Retrieving the CrowdStrike Agent ID

Starting with AppGate ZTNA client 6.2.1, the device claim for the CrowdStrike Agent ID is built in for both Windows and macOS. No additional configuration is necessary from this AppGate ZTNA client version onward.

NOTE

On macOS devices, you must retrieve the Agent ID from a file controlled by CrowdStrike. This file is not produced by default. Raise a support ticket with CrowdStrike to enable the following feature flag: zta_distribute_payload. Enable this feature flag regardless of which macOS AppGate ZTNA client version you use.

Windows

AppGate ZTNA client earlier than version 6.1.0

1. Create the following batch file on your machine and name it crowdstrike_agent_id_win.bat:

@echo off
for /F "tokens=3" %%A in ('reg query HKLM\SYSTEM\CrowdStrike\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\{16e0423f-7058-48c9-a204-725362b67639}\Default /v "AG"') do (echo %%A)

2. In the AppGate ZTNA admin UI, go to Identity and then Device Claim Scripts.

3. Click + Add New and fill in the following fields:

   • Name: crowdtsrike_agent_id_win

   • File: Upload the file crowdstrike_agent_id_win.bat

4. Click Save.

5. Go to Identity and then Identity Providers.

6. Select the identity providers you use to authenticate your users. Scroll down to Configure On-demand Device Claims and click + Add.

7. Fill in the following fields:

8. Click Done, then click Save.

AppGate ZTNA client versions 6.1.0 through 6.2.0 (inclusive)

1. In the AppGate ZTNA admin UI, go to Identity and then Identity Providers.

2. Select the identity providers you use to authenticate your users. Scroll down to Configure On-demand Device Claims and click + Add.

3. Fill in the following fields:

4. Click Done, then click Save.

macOS

NOTE

On macOS devices, you must retrieve the Agent ID from a file controlled by CrowdStrike. This file is not produced by default. Raise a support ticket with CrowdStrike to enable the following feature flag: zta_distribute_payload. Enable this feature flag regardless of which macOS AppGate ZTNA client version you use.

AppGate ZTNA client earlier than version 6.2.1

NOTE

You can enable the feature flag before or after completing the following configuration. Once you enable the feature flag and complete the configuration, the built-in algorithm starts working automatically.

1. Create the following shell file on your machine and name it crowdstrike_agent_id_mac.sh:

#!/bin/sh 
payload=`awk -F'.' '{print $2;}' "/Library/Application Support/Crowdstrike/ZeroTrustAssessment/data.zta"`
#echo payload: $payload
len=${#payload}
if [ $((len%2)) -gt 0 ]; then
    pad=1
elif [ $((len%4)) -gt 0 ]; then
    pad=2
else
    pad=0
fi
for (( ii=1; ii<=$pad; ii++ )) ; do payload+="="; done
echo $payload | base64 -d | grep -Eo '"sub":"\w+' | awk -F'":"' '{print $2;}' 2>/dev/null

2. In the AppGate ZTNA admin UI, go to Identity and then Device Claim Scripts.

3. Click + Add and fill in the following fields:

   • Name: crowdstrike_agent_id

   • File: Upload the file crowdstrike_agent_id_mac.sh

4. Click Save.

5. Go to Identity and then Identity Providers.

6. Select the identity providers you use to authenticate your users. Scroll down to Configure On-demand Device Claims and click + Add.

7. Fill in the following fields:

8. Click Done, then click Save.