CrowdStrike asset owner (WIP)

Works out who uses a host by querying logon telemetry in the CrowdStrike Falcon LogScale (Humio) repository and attributing the host to the user who appears most. It creates no assets — it fills in asset_owner on the ones you already have.

Type name	crowdstrike_asset_owner
Creates	Nothing — enriches existing endpoints
Runs on	A sensor with outbound reach to the Falcon API
Fields written	asset_owner, optionally department and criticality

How ownership is resolved

1. For every endpoint already in the inventory, run a query job against the Falcon investigate_view repository for that host's observed logons.
2. If exactly one user appears, that user wins.
3. If several appear, the one accounting for more than 50% of the host's logon events wins. If no user clears that bar, the host is left unowned.
4. Match the winning username against existing user assets, by the local part of user_email, by active_directory_user_sam_account_name, or by active_directory_user_surname.
5. Write the matched user asset's ID into the host's asset_owner.

Hosts are matched to telemetry by hostname, compared case-insensitively against the asset's names.

Ownership is a link, not a string

asset_owner holds the ID of a user asset. A person with no user asset cannot be assigned as an owner, so import identities first with Active Directory users or Azure users.

An existing owner is never overwritten

If a host already has a different asset_owner, the conflict is logged and the host is skipped. Manual assignments stick.

Requirements

The integration is outbound-only: it is a scheduled API client, so nothing is installed on the CrowdStrike side, nothing runs on the endpoints themselves, and nothing has to reach into the deployment.

Network access

From	To	Protocol	Port
The sensor running the integration	The Falcon API host for your region, e.g. api.us-2.crowdstrike.com	HTTPS over TCP	443

The token request, the host enumeration and the LogScale query jobs all go to that same host, so one egress rule covers the whole integration. Open it for your region's host — credentials issued in one Falcon cloud do not authenticate against another — and if the sensor reaches the internet through a proxy, point Proxy settings at it rather than opening direct egress.

Access in CrowdStrike

Need	Why
An account that can create API clients in the Falcon console	The credential is created under Support and resources → API clients and keys, which is admin-gated
Hosts: Read plus query access to the LogScale repository	Two scopes, because the run enumerates hosts and then queries logon telemetry — see Permissions in CrowdStrike
Logon events actually present in investigate_view	Ownership is inferred from logon telemetry; a repository without it resolves no owners while the run still succeeds

In this deployment

Need	Why
A registered, healthy sensor	The integration runs on a sensor, on the platform's schedule — see Sensors
Endpoints already discovered by CrowdStrike	This integration creates nothing — it writes asset_owner onto hosts that already exist, matched by their Falcon device ID
Users in the inventory, for department and criticality	The enrichment copies user_department and criticality from the owning user's record, so those fields need a user source such as Azure users

Configuration

Field	Required	Notes
Name	Yes	Label for this instance
API URL	Yes	Region-specific Falcon API base, e.g. https://api.us-2.crowdstrike.com
Client ID	Yes	Falcon API client ID
Client secret	Yes	Falcon API client secret
Proxy settings	No	http://host:port
Sensor	Yes	Sensor that will run the integration
Ignore SSL	No	Skips certificate validation

Its scan template adds a look-back window and an enrich host information by asset owner checkbox, on by default, which sets the host's department from the owner's user_department and propagates criticality.

Enrichment is how departments get onto hosts

Nothing else in the catalogue can tell you which department a laptop belongs to. Resolving the owner and inheriting their department is what turns an inventory into something you can report on by business unit.

Permissions in CrowdStrike

The API client needs read access to hosts to enumerate endpoints, plus query access to the LogScale investigate_view repository.

Scope	Access
Hosts	Read
Event search / LogScale repository	Read

TODO

Confirm the exact Falcon API scope name granting query-job access to investigate_view on the current console, and document the logon event types the query selects so the 50% threshold can be reasoned about.

See also

• CrowdStrike — the inventory source this depends on
• Elastic asset owner — the same idea using Elastic logs
• Integrations overview — the shared configuration model