Please find a list of frequently asked questions regarding the Automox and Crowdstrike partnership and integration troubleshooting
What are the requirements for linking my CrowdStrike and Automox accounts?
- Automox Side: Full Administrator
- CrowdStrike side: Falcon Administrator
- Link to CrowdStrike Docs (note: must have CrowdStrike account to view)
- Subscription Status:
- Automox Side: Trial (45 days), Patch, Manage
- CrowdStrike Side: Trial (45 days), Falcon Insights (linking + deploying agent), Spotlight (CVE Remediation - coming soon)
- Joint email/shared user account
- If you are attempting to link an existing Automox organization to a CrowdStrike account, you must use an email that is associated with the Automox organization and has the appropriate permissions (Full Administrator)
- Ability to receive email
- When you select the Automox app in the CrowdStrike store, you have up to 7 days to click the link in the email and either set-up a new Automox organization or link an existing Automox organization.
- Note: if you already have an Automox organization, but aren’t prompted by the email hyperlink to link that account, there may be an issue (review checklist in integration overview)
What can I do with my CrowdStrike/Automox link?
- Set up a CrowdStrike policy to deploy the Automox agent on Windows hosts (see integration overview for instructions)
- Remediate CVEs associated with Windows OS (coming soon...)
Can I link my CrowdStrike account with my Automox organization outside of the Crowdstrike store?
- No. In order to set up a CrowdStrike policy to determine whether or not the Automox agent is on an endpoint and deploy it to that endpoint when it is not, you will need to link your CrowdStrike account in the CrowdStrike store. This is also required for Automox to be able to remediate threats surfaced in Spotlight.
If I "Stop App access" in the CrowdStrike store, can I re-establish the link between my CrowdStrike account and Automox organization?
- Yes, but it will require intervention from the Automox and CrowdStrike support teams. Please reach out to us at firstname.lastname@example.org and let us know more about your situation. You are able, however, to pause the Automox app access within the CrowdStrike store and resume it without CS/AX support.
Am I able to link more than one Automox org to my CrowdStrike account?
- No. At this time you can link your CrowdStrike account to only one Automox organization at a time. That also means that you are only able to deploy one organization's agent via a CrowdStrike policy.
What are the requirements to set up a CrowdStrike policy to deploy the Automox agent?
- Only Windows hosts supported at this time by CrowdStrike
- Windows hosts must have Powershell 3.0 or higher
- You must configure your response policies to enable Real Time Response 'put' commands on your hosts
Please review the integration overview for a full explanation. CrowdStrike documentation on Software Update Policies
I didn't receive an email to either link my existing Automox organization or create a new one after clicking on the Automox app in the CrowdStrike store. What should I do?
- Please reach out to email@example.com with the email address that you use to sign into CrowdStrike, your CrowdStrike customer ID (CID) and your Automox organization ID and we will ensure it gets handled.
My hosts are stuck in a 'changes pending' state for my Automox Software install. What should I do?
- Please ensure that the Automox installer file is in the "put" files section in the Response Scripts & Files. If it is not there, please reach out to us at firstname.lastname@example.org
What are the different possible states for the Automox application in the CrowdStrike store, and what do they mean?
- No status: The Automox app has not been initiated. In this state, you are able to 'Try it for free' by clicking on the button. If you have already purchased an Automox subscription, this will create the link to your existing Automox organization.
- Pending, email sent: This means that someone has clicked the 'Try it for free' button and an email has been sent to that user's account with the hyperlink to link your CrowdStrike account to an Automox organization. It will stay in this state until a link has been made.
- Trial in progress: This means that the CrowdStrike account has been successfully linked to an Automox organization. It will remain in this state in the UI even when you have purchased. Therefore, the two underlying states could mean:
- In Trial - The CrowdStrike/Automox joint trial lasts a total of 45 days. After that, you will be prompted to purchase both an Automox and a CrowdStrike subscription.
- Purchased - You have purchased both an Automox subscription and a CrowdStrike subscription.
- No longer active: You have stopped Automox access to your CrowdStrike account. You will need to work with both support teams to get your account/org re-linked.
What should I do if I've read the documentation on the Automox and Crowdstrike side and I'm still having trouble?
We're happy to help you troubleshoot the integration. If, after checking our FAQ and implementation notes, you're still running into trouble please reach out to email@example.com with the following information:
- Your customer name (for CrowdStrike and Automox):
- The Automox Organization ID:
- Your CrowdStrike CID:
- Your Automox App state in the CrowdStrike store:
- Brief Description of what's going on: