CrowdStrike Falcon

Purpose

The CrowdStrike Falcon connector uses the Falcon OAuth2 API with read-only scopes to collect host sensor health, detection and vulnerability exposure data for endpoints protected by Falcon.

Requirements

• A CrowdStrike Falcon tenant with API client management enabled
• A dedicated API client with read-only scopes
• Falcon Spotlight (vulnerability) module licensed if vulnerability evidence is required

Permissions

• Hosts: Read — device inventory and sensor health
• Detections: Read — endpoint detections and severity
• Spotlight Vulnerabilities: Read — per-host vulnerability exposure, where licensed
• Incidents: Read — optional, for incident correlation

Setup

1. 1
   Create an API client

   In Falcon, go to Support and Resources > API Clients and Keys, and create a new client.
2. 2
   Assign read-only scopes

   Grant only the Read scopes listed above; do not grant any Write scope.
3. 3
   Store the client ID and secret

   Copy the client ID and secret into AssurIQ's Credential Vault immediately (the secret is shown once).
4. 4
   Connect in AssurIQ

   In Integrations, add the Falcon API client and select the correct cloud region (US-1, US-2, EU-1, etc.).
5. 5
   Verify collection

   Confirm host inventory and detections populate under Vulnerability Center.

Verification

• Falcon-protected hosts appear with sensor health and last check-in
• Detections populate alongside vulnerability and identity findings
• Spotlight vulnerability data appears per host, where licensed

Data collected

• Host inventory, OS version and sensor health/version
• Detections and their severity and status
• Per-host vulnerability exposure (Spotlight), where licensed
• Falcon-assigned host risk indicators

Security model

The API client is restricted to Read-only scopes and cannot trigger containment, isolation or policy changes. Credentials are stored encrypted and used only over the regional Falcon API endpoint's TLS connection.

Common errors

• AIQ-CRD-001Credentials failing
  Stored credentials were rejected by one or more targets.

Troubleshooting

• If no hosts appear, confirm the correct cloud region was selected during setup — Falcon API clients are region-specific.
• If vulnerability data is empty, confirm Falcon Spotlight is licensed and the Spotlight Vulnerabilities: Read scope was granted.

Disconnect

1. Disconnect Falcon from AssurIQ Integrations.
2. Delete or disable the API client in Falcon's API Clients and Keys page.