- About this guide
- Getting started
- Installing
- Upgrading
- Connecting and licensing
- Configuring
- Running workloads
- RPA processes and tests
- Agents, functions, and API workflows
- Limits
- Securing and governing
- Settings for Robot policies
- Tracing and data controls
- CrowdStrike integration
- Monitoring
- Troubleshooting
- Reference
CrowdStrike integration
Integration of UiPath Robot with CrowdStrike Falcon extends endpoint security coverage and maintains business continuity for robot workforces.
The integration of UiPath Robot with the CrowdStrike Falcon endpoint protection platform has the following advantages:
- Extended security posture for your organization.
- Business continuity for your robot workforce.
- Improved visibility for your security team, which can monitor and analyze the actions of the robots more easily.
- Seamless technical integration - This minimizes potential technical issues.
Demo
The following demo shows how the integration provides an easy way to detect and selectively block any suspicious or malicious activity caused by the automation execution:
Prerequisites for activation
- Robot and Studio minimum version: 2024.10.9
- Latest supported version of CrowdStrike Falcon sensor
- (Optional) 2024.10 Orchestrator or Automation Cloud Orchestrator
1
The integration is automatically activated when both UiPath Robot and CrowdStrike Falcon sensor are installed on the machine. It is available on Windows only and applies to RPA (executor) jobs. The Robot activates it when it finds the RpaCsInteg.dll file in its application folder and the CSFalconService service on the machine.
1 When the robot is connected to an Orchestrator older than 2021.10, the TenantName, TenantKey, and TenantId fields are not sent to the CrowdStrike cloud console.
Integration architecture
Data related to automation execution contains annotation metadata which is sent to the CrowdStrike Falcon sensor. From there, it is sent to the CrowdStrike management console where it can be reviewed by the security team. The integration is based on the following components, which are split between UiPath and CrowdStrike:
Metadata
The Robot sends the following metadata to CrowdStrike Falcon:
- Orchestrator URL - The URL that the robot uses for the Orchestrator connection (e.g. https://cloud.uipath.com).
- Tenant Name - The tenant in the Orchestrator instance used by the robot.
- Tenant Key - The key of the tenant.
- Tenant ID - The identifier of the tenant.
- Folder Name - The folder in Orchestrator where the process is found.
- Folder ID - The identifier of that folder.
- Robot Name - The name of the robot that runs the automation.
- Package Name - The name of the package used by the robot to run the automation.
- Package Version - The version of that package.
- Process Name - The name of the process run by the robot.
- Process Key (ID) - The process key (identifier).
- Machine Name - The machine name on which the automation is running on.
- Windows User - The Windows user under which the automation is running.
- Job ID - The job id in Orchestrator for the running job.
This metadata provides CrowdStrike Falcon with necessary context and hints about how and where the automations run, aiding in assessing and analyzing security measures.
Integration status
The integration status of your CrowdStrike Robot protection could be one of the following:
- Enabled - CrowdStrike protection is enabled; for machine templates, EDR protection is enabled on all host machines associated to that template.
- N/A - CrowdStrike protection is not enabled or the status is not known.
- Mixed (this status is only displayed for machine templates, and only on the Machines page) - CrowdStrike protection is enabled on some host machines connected to the template, and disabled on others, or the status is not available.
To see the integration status, access the following places:
- Orchestrator, on the Tenant > Machines > Installed Versions & Logs page, check the EDR Protection column. It displays the status of your CrowdStrike Robot protection per machine or machine template over the last 30 days.
- Assistant, point to the tray icon.
CrowdStrike documentation
Depending on the CrowdStrike account you are using, you can access one of the four documentation URLs: