Endpoint Management On-Platform

CrowdStrike Falcon gives you real-time threat detection and endpoint security visibility and can be integrated with the Deel platform, surfacing insights to your Deel IT suite. Protect your organization from advanced threats, whether you want Deel's team to keep an eye on your instance or you prefer to maintain full control yourself.

In This Article

• What Is CrowdStrike On-Platform?
• How CrowdStrike Falcon Works
• Packages 
• Setup
• Usage and Tracking
• About CrowdStrike Falcon Sensor
• Renewal or Cancellation
• Frequently Asked Questions
• Troubleshooting and Escalation
• Resources

What is CrowdStrike On-Platform?

CrowdStrike Falcon is an AI-powered endpoint protection platform that monitors your organization's devices for threats, malware, and suspicious activity. Unlike traditional antivirus, which only catches known threats, it uses AI and behavioral analysis to detect and stop never-before-seen attacks in real time. It is cloud-based and lightweight.

It is integrated directly into Deel, so you can manage your endpoint security without switching between platforms. You can view endpoint protection alongside device management, app licensing, and identity access, all in one dashboard.

CrowdStrike Falcon includes:

• Real-time threat detection across all your devices
• Device and sensor management with policy enforcement
• Threat hunting and response (available only with the Enterprise plan)
• Detailed reporting on detections, tactics, and severity levels
• Cloud-protected uninstall to prevent tampering with security tools

How CrowdStrike Falcon Works

CrowdStrike Falcon uses a lightweight agent (Sensor) installed on each endpoint to monitor activity in real time. Each device runs the Sensor, which protects it and pushes real-time data to CrowdStrike. Deel pulls this data through the CrowdStrike API for display. When suspicious behavior is detected, the platform analyzes it using AI and expert rules, then escalates critical threats as alerts.

Key operational rules:

• One instance per organization: you can connect one CrowdStrike instance to each Deel organization.
• Managed vs. unmanaged: with managed plans, Deel handles configuration and updates. With unmanaged plans, you maintain full control.
• API-based connection: your CrowdStrike instance connects using a Client ID and Client Secret. No complex setup is required.
• Real-time sync: detection and device data updates automatically as your environment changes, typically every few minutes.
• No data storage: Deel retrieves data through the CrowdStrike API and stores nothing on its side.

Packages and Plans

Choose between managed and unmanaged plans. With managed plans, Deel's security team handles CrowdStrike for you. With unmanaged plans, you control everything while Deel provides the license and platform integration.

• Pro, managed: Deel manages your Pro instance, handling all configuration, policy updates, and ongoing optimization.
• Pro, unmanaged: You manage your Pro instance with full control. Deel provides the license and platform integration.
• Enterprise, managed: Deel manages your Enterprise instance plus 24/7 managed threat hunting with expert analysts.
• Enterprise, unmanaged: You manage your Enterprise instance. Deel provides the license and platform integration, including a dedicated Adversary OverWatch section.

Enterprise offers more functionality and a more robust security package, backed by AI intelligence and active escalation management. Speak to our team to learn more.

Feature comparison:

• Next-Gen Antivirus (NGAV): Falcon Pro and Falcon Enterprise both include it. It stops ransomware, malware, and fileless attacks.
• Endpoint Detection and Response (EDR): Falcon Enterprise only. It analyzes attack patterns, and enables forensic investigation and automated response.
• OverWatch (24/7 threat hunting): Falcon Enterprise only. CrowdStrike experts actively hunt threats on your devices around the clock.
• Best for: Falcon Pro suits teams that need simple yet solid, reliable endpoint protection. Falcon Enterprise suits organizations that require advanced threat investigation and expert-led hunting.

In plain terms, Falcon Pro defends against known threats, like a solid antivirus. Falcon Enterprise adds EDR, which investigates and responds to attacks and traces their origin, and OverWatch, where CrowdStrike experts monitor your devices around the clock.

Setup

Before you begin

Make sure you have:

• Write access to your Deel organization. Only users with write access can connect CrowdStrike.
• For unmanaged plans: an active CrowdStrike account with a valid subscription purchased through Deel. If you already have a CrowdStrike account, contact your Deel IT sales representative to learn about the steps to transfer it. A CrowdStrike license bought outside Deel must be transferred under Deel management before you can use the service.
• CrowdStrike API credentials (Client ID, Client Secret, and Base URL) with the required API scopes. See the CrowdStrike Integration Guide for how to create them.

Steps

1. In the Deel platform, go to IT > Endpoint Protection. You can also go to Apps and Automation > App Marketplace and search for CrowdStrike.
2. Click Connect.
3. Select the region of your CrowdStrike instance. Most instances are in EU1. If you are not sure, check the region in your CrowdStrike console or ask Deel IT Support. Selecting the wrong region returns an error, and the integration is not made.
4. Enter your CrowdStrike Client ID and Client Secret.
5. Click Connect.
6. Your CrowdStrike dashboard appears in Deel within moments, and the status shows Connected.

For detailed information on how to integrate Deel and CrowdStrike, follow the complete CrowdStrike Integration Guide.

Usage and Tracking

Overview Tab

The Overview tab shows the security status of your organization's devices at a glance. Let's walk through its sections. You reach it from IT > Endpoint Management, or the shortcut on the Deel IT homepage.

CrowdStrike Falcon Adversary OverWatch

This Falcon Enterprise feature provides 24/7 threat hunting by CrowdStrike's security team.

• Threats hunted: whether suspicious activity was detected during proactive threat hunts, and actions performed.
• Threats escalated: whether any threats required escalation to a Falcon alert, actively triggered by the CrowdStrike team.

If you're on Falcon Pro and want to learn more about upgrading, reach out to your Deel account team or use the Upgrade to Premium button. On Falcon Pro, this widget appears empty.

Security Metrics

• Detections: new security threats identified on your devices by the CrowdStrike Sensor installed on each machine.
• Prevented attacks: the percentage of detected threats that were blocked.
• Contained devices: devices isolated to prevent threats from spreading.
• Total devices: total active endpoints monitored by Falcon.
• Devices protected against uninstall (cloud-protected uninstall): the percentage of devices that could be uninstalled without protection. This blocks the device's user from self-uninstalling the Falcon Sensor. Aim for 0%.
• Sensor status: how many devices are currently online and reporting data through the installed Falcon Sensor.

Other Sections

• Platform distribution: operating system breakdown across your monitored devices (Windows, macOS, or Linux).
• Detections by Tactic: detected threats broken down by attack method, such as Machine Learning, Defense Evasion, Lateral Movement, Malware, Post-Exploit, and others.
• Version compliance: which Falcon sensor versions are running. Keep all devices on the latest optimized version. More information on the Falcon sensor is in section 6.
• Severity breakdown: once threats appear, shows them by severity level (critical, high, medium, low, and informational).
• Recent detections: a grid of the latest threats, sortable by device, severity, time, and status. Columns are Severity, Device name, Detect time, Suspicious process, Tactic via technique, Triggering file, Source product, Resolution, and Status.

Taking Action on Detections and Devices

You can take action on detections and devices directly in Deel, without opening the CrowdStrike console. Actions are available in the Recent detections grid and inside a detection's details window. Each row has an Investigate button and a three-dot menu with the options below. Destructive actions require confirmation.

• Contain device: isolates the device from the network. Once a device is contained, the option reads "Lift containment". Confirming updates the row's Containment status and shows a success message. Every action is written to the audit log (see the Event Log section below).
• Change status: set a detection's status (New, In Progress, or Closed) and its resolution (True Positive, False Positive, or Ignored). Updates apply immediately through the CrowdStrike API, with no separate save step. A closed detection can be reopened here.
• Investigate: runs an AI investigation assistant, powered by Deel’s AKAI, against the full CrowdStrike detection data. It returns a verdict (True Positive, False Positive, or Suspicious), a confidence level (Low, Medium, or High), a plain-English summary, and recommendations. A non-dismissible disclaimer flags the result as a suggestion, not a definitive assessment. You can rate it thumbs up or down.

Investigate is available on both managed and unmanaged plans. For unmanaged clients, a Managed EPP upsell prompt appears below the result. For managed clients, the Deel IT team is notified of threats and reaches out with next steps, and Investigate is an additional tool alongside that process.

If an action fails, nothing changes. An error message appears, the previous state is preserved, and it's safe to retry.

Device Management Tab

The Device Management tab lists all managed devices with these details:

• Device ID
• Device name
• Sensor version
• Last seen date
• Platform (OS)
• OS version
• Device groups
• Local IP
• MAC address

Use the filters to narrow results by sensor version, last seen date, platform, or OS version. You can export the device list as CSV for sharing with your IT team, compliance audits, or asset management. Selecting a device name opens its full detail in the CrowdStrike console. Mobile devices are not shown in this tab. Device-level actions (contain and lift containment) are also available here for eligible organizations. For questions about device management, contact your Deel support team.

Event Log Tab

The Event log tab gives you a full audit trail of containment, lift-containment, and status-change actions triggered through Deel. It shows three summary cards (Info, Success, and Error) with counts for the loaded and filtered range, and a table with Timestamp, Status, Operation ID, Description, Actor, and Actions.

• Search matches Operation ID only.
• Status Type: filter by Info, Success, or Error.
• Date range: filter by Timestamp.

Filters combine, and you can expand the table to full screen. Select Details on a row to open a panel with the event history (status and timestamp), the full description, the Operation ID, and the Actor (the user or system that triggered the action). Closing the panel keeps any filters you applied.

Settings Tab

This tab is for admins. It contains:

• Your Customer ID (CCID): pulled automatically from the CrowdStrike API. If it fails to load, your API credentials are missing the Sensor Download scope. You can also find it in the CrowdStrike console under Host setup and management > Sensor downloads.
• Installers: direct Download buttons for the macOS and Windows sensors. Linux has no direct download; the tab links you to CrowdStrike instead.
• Security point of contact: the person Deel contacts after reviewing a threat or containment event. Threat alerts go to that person's work email, falling back to their Deel account email if there is no work email on file. You can set up to three points of contact. The main point of contact must have a Deel account. If none is set, the Org Admin is the default. Points of contact 2 and 3 are optional, and a group email can be used in either slot to alert several people at once.
• Policy links: shortcuts to your CrowdStrike console for Prevention, Sensor update, Firewall, and Device policies. These policies are managed in CrowdStrike, not in Deel.
• MDM links: guidance for deploying the sensor through your MDM system. These link to CrowdStrike user guides.

About CrowdStrike Falcon Sensor

The Falcon sensor is a lightweight program installed on your devices that monitors security events and reports them to CrowdStrike. It provides real-time threat detection, prevention, and detailed endpoint visibility.

You can download the sensor installer from the Installers section of the Settings tab (macOS and Windows), or from the three-dot menu in the Device Management tab. For Linux, use the link to the CrowdStrike console.

Sensors are regularly updated with the latest security patches and threat intelligence. Each version has a release number (for example, 7.35.20704.0). The optimized version is the latest and recommended version for all devices.

The Version compliance section tracks which sensor versions are running across your devices. We recommend keeping all devices on the latest version to ensure maximum security protection.

Renewal or Cancellation

Contract Renewals

Your CrowdStrike subscription auto-renews according to your contract terms. The feature activates on the start date of your contract and disables automatically when your Endpoint Protection contract ends. Only one contract per SKU can be active at a time.

Disconnecting or Canceling

To disconnect CrowdStrike from Deel:

1. Go to IT > Endpoint Protection.
2. Click the settings menu and select Disconnect.
3. You keep all data in your CrowdStrike account. Disconnecting only removes the Deel integration.
4. To fully cancel your CrowdStrike subscription, contact your account manager or Deel support.

Frequently Asked Questions

Troubleshooting and Escalation

Credentials are not valid upon integration

Check whether they have expired. If so, go to Apps > CrowdStrike, disconnect, regenerate the API credentials in the CrowdStrike console, and reconnect.

The client is integrated, but Endpoint Protection isn't showing

Check that your Endpoint Protection contract is active and that your CrowdStrike license was transferred under Deel management. Only Falcon Pro and Enterprise are supported.

The contract is active and the CrowdStrike instance is up, but the integration errors after I enter credentials or region

This is likely a permissions issue. Check that the user has Edit permissions in Deel.

All Endpoint Protection widgets are blank or showing errors

Check CrowdStrike's status page for an outage. If CrowdStrike is operating normally, check that the integration is enabled and that your credentials have not expired.

Action buttons return a permissions error

Check that your API credentials include Alerts:write and Hosts:write. If they don't, regenerate them with those scopes and reconnect (see the CrowdStrike Integration Guide).

When to escalate: the feature is down, no data appears in the widgets, information displayed is wrong, or you still can't access CrowdStrike after working through the FAQs.

How to escalate: contact your account manager or Deel support.

Resources

Below are some self-serve resources to help you get started:

• Deploying CrowdStrike Falcon sensor only
• Install the CrowdStrike Falcon Agent via JumpCloud

If you run into any issues during this process, contact the Deel team or the CrowdStrike support