Skip to main content

CrowdStrike CSPM

CrowdStrike CSPM

  • By SAFE Security
  • Published: Oct 16, 2026
  • Rating
    Average rating: 5.0 1 review

Outline

About this document

This document explains how to create read-only API credentials in CrowdStrike Falcon and use them to configure the CrowdStrike CSPM integration in SAFE. The integration pulls cloud assets, misconfiguration (IOM) check results and, optionally, open vulnerabilities (CVEs) on cloud VMs for AWS, Azure, GCP and OCI accounts registered in Falcon Cloud Security.

Introduction

The integration onboards the cloud assets that Falcon Cloud Security tracks and imports the results of its configuration checks (pass and fail, with severity, evidence and remediation) into SAFE. With Import Vulnerabilities (CVEs) on, it also imports the open CVEs that Falcon Spotlight finds on cloud VMs that run a Falcon sensor. SAFE admins configure it from the CrowdStrike CSPM card on the Integrations page. The card is separate from the CrowdStrike (EDR) and CrowdStrike Spotlight cards.

Prerequisites

  1. Cloud accounts registered in Falcon Cloud Security (CSPM / IOM enabled).

  2. A Falcon user with the Falcon Administrator role, or another role that can create API clients.

  3. SAFE access with an admin role.

Permissions

Scope Access Required Used for
Cloud Security API Assets Read Yes Cloud assets (resources) and their configuration
Cloud Security API Detections Read Yes Misconfiguration (IOM) check results for each asset
Hosts Read Only with Import Vulnerabilities (CVEs) Finds the Falcon sensor host for each cloud VM
Vulnerabilities Read Only with Import Vulnerabilities (CVEs) Open Spotlight CVEs on those hosts

Generate connection details

SAFE needs three values from Falcon:

  • API URL of your Falcon cloud

  • Client ID

  • Client Secret

Create a read-only API client in Falcon

  1. Log in to the Falcon console.

  2. Go to Support and resources > Client Management, and open the API clients tab. (Older Falcon consoles call this page API clients and keys.)

  3. Click Create API client.

  4. Enter a Client name and an optional Description.

  5. In the scope list, select Read only for Cloud Security API Assets and  ***Cloud Security API Detections.*

  6. Leave every other scope unticked.

  7. Select Read permissions for Hosts and Vulnerabilities if you want to Import Vulnerabilities (CVEs) in SAFE

  8. Click Create.

  9. Copy the Client ID, Client Secret and Base URL shown. Falcon shows the secret only once. If it is lost, use Reset secret in the API client's ⋮ menu.

Add a scope to an existing API client

  1. Go to Support and resources > Client Management > API clients.

  2. On the API client's row, click ⋮ and select Edit API client.

  3. Provide the read permission to above mentioned scope.

Find your API URL

The API URL depends on the Falcon cloud your tenant runs in. It is the Base URL shown at the top of the API clients tab.

Falcon cloud API URL
US-1 https://api.crowdstrike.com
US-2 https://api.us-2.crowdstrike.com
EU-1 https://api.eu-1.crowdstrike.com
US-GOV-1 https://api.laggar.gcw.crowdstrike.com

SAFE accepts only https://api…crowdstrike.com URLs, so the secret can't be sent to another host.

Configure CrowdStrike CSPM in SAFE

  1. Go to the Integrations page

  2. Click the + button and search CrowdStrike CSPM.

  3. Click the card to open the Configuration page page.

  4. Enter the Integration Name.

  5. Enter the CrowdStrike API URL.

  6. Enter the Client ID and Client Secret.

  7. Cloud Types (optional): By default all four clouds are selected (AWS, Azure, GCP and OCI). Remove a cloud to stop syncing it.

  8. Cloud Account Ids (optional): By default SAFE syncs every account the API client can see. Enter AWS account IDs, Azure subscription IDs, GCP Project IDs or OCI Tenancy IDs to sync only those accounts.

  9. Enter the Auto Sync frequency (in Days).

  10. Auto Onboard New Assets: when ticked (default), assets in Falcon that are not yet in SAFE are onboarded. Untick it to only update assets already in SAFE.

  11. Update Existing Assets Metadata: when ticked (default), the metadata of existing assets is updated from Falcon.

  12. Import Vulnerabilities (CVEs) (optional, off by default): adds the open CVEs that Falcon Spotlight finds on cloud VMs with a Falcon sensor. The API client also needs Hosts: Read and Vulnerabilities: Read. Each sync replaces the CVE results of those VMs, including CVEs another integration reported on them, so turn this on only if no other integration reports CVEs for these VMs. Other assets keep their CVEs.

  13. Click Test Connection.

  14. When the connection is validated, click Save.

  15. Click Sync Now to run a sync outside the schedule.

View result

  1. From the Integrations page, open the CrowdStrike CSPM card.

  2. Finding View lists each CrowdStrike Findings with its severity, finding type, and the number of assets it applies to.

  3. Asset View lists the assets imported from CrowdStrike, with their types and last-assessed time.

FAQs

Which clouds does SAFE pull from CrowdStrike?

AWS, Azure, GCP and OCI, as registered in Falcon Cloud Security.

Which assets are imported?

Every asset that still exists in the selected clouds and accounts. Falcon keeps deleted resources marked inactive; SAFE skips them. Assets with no checks are imported without findings.

Why does the asset count in Falcon differ from SAFE?

Falcon's inventory also counts deleted (inactive) resources and non-cloud records. SAFE counts only active cloud assets in the selected clouds and accounts.

Does SAFE need write access?

No. Every scope is Read only.

How does rate limiting work?

Falcon allows 6,000 API calls a minute, shared across your whole Falcon account. SAFE waits and retries when Falcon returns a rate-limit response.

Did this article help?

Let us know by leaving a star rating at the top of this article.