Skip to main content
Vulnerability Management (VM)

CrowdStrike Flight Control

Connect a parent CrowdStrike CID so Guard finds its child CIDs and imports hosts and vulnerabilities from each.

Overview

The CrowdStrike Flight Control integration is designed for MSSPs and multi-tenant CrowdStrike environments.

It lets the Praetorian Guard Platform (PGP) connect once using a parent or master CID, discover child tenants automatically, and create scoped integrations for each child tenant. PGP then pulls host and vulnerability data from each child tenant and correlates it with Guard exposure data.

Use this integration when you manage multiple CrowdStrike child CIDs from a parent tenant.

Prerequisites

Before you begin, make sure you have:

  • Access to the CrowdStrike Falcon console for the parent CID
  • Permission to create API clients in CrowdStrike
  • A parent tenant licensed for Flight Control
  • Your CrowdStrike cloud region

Create a CrowdStrike API Client

  1. Sign in to the CrowdStrike Falcon console for the parent CID.

  2. Navigate to Support & Resources → API Clients & Keys.

  3. Click Create API Client.

  4. Grant the following read-only scopes based on the modules you want enabled:

    Scope

    Required for

    Flight Control: Read

    Discovering child CIDs from the parent tenant

    Hosts: Read

    Syncing host inventory and correlating vulnerability findings to assets

    Vulnerabilities: Read

    Ingesting Spotlight findings

    SaaS Security (Falcon Shield): Read

    Optional Shield module validation

If you enable Spotlight, you must also grant Hosts: Read so PGP can map findings to the correct assets.

After saving the client, copy the following values and store them securely:

  • Client ID
  • Client Secret
  • Cloud Region from your Falcon console URL

Supported regions:

  • us-1 — api.crowdstrike.com
  • us-2 — api.us-2.crowdstrike.com
  • eu-1 — api.eu-1.crowdstrike.com
  • us-gov-1 — api.laggar.gcw.crowdstrike.com

You will not be able to retrieve the client secret again later.

Configure the Integration in PGP

  1. In PGP, go to Integrations.
  2. Select Managed Detection & Response → CrowdStrike Flight Control (MSSP).
  3. Click Connect.
  4. Enter the parent CID's Client ID, Client Secret, and Cloud Region.
  5. Enable the modules you want applied across child tenants. Hosts (Endpoint Inventory) and Spotlight (Vulnerabilities) are enabled by default.
  6. Click Connect.

PGP validates the credentials before saving the integration by authenticating and listing the parent's child CIDs. It does not check the scopes for each module at this step. If authentication fails, PGP shows CrowdStrike rejected the supplied Flight Control client ID or client secret.

What Happens After Connection

After Flight Control is connected, PGP automatically:

  • Discovers child CIDs using the Flight Control API
  • Creates a scoped CrowdStrike integration for each child tenant
  • Uses the parent credentials with member_cid scoping for child-tenant access
  • Applies the module configuration you selected to each child integration

You do not need to create a separate API client for every child tenant.

What Data Is Synced

Hosts → PGP Assets

For enabled child tenants, PGP syncs:

  • Device hostname and local IP address
  • Devices seen in the last 7 days
  • Assets that can be mapped successfully from CrowdStrike host data

Spotlight → PGP Risks

For enabled child tenants, PGP ingests:

  • Open CVEs from Spotlight that match at least one of these filters:
    • CrowdStrike ExPRT rating of High or Critical, with a network attack vector
    • Listed in the CISA Known Exploited Vulnerabilities catalog, with any attack vector
    • On Guard's list of CVEs used in attack-chain correlation
  • Findings updated since the last successful Spotlight sync, looking back at least 1 day and at most 5 days (5 days on the first sync)
  • CVSS score, severity, description, remediation guidance, references, and proof artifacts
  • Findings correlated to assets using CrowdStrike agent IDs

Shield

The Shield module does not import any data. Enabling it has no effect on what PGP syncs.

Troubleshooting

Issue

Cause

Fix

Flight Control validation fails

Missing Flight Control: Read

Add the scope to the parent CID API client

Spotlight findings are missing for child tenants

Vulnerabilities: Read or Hosts: Read is missing, findings are stale, or host correlation failed

Verify both scopes are granted and confirm the findings are open, recently updated, and tied to valid devices

Child tenants do not appear

The parent tenant cannot enumerate children or Flight Control is not licensed

Verify Flight Control licensing and ensure the parent CID API client has the required scope

No assets appear

Devices may be inactive for more than 7 days, or may be missing hostname/IP data

Confirm the child tenants contain recently seen devices with valid hostname and local IP fields

Need Help?

If you run into issues during setup, contact support@praetorian.com.

Still need help? Ask the team