HYPR and CrowdStrike Zero Trust Assessment (ZTA) Policy Configuration

Policy Management Overview

Overview

This guide covers integrating CrowdStrike Falcon's Zero Trust Assessment (ZTA) posture into the HYPR Adapt access decision process. HYPR Adapt evaluates ZTA events against your risk policy to determine whether a user is granted access, required to use phishing-resistant authentication, undergo identity verification, or denied access.

In this guide, you will learn how to create a standard policy for CrowdStrike, specifically for the Zero Trust Assessment Score. Multiple policies can be defined for different use cases or scenarios.

Manage HYPR Adapt risk policies using standard administrative operations via the HYPR Control Center.

On this page

• CrowdStrike webhook setup
• Policy setup in HYPR Control Center

CrowdStrike webhook setup

Complete the CrowdStrike Falcon setup before configuring the policy in Control Center.

HYPR prerequisites

• Your HYPR deployment must expose the CrowdStrike inbound webhook endpoint used by Control Center.
• Confirm with your HYPR representative that the feature flag ENABLE_ADAPT_CROWDSTRIKE_INTEGRATION is enabled for your tenant.
• Confirm with your HYPR representative that Control Center is configured for CrowdStrike webhook signature verification and that you have the required webhook signing secret.

Create a CrowdStrike API client (for ZTA reads)

In CrowdStrike Falcon, create an OAuth2 API client and enable Read scope for:

• Hosts
• Zero Trust Assessment

You’ll use the client ID/secret and tenant information when configuring the HYPR Adapt policy.

Configure the CrowdStrike webhook client

In CrowdStrike Falcon, configure a webhook client that targets Control Center.

1. Go to CrowdStrike Store → All Apps.

   

2. Open the Webhook application.

   

3. Select Configure → Add Configuration and set:

   • Webhook URL:

     {baseURLForCC}/rp/integrations/adapt/webhookclient/crowdstrike/eventshook

   • Signature header name:

     x-cs-primary-signature

   • Secret: set this to the webhook signing secret provided by HYPR for your tenant

   

4. Save the configuration. Keep the Webhook name handy—you’ll select it in the workflow step.

Create the ZTA workflow (Fusion SOAR)

1. Go to Fusion SOAR → Workflows.

   

2. Select Create Workflow (top right).

3. In the popup, select Create workflow from scratch.

   

4. Select Event as the workflow trigger.

5. Configure the event trigger for ZTA changes (for example: Zero Trust Assessment → Host assessment change → Overall assessment), then select Next.

   

6. Hover over the trigger object and click the arrow, then choose Action as the next step.

   

7. Search webhook and choose Call webhook.

   

8. Configure the webhook call:

   • Select the Webhook name you created earlier.
   • Leave the default format as JSON.
   • Include data elements required for evaluation. At minimum, include:
     • The endpoint identifier (CrowdStrike Agent ID / AID)
     • The ZTA overall assessment / score
     • An event timestamp
   

9. Select Next, then select Finish.

10. In the final confirmation window, ensure Workflow status is set to ON so events are sent immediately.

Watch the 3-minute Video

Take a few minutes to watch HYPR Adapt Crowdstrike policy configuration.

Policy setup in HYPR Control Center

To get started, first you must create a policy.

1. At the top rightof the Policy Management Overview, select Add New Policy.

   

2. Complete the Add New Risk Policy dialog fields as follows:

   Field	Value
   Policy Type	Custom Policy
   Policy Templates	Workstation Unlock
   Policy Name	(Provide a name.)
   Policy Description	(Provide a description.)

3. Click Create when you have finished.

   

Your policy now appears in the Risk Policies list.

Form Configuration

As part of creating a policy, you must define the variables that will be used for the policy. For CrowdStrike, we must create an AgentID field, URL field, Client field, Secret field, and Customer ID field. For testing purposes, you can include a field to hold a CrowdStrike Agent ID (AID). Keep in mind, the form names, such as crowdstrikeURL, will be used as variables in the policy.

Once the form is populated, click Save.

Configuration

With the form configured, you can now define the values that will be used as part of the policy.

1. Event Search Window is blank.

2. For HYPRs User-Agent for CrowdStrike API calls, the only acceptable value is HYPR_Strike_1.0.

3. Enter the CrowdStrike Tenant URL.

4. Provide your OAuth2 CrowdStrike API Client and CrowdStrike API Secret.

5. Add your CrowdStrike Customer ID.

6. When you are satisfied with the values in these fields, click Save Configuration.

   

7. Ensure your CrowdStrike API client has the required ZTA read permissions. For the CrowdStrike-side setup steps, see CrowdStrike Falcon setup (prerequisite).

Policy Code

Within the Policy Code tab, you will be able to modify and test the policy to your desired outcome.

To test a policy:

1. Request the policy from HYPR to get started.

2. Provide a user at the top right.

3. Add a date range to receive data for the user to test. You will see the data populate the area labeled Input.

4. Click Evaluate. The results will be displayed at the bottom right, labeled Evaluation Result.

   

5. Once the policy meets your requirements, click Save.