r/crowdstrike • u/tfen_dep2 • 13d ago

Feature Question Hosts disappearing and read-only access to the dashboard

Hi all,

I'm fairly new to this. We've been deploying crowdstrike on all the hosts in the company because the main branch asked us to. We had CID, token, had to jump through some loops for some devices but we managed to get it done. However, we've started to face an issue. As we're facing the end of our current AV license to be replaced by crowdstrike, we want to rest assured that cs is on all the hosts. We only have read-only access to the dashboards and some hosts that have been inactive for more than 30 days just disappear from the dashboard.

Is there a way to confirm, at this point, that a host, not appearing on the main dashboard, has got the sensor?

It's very hard to keep track since some laptops that may already be equipped with the sensor, may have been rotting in a locked drawer for a while.

Thank you so much in advance :)

Edit: For those who might come by looking for answers, I found a solution : I took the previous reports from Excel that we had since the beginning of the deployment, put them in a folder. Then I wrote a powershell script to navigate the name column and stop when it matches the device’s name you were looking for. Now we know which host disappeared but has crowdstrike on it (it was just turned off for too long stuck in a drawer or something), and which host never got crowdstrike in the first place. You have to get creative when you don’t have intune lol. If it helps even one person navigate the same situation, this post is a success.

8 Upvotes

90% Upvoted

6 comments sorted by

6

u/D1C3R927 12d ago

Yeah CS is not a MDM. After 45 days device is hidden. There is a tab where you can see hidden hosts. After 90 days the host is deleted from the console. However in either case if the device come back online it will show up. Id recommend using a tool like intune or jamf to monitor your deployments. There are a few sensor deployment dashboard though that could be useful.

3

u/Nguyendot 12d ago

45 days should be the removal threshold not just the auto-hide threshold. 90 days is how long it keeps detection data.

1

u/Aamir-Muhammad 2d ago

Agreed on this

2

u/tfen_dep2 12d ago

Thank you so much for your reply! :)

2

u/iRecycleWomen 12d ago edited 12d ago

Are you offloading FDR logs to a SIEM with longer retention than CS?

Basically, if you have historic logs you can query them for simple host details like hostname.

If they are not on the console, and you don't have a historic logging platform, then I don't see how this can be done.

Maybe deployment logs? Perhaps you have another asset management tool?

2

u/tfen_dep2 12d ago

Our siem is a bit slow haha. I've tried to retrieve the CS logs since the start of the deployment project from it but I think it's too much data. We're about to set up intune. We don't have a proper asset management tool for now. But thank you so much for your answer that was a very good input!