasyNAC appliance or Enforcer Sensor coverage for each network. Larger deployments can use optional CVM for centralized appliance configuration. Validate connectivity and device matching at each representative site.
Sources and scope
Prepared by InfoExpress, the company behind EasyNAC. The connector checks in this guide were verified against the EasyNAC appliance help on 14 October 2026. Availability depends on the source-product configuration and supported connector version.
Prove it on your network.
Use a representative pilot and record the actual access outcomes, administrator effort and exceptions.