Repository

azure-storage-account-container-protection

CrowdStrike Falcon Azure Storage Account Container Protection

README

CrowdStrike

Twitter URL

[!WARNING]

DEPRECATION NOTICE

This repository will be deprecated in the near future in favor of our new Cloud Storage Protection examples using the QuickScan Pro APIs. The new repository is available at:

https://github.com/crowdstrike/cloud-storage-protection

CrowdStrike Falcon Azure Storage Account Container Protection

Prerequisites

  • Have access to Azure w/ permissions to manage resources
  • Knowledge on creating Falcon API Keys

Demonstration

This demonstration creates a new Azure Storage Account Container, implements Azure Storage Account Container Protection on that container, and then deploys an instance with several test scripts and sample files for testing the integration in a real environment.

Start the demo by following this documentation:

Demo

On-demand scanning

For scenarios where you either do not want to implement real-time protection, or where you are wanting to confirm the contents of a storage container before implementing protection, an on-demand scanning solution is provided as part of this integration.

This solution leverages the same APIs and logic that is implemented by the serverless handler that provides real-time protection.

The read more about this component, and use it by following this documentation:

On Demand.

Deploying to an existing storage container

A helper routine is provided as part of this integration that assists with deploying protection to an existing storage container. This helper leverages Terraform, and can be started by executing the existing.sh script.

Start the demo by following this documentation:

Existing