CrowdStrike Exclusions Guide
Audience
This document is intended for Security and IT Teams, who are responsible for maintaining endpoint protection and ensuring the seamless operation of BEAK Agents within their managed environments.
Goal
To ensure the smooth functioning of the BEAK Agent within your environment while maintaining robust endpoint protection with CrowdStrike Falcon.
Why This Matters
You may have already allowed beak*.exe files under: C:\Program Files (x86)\Beak\
However, Falcon may still flag child processes such as PowerShell or WMIC triggered by BEAK (for example, during GPU or hardware info retrieval).
This is expected behavior from Falcon’s advanced detection engine, which focuses on behavioral activity, not just executables.
This guide provides a safe and precise method to resolve these alerts by setting targeted exclusions.
Step-by-Step Resolution
Step 1: Understand the Detection
- Open the Falcon Console.
- Go to Activity → Detections.
- Look for BEAK-related alerts and note the following:
- Parent process:
beakagent.exe - Child process: e.g.,
powershell.exe,wmic.exe - Command line triggered
- Detection type: e.g., Recon Tool, Suspicious Process
- Parent process:
This information will help build a targeted and secure exclusion rule.
Step 2: Create a Custom IOA Exclusion
-
Navigate to:
Configuration → Prevention Policies → [Your Windows Policy] → Custom IOAs → Add Exclusion -
Use the following values to define the rule:
| Field | Value |
|---|---|
| Process Executable | beak*.exe |
| Path | C:\Program Files (x86)\Beak\ |
| Child Process | powershell.exe, wmic.exe, cmd.exe |
| Detection Type | As per the alert |
| Action | Allow |
| Scope | BEAK Host Group only (recommended) |
Falcon provides a built-in test to validate the pattern before saving.
Step 3: Allow BEAK’s Backend Communication
Ensure the following domains and ports are open for outbound access from BEAK-installed systems:
| Domain | Port | Protocol | Purpose |
|---|---|---|---|
apps-uat.beakops.com | 443 | TCP | API communication |
uat-ras.beakops.com | 443 | TCP / WebSocket | Remote actions |
beakstreamdemobootstrap.westus2.cloudapp.azure.com | 9094 | TCP | Streaming backend |
beakstream-bk0-demo.westus2.cloudapp.azure.com | 9094 | TCP | Streaming backend |
beakstream-bk1-demo.westus2.cloudapp.azure.com | 9094 | TCP | Streaming backend |
beakstream-bk2-demo.westus2.cloudapp.azure.com | 9094 | TCP | Streaming backend |
If using Falcon Firewall Management:
- Go to Configuration → Firewall Policies → Add Rule
- Create an Outbound Allow rule for each domain/port.
If not using Falcon’s firewall, replicate these rules in your existing firewall infrastructure.
Step 4 (Optional): Trust BEAK Executables via Certificate or Hash
If BEAK executables are signed:
- Go to Configuration → Indicators → Certificates.
- Add BEAK's publisher certificate to trust signed files globally.
Or, to trust specific hashes:
Get-FileHash "C:\Program Files (x86)\Beak\beakagent.exe" -Algorithm SHA256
Then allowlist the hash under Indicators → Allowlist.
This approach is useful if your organization prefers granular control or does not use certificates.
Step 5: Test and Confirm
- Restart the system or BEAK Agent.
- Rerun previously blocked actions (e.g., hardware inventory scan).
- Confirm:
- No new detections appear in the Falcon Console.
Summary of Required Exclusions
| Type | What to Exclude |
|---|---|
| Executables | beak*.exe under Program Files |
| Child Processes | PowerShell, WMIC, CMD (when triggered by BEAK) |
| Behaviors | System queries such as WMI, GPU enumeration |
| Network | Domains and ports required for agent communication |
| Trust (Optional) | File certificate or SHA-256 hash allowlist |
Important Notes
- Keep exclusions scoped — apply only to devices running BEAK Agent to reduce risk.
- Monitor child processes — ensure they are not misused by external scripts.
- Use certificate-based trust when possible.
- Document all changes (logs, screenshots, JSONs) for compliance.
- Review after each BEAK update to ensure exclusions remain relevant.
- Align with your organization's security policy and involve the SOC or infosec team before finalizing.
Helpful Reference Links
| Topic | Link |
|---|---|
| How to create IOA exclusions (Red Canary) | How to Create Exclusions in CrowdStrike – Red Canary |
| Falcon Firewall Management Overview | CrowdStrike Falcon Firewall Management Overview |
| FalconPy Custom IOA API | FalconPy Custom IOA API Documentation |
| Community best practices | Community Best Practices – CrowdStrike Reddit Thread |