MSSQL Connector CrowdStrike Workflow Execution

Follow these steps to deploy and execute the MSSQL Server Data Sensor using a CrowdStrike workflow.

Prerequisites

The following prerequisites must be met.

CrowdStrike RTR

The CrowdStrike Real Time Response (RTR) service collection is required to perform AgileSec scanning. See https://developer.crowdstrike.com/api-reference/collections/real-time-response/ for additional details.

Optional: Host Group

While this step is optional, it is recommended to create host groups to organize your hosts. This allows you to selectively target only the hosts where you want to run scans when configuring workflows, rather than scanning all hosts in your environment.

1. Add your Linux hosts in CrowdStrike

2. Add your Window hosts in CrowdStrike

3. Add your Mac hosts in CrowdStrike

4. Add your hosts to a host group

Set up EDR ID

An EDR ID is used to obtain an access token for communicating with the AgileSec platform. This process is automatic: when a Scan runs, the configured EDR ID is presented to the Ingestion Service, which returns a Remote Sensor Token. The token is stored locally and used for subsequent authenticated communication with the Ingestion Service.

EDR IDs provide an implicit trust mechanism allowing approved endpoints to obtain a Remote Sensor Token without embedding long-lived credentials on the host. EDR IDs can be revoked at any time to immediately block token issuance for endpoints using that ID.

You can generate multiple EDR IDs and assign them to specific deployments (for example, by environment, business unit, or endpoint group) rather than using a single EDR ID across all endpoints. This segmented approach is recommended to limit blast radius and simplify revocation and rotation when access needs to be restricted.

1. Log in to the AgileSec Platform UI, navigate to EDR Management, then click + Create EDR ID.

2. In the Create EDR ID dialog, select your organization and click Generate.

3. Copy the newly generated EDR ID by clicking the copy icon before the EDR ID.

Step 1: Download Remote Sensor Package from Keyfactor

Download the latest Remote Sensor package from AgileSec.

1. Open your browser and navigate to the Keyfactor AgileSec Platform Web URL

2. Log in with your credentials

3. Click on "Sensors" in the left navigation menu under Scan

   

4. Click Remote Scan.

   

5. Click + Download Remote Sensor.

   

6. Download the sensor binary for your remote machine’s operating system

   

7. Unzip the Remote Sensor package. The folder isg_agilescan_<platform>_sensor contains a crowdstrike directory with the scripts and configuration files required to create the CrowdStrike workflow.

Step 2: Upload Sensor Package to CrowdStrike

1. Log in to CrowdStrike and navigate to Host setup and management → Response scripts and files.

2. Select the "put" files tab and click Upload file. In the dialog, choose agilesec_sensor_windows_<version>.zip|pkg, then click Upload.

Step 3: Create Scripts

Create scripts to perform the following tasks:

1. Check Sensor Zip: Check whether the Sensor Zip Exists

2. Run the Sensor: Deploy the Sensor and execute scans

3. Un-deploy the Sensor: Remove the Sensor

Check Sensor Zip Script

1. On the Response scripts and files screen, select the Custom scripts tab, then click Create script.

2. In the Create script dialog, complete the following fields:

3. Click Create.

Run Sensor Script

1. On the Response scripts and files screen, select the Custom scripts tab, then click Create script.

2. In the Create script dialog, complete the following fields:

3. Click Create

Undeploy Sensor Script

1. On the Response scripts and files screen, select the Custom scripts tab, then click Create script.

2. In the Create script dialog, complete the following fields:

3. Click Create.

Step 4: Create and Execute the Run Sensor Workflow

1. Navigate to Fusion SOAR -> Workflows, then click Create workflow to open the CrowdStrike workflow builder interface. 

2. In the Create workflow dialog, select Create workflow from scratch.

3. In the Add trigger dialog, select Scheduled workflow and configure the execution schedule.

4. On the workflow builder, click Action.

5. In the Add action dialog, search for and select Device Query.

6. In the Device Query dialog, configure fields specific to your environment to select the devices where the SQL Server Database Sensor should run. At a minimum, the following fields are recommended:

• Device status: all

• Host group: as defined in your environment

7. On the workflow builder, add a Loop after Device Query.

8. In the Start Loop dialog, enter the following and click Next:

• Loop type: For each

• Loop source: Sensor IDs

• Processing order: At the same time/concurrently

• Continue workflow on loop iteration failure: Enabled

9. On the workflow builder, add an action inside the loop.

10. In the Add action dialog, search for and select Get device details.

11. In the Device details dialog, set Device ID to Sensor IDs instance, then click Next.

12. On the workflow builder, add a Condition after Get device details.

13. In the Condition dialog, enter the following and click Next:

• Parameter: Platform

• Operator: is equal to

• Value: Windows

14. On the workflow builder, add an action under the TRUE branch.

15. In the Add action dialog, search for and select the script kf-agilesec-check-sensor-zip-windows script.

16. In the action configuration for kf-agilesec-check-sensor-zip-windows, enter the following recommended values and click Next:

• Device ID: Sensor IDs instance

• sensorDirectory: C:\Program Files\Keyfactor

• sensorZipFilename: isg_sensor_windows_3.4.0_crowdstrike.zip

17. On the workflow builder, add a Condition after kf-agilesec-check-sensor-zip-windows.

18. In the Condition dialog, enter the following and click Next:

• Parameter: SensorZipExists

• Operator: is equal to

• Value: True

19. On the workflow build, add an action under the TRUE branch.

20. In the Add action dialog, search for and select the script kf-agilesec-run-mssql-sensor-windows.

21. In the action configuration for kf-agilesec-run-mssql-sensor-windows, enter the following recommended values for your environment:

22. On the workflow builder, add an action under the ELSE branch for sensorZipExists.

23. In the Add action dialog, search for and select Put file.

24. In the Put file dialog, enter the following values and click Next:

• Device Id: Sensor IDs instance

• File name: isg_sensor_windows_3.4.0_crowdstrike.zip

• Destination directory path: ${data['KfAgilesecCheckSensorZipWindows.sensorDirectory']}

• Queue offline: true

25. On the workflow builder, add action kf-agilesec-run-mssql-sensor-windows (same as 20) under the Put file.

26. Configure the action kf-agilesec-run-mssql-sensor-windows using information from Step 1.21.

27. The workflow is now complete and should resemble the following:

28. Click Publish, then in the Publish workflow dialog click Publish workflow. When you are ready to active the workflow, toggle Status to on.

Step 5: Execute Workflow to Run Host Scan Sensor

1. If your workflow trigger is on-demand, execute the workflow to test the sensor.

2. If your trigger is scheduled, wait for the configured interval for the sensor to run.

3. Check the scan output data

• A SQL server database scan is initiated on all machines included in “Device Query” action.

• Found findings are exported to the ingestion service.

• Users can view scan history and results within the Keyfactor web application.

Step 6: Workflow To Undeploy Sensor

You may need to un-deploy the sensor to upgrade to a newer version or remove the sensor from an endpoint. The un-deployment workflow cleanly removes the deployed sensor components and associated execution artifacts so the sensor can be reinstalled or upgraded as needed.

Follow the same instructions used to create the "Run host sensor" workflow, with the following changes:

1. In the Add trigger dialog, select On-demand instead of Scheduled.  

2. On the true branch of the sensorZipExists condition:

   1. Windows: add action kf-agilesec-undeploy-sensor-windows

3. In the action configuration, enter the following recommended values for your environment:

   1. Device Id: Sensor IDs instance

   2. Queue Offline: true

   3. sensorDirectory:

      • Windows: ${data['KfAgilesecCheckSensorZipWindows.sensorDirectory']}

   4. sensorZipPath:

      1. Windows: ${data['KfAgilesecCheckSensorZipWindows.sensorZipPath']}

The undeploy sensor workflow should resemble the following:

Step 7: Deploy New Sensor Package

When a new version of the sensor package is released, follow these steps to deploy the update:

1. Execute the "Un-deploy Sensor" workflow to remove the old version.

2. Execute the "Run Host Sensor" workflow to install the new version.