PARTNER BRIEF

Unify risk posture with
Cloudflare & CrowdStrike
Integrate to exchange risk indicators and enforce
controls based on device posture.

Challenge: Rising complexity to manage risks
Managing risk effectively and efficiently is becoming exceedingly complex as attack surfaces expand.
Security teams today struggle with siloed tools with limited interoperability that require too much manual effort andexpertise to assess, prioritize, and mitigate evolving risks within a business.

Joint solution with Cloudflare & CrowdStrike
Cloudflare and CrowdStrike exchange risk signals and enforce security controls dynamically. Set up the integration
only once and begin automating how you adapt to risks across users, devices, and applications:●●Ingest the CrowdStrike Falcon® Zero Trust Assessment (ZTA) score into Cloudflare to enforce device
posture across all access requests
Share Cloudflare logs with the Falcon® Next-Gen SIEM to enrich real-time visibility across Security Service
Edge (SSE) and web application and API protection (WAAP) security domains

Adopt Zero Trust

Simplify threat defense

Automate SOC response

Default-deny, least privilege rules
based on device posture for web,
SaaS, and private app requests.

Layer policies to guard users anddevices from multi-channel
phishing, ransomware, and more.

Build mitigation workflows withinyour CrowdStrike NG-SIEM
enriched by Cloudflare telemetry.

1 888 99 FLARE | enterprise@cloudflare.com | Cloudflare.com

REV:PMM-JUNE2024

Cloudflare + CrowdStrike | Unified Risk Posture

Use case: Enforce Zero Trust with Cloudflare & CrowdStrike
Below is a sample workflow of how Cloudflare and CrowdStrike work together to enforce Zero Trust policies and mitigate
emerging risks. Together, Cloudflare and CrowdStrike complement each other by exchanging activity and risk data andenforcing risk-based policies and remediation steps.

Phase 1

Phase 2Phase 3

Remote user access request

Remote user

User activity
User potentiallycompromised

BlockCloudflareactions

SWG

ZTNA with
device posture

CES

Share logs on blocked activity likerisky web browsing & phishing emails

Block access based on
CrowdStrike risk score

User risk scoring(UEBA)

Quarantine

Increase user risk score after
failed device posture check

Share Cloudflarelogs

CrowdStrikeactions

FalconNext GenSIEMFalconInsight
XDR

Alert analyst ofsuspicious activity

Detect infectedendpoint

Share CrowdStrike
Falcon ZTA risk scorewith Cloudflare

Falcon Next Gen SIEM

Propose remediation
to analyst

Select remediation &enforce additional controls

Phase 1: Automated investigation

Phase 2: Zero Trust enforcement

Phase 3: Remediation

Cloudflare and CrowdStrike help anorganization detect that a user iscompromised.

This org has set up device posturechecks via Cloudflare’s Zero Trust
Network Access (ZTNA), only allowing
access when the Falcon ZTA risk scoreis above a specific threshold they havedefined.

In parallel, CrowdStrike’s Next-Gen
SIEM has continued to analyze thespecific user’s activity and broader
risks throughout the organization’senvironment. Using machine learningmodels, CrowdStrike surfaces top risks
and proposes solutions for each risk toyour analyst.

In this example, Cloudflare has recently
blocked web browsing to risky
websites and phishing emails, serving
as the first line of defense. Those logs
are then sent to CrowdStrike Falcon
Next-Gen SIEM, which alerts yourorganization’s analyst about suspicious
activity.
At the same time, CrowdStrike Falcon
Insight XDR automatically scans thatuser’s device and detects that it isinfected. As a result, the Falcon ZTA
score reflecting the device’s health islowered.

Our ZTNA denies the user’s next
request to access an application
because the Falcon ZTA score falls
below that threshold.
Because of this failed device posturecheck, Cloudflare increases the risk
score for that user, which places themin a group with more restrictivecontrols.

1 888 99 FLARE | enterprise@cloudflare.com | www.cloudflare.com

The analyst can then review and selectremediation tactics — for example,
quarantining the user’s device — tofurther reduce risk throughout theorganization.

REV:PMM-JUNE2024

Cloudflare + CrowdStrike | Unified Risk Posture

Impacts
Flo Health uses Cloudflare &CrowdStrike to enforce device
posture for all employees accessrequests to sensitive apps.
Case study on the world’s
most popular female health app“The Cloudflare integration with
Crowdstrike strengthens ouroverall security posture.”
Troy Ridgewell
Head of Security, Stax
Case study on this AWS management platform“By expanding our partnershipwith Cloudflare, we are making iteasier for joint customers tostrengthen their Zero Trust
security posture across all
endpoints and their entire
corporate network.”
Michael Sentonas
President, CrowdStrike

Global cybersecurity leader and Cloudflare
technology partner

Ready to discuss your risk management approach?
Request a consultation
Want to keep learning more?
Read our announcement blog or visit our tech partner directory