Skip to main content
SAFE Security

Course Catalog

All Topics

CrowdStrike Falcon Exposure Management (FEM)

  • By SAFE Security
  • Published: Oct 14, 2026
  • Rating
    Average rating: 0 No reviews

Outline

Introduction

The CrowdStrike integration in SAFE is a consolidated integration that ingests data across the following modules using CrowdStrike APIs:

  • Falcon EDR (Endpoint Detection & Response)
  • Spotlight VM (Vulnerability Management)
  • Discover (Asset Inventory & Software Visibility)

Safe automatically identifies which of these modules are licensed and accessible based on your API credentials and permissions, streamlining the onboarding process.

Note: Discover ingestion is currently triggered only when vulnerability data from Spotlight is not fetched (for example, due to insufficient permissions or module unavailability). If Spotlight vulnerability ingestion runs successfully, Discover data is not ingested in the same cycle.

What SAFE Imports from CrowdStrike

SAFE imports the following security data from CrowdStrike.

Source Data Ingested
Falcon Host metadata (hostname, MAC, IP, OS, BIOS, agent version), timestamps etc
Spotlight Vulnerability data: CVE ID, severity, exploitability, detection timestamps, affected software, remediation state
Discover Installed software inventory, application version, vendor/product, installation path, and runtime presence

Prerequisites and Permissions

You need the following connection details to establish the SAFE-CrowdStrike connection.

  • CrowdStrike URL
  • Client ID
  • Client Secret

Note: To create API clients and secrets, you must have a Falcon Administrator role in CrowdStrike. The API client secret value is only shown when a new API client is created or while resetting it.

Generate Connection Details

Follow the below step-by-step procedure to get the connection details:

  1. Login to your CrowdStrike instance.
  2. Navigate to the Support and resources > API Clients and Keys (Under Resources and tools).
  3. Under OAuth2 API clients, click the Create API Client. It opens an API scope view.
  4. Enter the details Client Name and Description.
  5. Select the scopes as read:hosts, read:vulnerabilities, and read:discover.
  6. Click the Create button.
  7. The system displays the connection details (URL, Client ID, and Client Secret). Copy connection details somewhere, it will be needed at the time configuring connector in Safe Platform.

Configure CrowdStrike Integration in SAFE

After completing the prerequisites, follow these steps to configure Crowdstrike connector into Safe Platform.

  1. Login to SAFE as admin and navigate to Integrations on the left navigation.
  2. Click on the + icon on top right of the page. Search for CrowdStrike and click the card.
  3. On the configuration page, enter a unique name for the integration.
  4. Enter the CrowdStrikeURL, Client ID, and Client Secret.
  5. Enter the API Filter in CrowdStrike FQL format. Example, product_type_desc:['Server'].
  6. Enter a value in days for the Asset Last seen days filter field. This is the maximum allowed age of assets (in days) while populating the data from the source.
  7. Click the Test Connection.
  8. Once the connection is verified, click Save.
  9. Click the Sync Now to trigger an on-demand sync.

View Results

To view the assets and the assessment result:

  1. From the Integrations page, Click on Crowdstrike card.
  2. A page with “Finding View” and “Asset View” tabs will open up.
  3. Finding view will contain all the findings pulled from Crowdstrike.
  4. Asset view will list all the assets pulled/updated from Crowdstrike.

API Details

Fetching Inventory details from CS requires two step:

  1. Fetch resources
  2. Fetch inventory for each resource id got from fetch resources response.
API Method Endpoint
Resources GET /devices/queries/devices-scroll/v1
Inventory POST /devices/entities/devices/v2
Vulnerabilities GET /spotlight/combined/vulnerabilities/v1

FAQs

Q: What happens if API rate limits are exceeded?

A: SAFE automatically manages rate limits by pausing and retrying API calls after the designated wait time.

Q: How are duplicate assets or findings handled?

A: Assets are deduplicated based on unique identifiers.

To check sync status and errors for this integration, see Integration History.

Did this article help?

Let us know by leaving a star rating at the top of this article.