CrowdStrike Spotlight

Connect CrowdStrike Spotlight to import open vulnerabilities into Guard as risks on the matching hosts.

Overview

The CrowdStrike Spotlight integration brings CrowdStrike vulnerability data into the Praetorian Guard Platform (PGP), so you can correlate endpoint findings with the rest of your exposure data.

In practice, PGP uses both Spotlight and Hosts data together:

  • Hosts data is used to map CrowdStrike devices into Guard assets
  • Spotlight data is used to ingest open CVEs as Guard risks
  • Findings are correlated to assets using CrowdStrike agent IDs

Prerequisites

Before you begin, make sure you have:

  • Access to the CrowdStrike Falcon console with permission to create API clients
  • A CrowdStrike tenant with Hosts and Spotlight access
  • Your CrowdStrike cloud region

Create a CrowdStrike API Client

  1. Sign in to the CrowdStrike Falcon console.

  2. Navigate to Support & Resources → API Clients & Keys.

  3. Click Create API Client.

  4. Grant the following read-only scopes:

    ScopeRequired for

    Hosts: Read

    Asset correlation and host inventory lookup

    Vulnerabilities: Read

    Spotlight vulnerability ingestion

If you enable Spotlight in Guard, you must also grant Hosts: Read so Guard can map vulnerability findings back to the correct assets.

After saving the client, copy the following values and store them securely:

  • Client ID
  • Client Secret
  • Cloud Region from your Falcon console URL

Supported regions:

  • us-1 — api.crowdstrike.com
  • us-2 — api.us-2.crowdstrike.com
  • eu-1 — api.eu-1.crowdstrike.com
  • us-gov-1 — api.laggar.gcw.crowdstrike.com

You will not be able to retrieve the client secret again later.

Configure the Integration in PGP

  1. In PGP, go to Integrations.
  2. Select Managed Detection & Response → CrowdStrike Falcon.
  3. Click Connect.
  4. Enter your Client ID, Client Secret, and Cloud Region.
  5. Enable the modules you want to use.

For Spotlight vulnerability ingestion, enable:

  • Spotlight (Vulnerabilities)
  • Hosts (Endpoint Inventory)

Both are enabled by default.

  1. Click Connect.

PGP validates the API credentials and confirms access to each enabled CrowdStrike module before saving the integration. If a module is not licensed for your tenant, PGP shows The CrowdStrike <module> module is not licensed or not available for this tenant.

What Data Is Synced

Spotlight → PGP Risks

PGP ingests:

  • Open CVEs from CrowdStrike Spotlight that match at least one of these filters:
    • CrowdStrike ExPRT rating of High or Critical, with a network attack vector
    • Listed in the CISA Known Exploited Vulnerabilities catalog, with any attack vector
    • On Guard's list of CVEs used in attack-chain correlation
  • Findings updated since the last successful Spotlight sync, looking back at least 1 day and at most 5 days (5 days on the first sync)
  • CVSS score, severity, description, remediation guidance, references, and proof artifacts

Hosts → Asset Correlation

PGP also reads CrowdStrike host data so it can:

  • Correlate Spotlight findings to Guard assets using CrowdStrike agent IDs
  • Use hostname and local IP data for asset mapping, for devices seen in the last 7 days
  • Skip devices missing required correlation fields such as hostname or local IP

Troubleshooting

Issue

Cause

Fix

Spotlight validation fails

Missing Vulnerabilities: Read scope

Add the scope to the API client

Spotlight connects but findings do not appear

Findings may be closed, outside the sync window, below the filters listed above, or not correlated to a valid host

Confirm the vulnerabilities are open, recently updated, match a filter above, and are tied to a host with valid hostname and local IP data

Findings are missing asset context

Hosts: Read is missing or host data could not be mapped

Add Hosts: Read and verify device data exists in Falcon

Need Help?

If you run into issues during setup, contact support@praetorian.com.