Use CrowdStrike ZTA scores to restrict device access

CrowdStrike Falcon Zero Trust Assessment calculates a numeric trust score (from 0 to 100) for each device that runs a Falcon agent. Using that score as part of access rules in Tailscale can allow organizations to grant access to sensitive resources only to devices that have a high enough level of trust.

This can be achieved using Tailscale's device posture features:

• CrowdStrike Falcon posture integration, which synchronizes Zero Trust Assessment scores from CrowdStrike to device posture attributes in Tailscale.
• Device Identity Collection, which collects identifiers such as serial numbers and MAC addresses, used to match devices in Tailscale to devices in CrowdStrike.
• Posture conditions in access rules, which allows configuring access restrictions based on device attributes.

This document provides instructions on how to:

• Enable Device Identity collection for your tailnet.
• Configure CrowdStrike Falcon posture integration.

What is CrowdStrike Falcon posture integration?

CrowdStrike Falcon posture integration lets you connect your Tailscale network to CrowdStrike Falcon. It runs regularly and copies Falcon Zero Trust Assessment scores to device posture attributes.

When configured, it will regularly:

• Fetch a list of hosts recorded in your Falcon account, and their ZTA scores.
• Match Falcon hosts with corresponding devices in your tailnet, based on the serial numbers associated with a device.
• Write the data from each device into the following Tailscale device posture attribute:

Prerequisites

• Device Identity Collection is enabled, and devices in your tailnet are reporting identifiers
• CrowdStrike Falcon API credentials

Create CrowdStrike Falcon API credentials

Generate a CrowdStrike Falcon API client that will be used to fetch a list of hosts from Falcon along with their ZTA scores.

1. In Falcon, open Support and resources and then API clients and keys.

2. Select Create API client.

3. Add a name. For the Hosts scope add Read, and for the Zero Trust scope add Read.

   

4. Select Create, then make sure to copy the displayed Client ID and Client Secret. These will be only displayed once.

Also make a note of the Base URL (for example, https://api.us-2.crowdstrike.com).

Configure CrowdStrike Falcon posture integration

Configure Tailscale to fetch the ZTA scores from CrowdStrike Falcon.

1. Open the Device management page of the Tailscale admin console.

2. Under the Device Posture section, select Connect next to the CrowdStrike Falcon integration.

3. Select your CrowdStrike Cloud Region (the Base URL from the API client).

4. Enter your Client ID and Client Secret.

   

5. Select the Connect to CrowdStrike Falcon button.

View the integration status

Check that the integration has run successfully.

In the Device Posture section of the Device management page, configured integrations and their status will show under Integrations. The time of the most recent sync will display here. If an error occurs while synchronizing, it will display here.

Check node attributes

After you configure CrowdStrike Falcon posture integration, you can confirm that the Zero Trust Assessment score attribute is being written for your Tailscale nodes via the Machines page of the admin console.

1. Open the Machines page of the Tailscale admin console.
2. Select a machine you want to inspect.
3. The attributes for the machine are in the Machine Details section. This should include the falcon:ztaScore attribute.

You can also check node attributes via the API.

Adjust Tailscale access rules

Once CrowdStrike Falcon posture integration is configured and your devices have a device posture attribute that reflects their Falcon trust score, you can use that device posture attribute as part of your posture rules.

For example, to only allow access to tag:production from devices that have a CrowdStrike ZTA score of 70 or higher, you can create a new posture and use it as part of a corresponding access rule:

"postures": {
  "posture:trusted": ["falcon:ztaScore >= 70"],
},
"acls": [
  {
    "action":     "accept",
    "src":        ["autogroup:member"],
    "srcPosture": ["posture:trusted"],
    "dst":        ["tag:production:*"],
  },
]

Schedule

For each configured integration, Tailscale will aim to sync device posture attributes every 15 minutes, with a few exceptions:

• Adding a new integration, or changing configuration of an existing one, will trigger an out-of-schedule sync.
• If an integration fails due to authentication error (usually caused by invalid credentials), it will be paused for up to 24 hours.

Audit log events

The following audit log events are added for device posture.