Associate Customer CrowdStrike Falcon Instance with Managed Defense

There are currently four CrowdStrike regions: US-1, US-2, EU-1, and US-GOV-1. The following table shows the Customer IDs (CIDs) for each of the regions for customer tenant association:

Use the Tenant CID / Parent CID  for the region where the customer's CrowdStrike instance is deployed. Be sure to include the correct Tenant CID / Parent CID in the CrowdStrike customer support ticket.

Falcon Complete Customers

As a Falcon Complete Customer, you do not use Falcon Flight Control and use an access method referred to as CID Switching in the CrowdStrike backend. In these situations, CrowdStrike Support must associate your CID with the Mandiant parent tenant and every individual user that needs to access the tenant.

Child Tenant Association Steps

1. Use the CrowdStrike Managed Service Provider Addendum Authorization Form to authorize Mandiant to access your CrowdStrike Falcon tenant.
2. Once you have completed the form, open a support ticket within the CrowdStrike Support Portal or by emailing support@crowdstrike.com. Mandiant can also open a support ticket on your behalf, but CrowdStrike Support will ask you to confirm with an approval via email (replying all to the support ticket).
   1. Subject: Associate <Customer Name> Tenant to Mandiant Parent.
   2. Description: Please allow Mandiant (CID: <Mandiant Tenant CID / Parent CID>) to have read-only access to <Customer Tenant>.
   3. Product: Provisioning
   4. Component: Add Access
   5. Add Attachment: Attach the completed consent form CrowdStrike Managed Service Provider Addendum Authorization Form.

After you have sent the request to CrowdStrike support, Mandiant must submit a request to CrowdStrike support to allow all users in the tenant to have read-only access to your tenant account.

Falcon Enterprise or Falcon Elite Customers

Your CrowdStrike Falcon tenant needs to be associated as a child tenant of the Mandiant CrowdStrike account so it is accessible through Falcon Flight Control. This step allows Mandiant to access your tenant account. This step is performed by CrowdStrike support with your authorization.

Child Tenant Association Steps

1. Use the CrowdStrike Managed Service Provider Addendum Authorization Form to authorize Mandiant to access your CrowdStrike Falcon tenant.
2. Once you have completed the form, open a support ticket within the CrowdStrike Support Portal or by emailing support@crowdstrike.com. Mandiant can also open a support ticket on your behalf, but CrowdStrike Support will ask you to confirm with an approval via email (replying all to the support ticket).

   New Case

   1. Subject: Associate <Customer Name> Tenant to Mandiant Parent.
   2. Description: Please associate the <Customer Tenant> to have a <primary | non-primary> parent of Mandiant (CID: <Mandiant Tenant CID / Parent CID>). Please disable the feature flag for MSSP Policy Management for this tenant, as Mandiant will not be managing policy from the parent. The Splunk model for this relationship should be to have all events in both the parent and the child.
      What is the difference between a primary and non-primary parent?

      • CrowdStrike tenants can be associated with one or more parent tenants. Only the primary parent tenant can be used to push policies to child tenants. If a child tenant only has one parent, then that parent is the primary parent.
      • Mandiant does not offer policy management to CrowdStrike customers, so Mandiant does not need our tenant to be a primary parent tenant unless it is the only parent. If you have another MSSP or third-party that manages their CrowdStrike tenant, Mandiant should be a non-primary parent tenant. This will allow the other parent to continue managing your tenant's policies.
   3. Product: Provisioning
   4. Component: Add Access
   5. Add Attachment: Attach the completed consent form CrowdStrike Managed Service Provider Addendum Authorization Form.docx.
3. CrowdStrike will provision your tenant as a child tenant to Mandiant.
4. Confirm that you can log into your tenant account using your CrowdStrike account credentials once CrowdStrike has confirmed it is accessible to Mandiant.