CrowdStrike Falcon
Purpose
Imports host inventory, sensor version, and Spotlight vulnerability data from CrowdStrike Falcon to correlate endpoint and vulnerability signals with cloud and identity data.
SubImage uses CrowdStrike's Hosts API and Spotlight Vulnerabilities API.
tip
Secret fields below accept either an AWS Secrets Manager ARN or a value pasted directly into SubImage's managed vault. See Secrets for details.
important
If your CrowdStrike API endpoint is restricted to a private network, set tailscale_hostname and run the collector from a SubImage Outpost.
Required Fields
| Field | Secret? | Description |
|---|---|---|
crowdstrike_client_id |
No | Falcon API Client ID |
crowdstrike_client_secret |
Yes | Falcon API Client Secret |
crowdstrike_api_url |
No | API base URL, e.g. https://api.us-2.crowdstrike.com |
tailscale_hostname |
No | (Optional) Internal hostname resolved via Outpost |
Setup Steps
- In Falcon → Support Apps, create a new API Client with at least Hosts: Read and Vulnerabilities: Read permissions.
- Save the Client ID and Client Secret.
- In SubImage, fill in the fields above (use the Client Secret or its AWS Secret ARN for
crowdstrike_client_secret) and save the module.
Troubleshooting
- Hosts sync works but Spotlight vulnerabilities stay empty → the API client is missing Vulnerabilities: Read.
- Older setup guides mention Detects: Read — not required. The current integration does not call the Detects API.