Scribd
Upload
117 views19 pages

CrowdStrike IP Data Sheet

The document provides a comprehensive list of Fully Qualified Domain Names (FQDNs) and IP addresses used by the Falcon sensor to communicate with the CrowdStrike cloud across different US regions. It emphasizes the need for organizations to add these addresses to their allowlists to ensure proper functionality. The document is organized by service types including term servers, LFO downloads, uploads, and APIs, detailing specific IPs for each service.

Uploaded by

ScribdTranslations
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
117 views19 pages

CrowdStrike IP Data Sheet

The document provides a comprehensive list of Fully Qualified Domain Names (FQDNs) and IP addresses used by the Falcon sensor to communicate with the CrowdStrike cloud across different US regions. It emphasizes the need for organizations to add these addresses to their allowlists to ensure proper functionality. The document is organized by service types including term servers, LFO downloads, uploads, and APIs, detailing specific IPs for each service.

Uploaded by

ScribdTranslations
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Cloud IPAddresses

Last updated: Nov. 1, 2023

Overview
The Falcon sensor on your hosts uses these FQDNs to communicate with the CrowdStrike cloud over the standard port (443) for everyday operation. Add these
FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

US-1IPs

Term servers
The Falcon sensor on your hosts uses these FQDNs to communicate with the CrowdStrike cloud over the standard port (443) for everyday operation. Add these
FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name:[Link]

IPs:

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]
[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]
[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]
[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

LFO download
The Falcon sensor on your hosts uses these FQDNs to retrieve dynamic content, including updates to policy and configuration settings, from the CrowdStrike
cloud. Add these FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name:[Link]

IPs:

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]
[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

No translatable text provided.

[Link]

[Link]

LFO upload
Public DNS Name:[Link]

IPs:

[Link]

[Link]

[Link]

[Link]

Falcon console
Public DNS Names:

[Link]

[Link]

[Link]

OAuth2-based API IPs


Public DNS Name:[Link]

IPs:

[Link]

[Link]

Event Streams API


Public DNS Name:[Link]

IPs:

[Link]
[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

US-2IPs

Term servers
The Falcon sensor on your hosts uses these FQDNs to communicate with the CrowdStrike cloud over the standard port (443) for everyday operation. Add these
FQDNs IP

Public DNS Name:[Link]

IPs:

[Link]

[Link]

[Link]

[Link]
[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

LFO download
The Falcon sensor on your hosts uses these FQDNs to retrieve dynamic content, including updates to policy and configuration settings, from the CrowdStrike
cloud. Add these FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name:[Link]

IPs:

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

LFO upload
Public DNS Name:[Link]

IPs

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

Falcon console
Public DNS Names:

[Link]

[Link]

[Link]
IPs:

[Link]

[Link]

[Link]

OAuth2-based API IPs

OAuth2-based APIs public DNS


For the US-2 cloud environment, IP addresses are assigned dynamically and are subject to change. If needed, allowlist this public DNS name:
[Link]

Event Streams API


Public DNS name:[Link]

IPs:

[Link]

[Link]

[Link]

US-GOV-1IPs

Term server
The Falcon sensor on your hosts uses these FQDNs to communicate with the CrowdStrike cloud over the standard port (443) for everyday operation. Add these
FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name:[Link]

Elastic Load Balancer DNS Name:[Link]

IPs:

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]
[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]
[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]
[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

LFO download
The Falcon sensor on your hosts uses these FQDNs to retrieve dynamic content, including updates to policy and configuration settings, from the CrowdStrike
cloud. Add these FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name:[Link]


Elastic Load Balancer DNS Name:[Link]
IPs:

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]
[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

Falcon console
Public DNS Name:[Link]

Elastic Load Balancer DNS Name:[Link]

IPs:

[Link]

[Link]

[Link]

[Link]
[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

OAuth2-based API IPs

OAuth2-based APIs public DNS


For the US-GOV-1 cloud environment, IP addresses are assigned dynamically and are subject to change. If needed, allowlist this public DNS name:
[Link]

Event Streams API


Public DNS Name:The provided text is a URL and cannot be translated.

Elastic Load Balancer DNS Name:[Link]

IPs:

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]
[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

US-GOV-2IPs

Term Servers
The Falcon sensor on your hosts uses these FQDNs to communicate with the CrowdStrike cloud over the standard port (443) for everyday operation. Add these
FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name:[Link]

IPs:

[Link]

[Link]

[Link]

LFO download
The Falcon sensor on your hosts uses these FQDNs to retrieve dynamic content, including updates to policy and configuration settings, from the CrowdStrike
cloud. Add these FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name:[Link]

IPs:

[Link]

[Link]

[Link]

Falcon console
Public DNS Name:[Link]

IPs:

[Link]

[Link]

[Link]
OAuth2-based API IPs

OAuth2-based APIs public DNS


For the US-GOV-2 cloud environment, IP addresses are assigned dynamically and are subject to change. If needed, allowlist this public DNS name:
[Link]

Event Streams API


Public DNS Name:[Link]

IPs:

[Link]

[Link]

[Link]

EU-1IPs

Term servers
The Falcon sensor on your hosts uses these FQDNs to communicate with the CrowdStrike cloud over the standard port (443) for everyday operation. Add these
FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name:[Link]

IPs:

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

LFO download
The Falcon sensor on your hosts uses these FQDNs to retrieve dynamic content, including updates to policy and configuration settings, from the CrowdStrike
cloud. Add these FQDNs or IP addresses to your allowlists if your organization blocks these network communications.

Public DNS Name:[Link]

IPs:

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

LFO upload
Public DNS Name:[Link]

IPs:

[Link]

[Link]

[Link]

Falcon console
Public DNS Names:

[Link]

[Link]

[Link]

IPs:

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

OAuth2-based API IPs

OAuth2-based APIs public DNS


For the EU-1 cloud environment, IP addresses are assigned dynamically and are subject to change. If needed, allowlist this public DNS name:
[Link]

Event Streams API


Public DNS Name:[Link]

IPs:

[Link]

[Link]

[Link]

FalconForensics
Falcon Forensics [/documentation/page/b9f34543/falcon-forensics-for-windows]requires internet access between hosts in your environment and appointed
CrowdStrike upload servers. Each server corresponds to your target cloud environment (for example US-1, US-2, or EU-1).
Domains:

[Link] (Windows)

[Link]

[Link]

[Link] (macOS, Linux)


[Link]

[Link]

[Link] (Windows)

[Link]

[Link]

[Link]

ff[Link] (macOS, Linux)

[Link]

[Link]

[Link]

[Link] (Windows)

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link] (macOS, Linux)

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link] (Windows)

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link] (macOS, Linux)

[Link]

[Link]

[Link]

[Link]

[Link]

[Link]

[Link] (Windows)
[Link]

[Link]

[Link]

[Link] (macOS, Linux)

[Link]

[Link]

[Link]

Image assessment IPaddresses


To scan images from an on-premises registry, such as Artifactory, or a registry in a private cloud, you must add these IP addresses to the allowlist:

CrowdStrike cloud US-1 US-2 EU-1 US-GOV-1

[Link] [Link] [Link]


[Link]
IP addresses [Link] [Link] [Link]
[Link]
[Link] [Link] [Link]

Sensor Update Policies [/documentation/page/d2d629cf/sensor-update-policies]

You might also like