Add a CrowdStrike endpoint security rule pack

[kyorkJ1]

Why

CrowdStrike has no rule pack. The three endpoint packs that exist cover Sophos, Trellix and Armis — across the 53 active JupiterOne customers measured on 2026-08-25 that is 2 customers, 0, and 0. CrowdStrike is deployed at 23, making it the most widely deployed endpoint tool in the book.

AX-1 (agent coverage, health, hygiene and policy management) is gate-met at 36 of 46 measured accounts and had no CrowdStrike content behind it.

What

13 rules modelled on sophos-endpoint-security.json, using only entity types and relationship verbs documented in graph-crowdstrike/docs/jupiterone.md.

They are ordered so each one catches something the previous one counts as healthy:

Rule	Catches
devices-without-sensor	no coverage at all
sensors-without-prevention-policy	installed, enforcing nothing
sensors-on-inactive-prevention-policy	assigned, switched off
prevention-policies-without-settings	assigned, asserting nothing
sensors-not-reporting	reporting stopped, still counted as protected
hosts-hidden-from-visibility	in inventory, excluded from activity

crowdstrike-open-critical-vulnerability-on-unpoliced-sensor is the one rule with no single-vendor equivalent anywhere in this repo: an open, publicly exploitable vulnerability on a host whose sensor has no prevention policy. That compound condition is what AX-2 asks for — a critical CVE combined with a missing or incorrect agent policy — and neither half fires on its own today.

Verification

Properties were taken from queries already shipping in this repo and in the managed-question library rather than from vendor API docs: status, public, exploitability, score on crowdstrike_vulnerability; active on crowdstrike_prevention_policy; hostHiddenStatus on crowdstrike_sensor; and the normalised lastSeenOn.

Checked mechanically that no rule references an undocumented entity type, an undocumented relationship verb, or a property absent from shipped content. alertLevel values and query names conform to scripts/validate.ts.

⚠️ Not parser-validated

I could not run npm run validate locally — @jupiterone/query-language-parser is private and does not resolve outside the JupiterOne registry, so the J1QL is not syntax-checked. CI is the first real check, which is why this is a draft.

Two queries most worth a second look:

• THAT !ENFORCES << crowdstrike_prevention_policy — reverse-direction negation; the idiom is copied from sophos rule 1's THAT !PROTECTS << sophos_endpoint
• the chained positive-then-negated traversal in the compound rule

🤖 Generated with Claude Code

[SeaBlooms]

https://github.com/JupiterOne/jupiterone-alert-rules/blob/main/package.json#L3

this version needs to be bumped before deployment to prod