CrowdStrike Falcon

Introduction

The Safe–CrowdStrike connector is a consolidated integration that ingests data across the following modules using CrowdStrike APIs:

• Falcon EDR (Endpoint Detection & Response)

• Exposure Management (Spotlight VM)

Safe automatically identifies which of these modules are licensed and accessible based on your API credentials and permissions, streamlining the onboarding process.

Types of Data Fetched

This table provides a summary of the data fetched by the CS connector

• Falcon: Host metadata (hostname, MAC, IP, OS, BIOS, agent version), timestamps, etc.

• Spotlight: Vulnerability data: CVE ID, severity, exploitability, detection timestamps, affected software, and remediation state.

Prerequisites and Permissions

You need the following connection details to establish the SAFE-CrowdStrike connection.

• CrowdStrike URL

• Client ID

• Client Secret

Note

To create API clients and secrets, you must have a Falcon Administrator role in CrowdStrike. The API client secret value is only shown when a new API client is created or while resetting it.

Generate Connection Details

Follow the step-by-step procedure below to get the CrowdStrike URL, Client ID, and Client Secret.

1. Log in to your CrowdStrike instance.

2. Navigate to the Support and resources > API Clients and Keys (Under “Resources and tools”).

3. Under OAuth2 API clients, click the Create API Client. It opens an API scope view.

4. Enter the details Client Name and Description.

5. Select the Read and/or Write boxes next to a scope to enable access to its endpoints

6. At least one scope must be assigned.

7. Only required scopes are requested per module (e.g., read:hosts, read:vulnerabilities, read:discover).

   
   

8. Click the Create button.

9. The system displays the connection details (URL, Client ID, and Client Secret). Copy connection details somewhere, as they will be needed at the time of configuring the connector in Safe.

Configure CrowdStrike in SAFE

Follow these steps to configure the CrowdStrike connector in the Safe Platform.

1. Log in to SAFE as an admin, then navigate to Integrations.

2. Click on the + icon on the top right of the page and search for CrowdStrike.

3. Enter the connection details (Name, CrowdStrikeURL, Client ID, and Client Secret) on the CrowdStrike Configuration page.

4. Enter the API Filter in CrowdStrike FQL format.
   Ex, product_type_desc:['Server'].

5. Enter a value in days for the Asset Last seen days filter field. This is the maximum allowed age of assets (in days) while populating the data from the source.

6. Click the Test Connection.

7. Once the connection is verified, click Save.

8. Click the Sync Now to trigger an on-demand sync.

View Results

To view the assets and the assessment result:

1. From the Integrations page, click on the CrowdStrike Falcon card.

2. A page with the “Finding View” and “Asset View” tabs will open.

3. The Findings View tab contains all the findings pulled from CrowdStrike.

4. The Asset View tab lists all assets pulled/updated from CrowdStrike.

API Details

Fetching Inventory details from CrowdStrike requires two steps:

• Fetch resources

• Fetch inventory for each resource ID got from the fetch resources response.

FAQs

Q: How frequently does SAFE sync data from CrowdStrike?

A: Sync frequency depends on the auto sync frequency configured on the CrowdStrike integration page.

Q: What happens if API rate limits are exceeded?

A: SAFE automatically manages rate limits by pausing and retrying API calls after the designated wait time.

Q: How are duplicate assets or findings handled?

A: Assets are deduplicated based on unique identifiers.

Q: Can historical data be re-ingested?

A: Yes, historical data can be re-ingested by re-running the integration.

To check sync status and errors for this integration, see Integration History.

Did this article help?

Let us know by leaving a star rating at the top of this article.