Skip to content
Furl Docs

CrowdStrike Falcon Spotlight

Connect Furl to CrowdStrike Falcon Spotlight using OAuth2 API credentials for real-time vulnerability assessment of endpoints protected by the Falcon platform.

Description

Section titled “Description”

CrowdStrike Falcon Spotlight provides continuous vulnerability assessment for hosts running the Falcon agent. Furl’s integration imports both the host inventory and the associated vulnerability findings (with CVE details, CVSS scores, and exploit status) into the context graph for prioritization and remediation. Host records are enriched with hardware identity (serial number, BIOS and system details) from the Falcon Hosts API, which Furl uses to correlate each device with its Furl agent and with the same device seen by other integrations.

Required API Scopes

Section titled “Required API Scopes”

The API client you create for Furl must have both of the following scopes:

Scope Falcon console name Used for
spotlight-vulnerabilities:read Spotlight vulnerabilities — Read Importing hosts and vulnerability findings
hosts:read Hosts — Read Enriching hosts with hardware identity (serial number, BIOS details) for device correlation

Without hosts:read, hosts and findings still sync, but endpoints are imported without serial numbers — Furl then has to correlate devices on hostname and IP alone, which is less reliable and can leave CrowdStrike-reported vulnerabilities unmatched to the endpoints seen by the Furl agent or other integrations.

Configuration Steps

Section titled “Configuration Steps”

  1. Create an API Client in the Falcon console

    • Sign in to the CrowdStrike Falcon console.
    • Navigate to Support → API Clients and Keys.
    • Click Add new API client.
    • Give it a meaningful name (e.g., Furl Spotlight Integration).
    • Grant the Spotlight vulnerabilities — Read (spotlight-vulnerabilities:read) and Hosts — Read (hosts:read) scopes.
    • Save and copy the Client ID and Client Secret immediately — the secret is shown only once.

  2. Note your Falcon API base URL

    The base URL depends on the cloud region your CrowdStrike tenant runs in:

    Region Base URL
    US-1 https://api.crowdstrike.com
    US-2 https://api.us-2.crowdstrike.com
    EU-1 https://api.eu-1.crowdstrike.com
    US-GOV-1 https://api.laggar.gcw.crowdstrike.com

    If you’re not sure, check the URL of your Falcon console.

Required Configuration

Section titled “Required Configuration”

Provide the following in Furl:

  • Client ID — Your CrowdStrike API client ID.
  • Client Secret — Your CrowdStrike API client secret.
  • Base URL (optional) — The Falcon API base URL for your region. Defaults to the US-1 endpoint if omitted.

Datasource Configuration

Section titled “Datasource Configuration”

Assets and Vulnerabilities

Section titled “Assets and Vulnerabilities”

The Assets and Vulnerabilities datasource supports the following optional filters:

  • FQL Filter — A Falcon Query Language expression. Useful for narrowing the scope of imported vulnerabilities. Supported fields include status, cve.id, cve.severity, cve.base_score, host_info.platform_name, host_info.tags, etc. Example: status:'open'+cve.severity:'critical'.
  • Status Filter — Filter by vulnerability status. Options: open, closed, reopen, expired. Leave empty to include all statuses.
  • Severity Filter — Filter by CVE severity. Options: critical, high, medium, low, unknown. Comma-separated for multiple values.

Supported Capabilities

Section titled “Supported Capabilities”

Datasources

Section titled “Datasources”
  • Assets and Vulnerabilities → Retrieve hosts and vulnerability findings together using Spotlight’s combined endpoint, then enrich each host with hardware identity (serial number, BIOS and system details) from the Hosts API. Imports both endpoints and vulnerabilities outputs.

Actions

Section titled “Actions”

Currently no actions are supported for this integration.

Troubleshooting

Section titled “Troubleshooting”
  • Sync fails with a 403 error — verify the API client has the spotlight-vulnerabilities:read scope; without it the vulnerability import itself is rejected.
  • Endpoints sync without serial numbers (and may not correlate with agent-managed devices) — the API client is missing the hosts:read scope. Add Hosts — Read to the API client in the Falcon console; serial numbers appear on the next sync.
  • If you see authentication errors, double-check that the Base URL matches your Falcon tenant’s region.
  • Large environments can return many findings on first sync; use FQL or severity filters to narrow scope while you tune the integration.