# IoT Assets

Collects detailed information on IoT devices managed by CrowdStrike, including security status and activity logs. This integration supports monitoring and securing IoT environments.

## Details
Monad uses the `cron` field to run this input on specific intervals and returns all IoT assets' details, performing a full sync of data each time.

## Requirements
- Before you connect Monad to CrowdStrike, you need a Client ID and Client Secret. Log in to [falcon.crowdstrike.com](https://falcon.crowdstrike.com/login/) and under Support & Resources, click on 'API Client and Keys' to create your credentials.
- Enter a Client Name, Description and API Scopes to define the API client. Ensure read roles for User Management are enabled.
- Click **Done**.
- Copy the ClientID and ClientSecret key. You'll need them when you set up the Monad connector.
[setup documentation](https://docs.servicenow.com/bundle/washingtondc-security-management/page/product/secops-integration-sir/secops-integration-crowdstrike-falcon-insight/task/create-api-clients-and-keys.html)
## Related Articles
- [https://developer.crowdstrike.com/crowdstrike/reference/get-hosts-1](https://developer.crowdstrike.com/crowdstrike/reference/get-hosts-1)
- [https://developer.crowdstrike.com/crowdstrike/reference/query-iot-hosts-1](https://developer.crowdstrike.com/crowdstrike/reference/query-iot-hosts-1)

## Configurationcrowdstrike-iot-details
The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

#### Settings

| Setting | Type | Required | Description |
|---------|------|----------|-------------|
| Cron | string | Yes | Cron string for scheduling tasks. Ex: '0 0 * * *' for daily execution at midnight. |
| Cloud Type | string | No | Your cloud type for CrowdStrike. Ex: 'autodiscover', 'us-1', 'us-2', 'eu-1', 'us-gov-1'. |

#### Secrets

| Secret | Type | Required | Description |
|---------|------|----------|-------------|
| Client ID | string | Yes | Client ID for the CrowdStrike API. This is required to authenticate requests. |
| Client Secret | string | Yes | Client Secret for the CrowdStrike API. This is required to authenticate requests. |

## Custom Schema Handling

If the source data doesn't align with any of the [OpenSecurityControlFramework (OSCF) schemas](https://schema.ocsf.io/), you can create a custom transformation using our JQ transform pipeline. For example:

```jq
{
  metadata: {
    schema_version: "1.0.0",
    custom_framework: "my_framework"
  },
  controls: .[]
}
```

For more information on JQ and how to write your own JQ transformations see the JQ docs [here](https://jqlang.github.io/jq/)

If you believe this data source should be included in the standard OSCF schema set, please reach out to our team at [support@monad.com](mailto:support@monad.com). We're always looking to expand our coverage of security control frameworks based on community needs.

## Sample Record

```json
{
  "agent_version": "2.0.1",
  "aid": "f5f4cc34-5bf8-b872-9c02-2fe0f8a0109d",
  "available_disk_space": 3468,
  "average_memory_usage": 2581,
  "average_processor_usage": 14,
  "bios_id": "cc93a598-69bc-94d3-a874-721deda14f68",
  "bios_manufacturer": "ACME Inc.",
  "bios_version": "1.0",
  "business_criticality": "High",
  "cid": "customer789",
  "city": "Chicago",
  "claroty_id": "XYZ789",
  "computed_internet_exposure": "Yes",
  "computed_internet_exposure_external_ip": "159.190.34.148",
  "computed_internet_exposure_last_seen": "2025-08-11T23:46:29.604883Z",
  "confidence": 79,
  "country": "USA",
  "cpu_processor_name": "Intel Core i7-8700K",
  "credential_guard_status": true,
  "current_local_ip": "172.51.55.51",
  "data_providers": [
    "Provider A",
    "Provider B"
  ],
  "data_providers_count": 2,
  "device_class": "Industrial IoT",
  "device_family": "Sensor",
  "device_guard_status": true,
  "device_type": "Sensor",
  "discoverer_count": 2,
  "discoverer_ics_collector_ids": [
    "collector123",
    "collector456"
  ],
  "discoverer_product_type_descs": [
    "Type A",
    "Type B"
  ],
  "disk_sizes": [],
  "dragos_id": "DRAGOS123",
  "encrypted_drives": [
    "Drive A",
    "Drive B"
  ],
  "encrypted_drives_count": 2,
  "encryption_status": "Enabled",
  "entity_type": "Managed",
  "external_ip": "160.240.146.197",
  "field_metadata": {
    "agent_version": {
      "description": "Version of the Falcon sensor"
    },
    "aid": {
      "description": "Agent ID of the Falcon sensor"
    }
  },
  "first_seen_timestamp": "2025-08-11T23:46:29.604969Z",
  "groups": [
    "Group A",
    "Group B"
  ],
  "hostname": "iot-host-1",
  "ics_id": "ICS123",
  "id": "c81aba6b-de00-0ca0-f84b-988eeb71184d",
  "internet_exposure": "Yes",
  "iommu_protection_status": "Enabled",
  "kernel_dma_protection_status": true,
  "kernel_version": "4.19.0-16-amd64",
  "last_discoverer_ics_collector_id": "collector456",
  "last_seen_timestamp": "2025-08-11T23:46:29.604984Z",
  "local_ip_addresses": [
    "172.147.160.136",
    "fe80::1"
  ],
  "local_ips_count": 2,
  "logical_core_count": 8,
  "mac_addresses": [
    "8e:d9:ec:d2:c9:17"
  ],
  "machine_domain": "example.com",
  "max_memory_usage": 4096,
  "max_processor_usage": 60,
  "memory_total": 8192,
  "mount_storage_info": [],
  "network_id": "network123",
  "network_interfaces": [],
  "number_of_disk_drives": 1,
  "os_is_eol": "No",
  "os_version": "Ubuntu 20.04",
  "ot_information_sources": [
    "Source A",
    "Source B"
  ],
  "ot_serial_numbers": [
    "Serial A",
    "Serial B"
  ],
  "ou": "Engineering",
  "physical_core_count": 4,
  "platform_name": "Windows",
  "processor_package_count": 1,
  "product_type": "3",
  "product_type_desc": "Server",
  "protocols": [
    "HTTP",
    "HTTPS"
  ],
  "purdue_level": "Level 2",
  "reduced_functionality_mode": "No",
  "secure_boot_enabled_status": true,
  "secure_boot_requested_status": true,
  "secure_memory_overwrite_requested_status": "Enabled",
  "site_name": "Site A",
  "subnet": "192.168.1.0/24",
  "system_guard_status": "Enabled",
  "system_manufacturer": "ACME Inc.",
  "system_product_name": "IoT Sensor X",
  "system_serial_number": "SN123456",
  "tags": [
    "Tag A",
    "Tag B"
  ],
  "total_bios_files": 2,
  "total_disk_space": 2048,
  "uefi_memory_protection_status": "Enabled",
  "unencrypted_drives": [
    "Drive C"
  ],
  "unencrypted_drives_count": 1,
  "used_disk_space": 1024,
  "virtual_zone": "Zone A",
  "virtualization_based_security_status": true,
  "vlan": [
    "VLAN123"
  ],
  "xdome_id": "XDOME456"
}
```