Integrating with CrowdStrike to Collect Evidence

You can set up the CrowdStrike collectors to automatically collect evidence of monitoring workstations by your Endpoint Detection and Response (EDR). Adding a collector will connect CrowdStrike with an evidence task so that evidence collection can begin. For information on managing your collector, see Managing Collectors .

To set up and activate collectors

Collectors are integrations that are set up to pull evidence from third-party systems. To integrate OneTrust with a third-party system, you must set up the credentials that OneTrust will use to connect to the system. You have the ability to create a new credential when setting up the collector.

  1. On the Compliance Automation menu, select Setup > Evidence Integrations.
    The Evidence Integrations screen appears.

  2. Click on the CrowdStrike system.

    The Integration Details screen appears.

  3. Click the Add Collector button.
    The Add Collector for CrowdStrike modal appears.

  4. Select the service that will collect evidence and click the Continue button.
  5. Complete the fields in the Add Details tab. For more information, see Add Details Screen Reference.
  6. Click the Continue button.
  7. Complete the fields in the Define Evidence Collection tab. For more information, see Define Evidence Collection Screen Reference.
  8. Click the Continue button.
  9. Review the information for the collector.

    Click the Previous button to edit the evidence collection details.

  10. Click the Activate Collector button to save and activate the collector. The collector's status will appear on the Integration Details screen. For information on managing your collector, see Managing Collectors .
    Note:

    This is the only location where you can activate the collector. This is to ensure the collector is not activated by mistake.

Add Details Screen Reference



Step

Field

Description

Add Details

Collector Name

Enter a unique and descriptive name for the collector that will be used to create the integration. This name will help you to identify the collector in future interactions.

Note:

Once you advance to the next screen, you cannot change the collector name.

Collector Assignee Email

Enter the email address that will receive notifications related to this collector. Create a distribution list if you would like to notify multiple users.

Email notifications are sent in the following situations:

  • The collector has been assigned to you and activated.

  • Evidence has been successfully captured.

  • Errors were found while capturing evidence automatically.

Choose Credentials

Select Credential

Select the existing credential you would like to use to share data securely. The collector will use credentials to access and gather data from the desired source.

You can create a new credential by clicking the Add new credential option. The Add new credential modal will appear.

Note:

You can also create a new credential in the Integrations menu. Once the new credential is created, it will appear as a saved credential. For more information, see Configuring Integration Credentials.

Add New Credential Modal

Credential Name

Enter a name to identify the credentials.

Note:

This field and all fields below only appear when you select the Add new credential option.

Description

Enter a description of the credentials.

Client Id

Enter the Client ID. To locate the Client ID, see Part 1 of Crowdstrike Integration Setup Instructions.

Client Secret

Enter the Client Secret. To locate your Client Secret, see Part 1 of Crowdstrike Integration Setup Instructions.

Save Credential

Click the Save button to create and save the new credential.

Note:

If the credential is unable to collect evidence, you will need to select or create another credential.

Test Credential

Click the Test Credential button to test the credentials ability to collect evidence.

Define Evidence Collection Screen Reference



Step

Field

Description

Choose Evidence Tasks

Evidence Task List

Select one or more evidence tasks for this collector. You can filter the evidence tasks list by recommended, all evidence tasks, and selected tasks.

Assign Collection Intervals

Collection Interval

Select a collection interval to determine how often this collector will sync and collect evidence. The collection interval will apply to all selected evidence tasks.

Tip:

OneTrust recommends you choose the most frequent option.

For example, if the evidence tasks you selected have a frequency of Monthly, Quarterly, and Yearly - you should choose Monthly for your collection interval.

Time of Day

Select the time of day that evidence will be collected. All times are in UTC.

Day of the Week

Select the day of the week that evidence will be collected.

Note:

This option only appears if the Weekly collection interval is selected.

Day of the Month

Select the day of the month that evidence will be collected.

Note:

This option only appears if the Monthly, Quarterly, or Biannually collection interval is selected.

Interval Start Month

Select the month when evidence will start being collected. This will set the cadence of evidence collection.

Note:

This option only appears if the Quarterly or Biannually collection interval is selected.

Date and Time of Day

Select the date and time that evidence will be collected. All times are in UTC.

Note:

This option only appears if the Yearly collection interval is selected.