Skip to main content

CrowdStrike Spotlight connector setup

Polls vulnerability records from the CrowdStrike Falcon Spotlight API (GET /spotlight/combined/vulnerabilities/v1), incrementally by updated_timestamp.

What you need first​

RequirementDetails
CrowdStrike FalconFalcon Spotlight licensed
API accessAdministrator access to create API clients
Cloud regionKnow which Falcon cloud hosts your tenant

1. Create an API client​

  1. Sign in to the Falcon console.
  2. Go to Support and resources → API clients and keys.
  3. Click Create API client.
  4. Enter a Client name and Description (e.g. Perpetual Spotlight).
  5. Under API scopes, enable Read for Spotlight vulnerabilities.
  6. Click Create.
  7. Copy the Client ID and Client secret. The secret is shown only once.

2. Perpetual credential​

  1. Log in to Perpetual. Open Settings from the user/org control at the bottom left of the sidebar (click your name → Settings), then go to Credentials → New Credential.
  2. Choose OAuth 2.0 Client Credentials.
  3. Fill in:
FieldValue
NameUnique identifier using letters, digits, and underscores only (e.g. crowdstrike_spotlight).
Allowed URL patterns*.crowdstrike.com, *.crowdstrike.mil
Token URLMatch your Falcon cloud (same endpoints as the CrowdStrike connector)
Client IDClient ID from step 1
Client SecretClient secret from step 1
  1. Save the credential.

3. Create the CrowdStrike Spotlight connector​

  1. Go to Datasets → Connectors → Create Connector.
  2. Select CrowdStrike Spotlight.
  3. Connector name: unique identifier (letters, numbers, underscores).
  4. Configure:
    • CrowdStrike API: select the credential from step 2.
    • Poll interval (minutes): default 5.
    • Cloud environment: us1, us2, eu1, usGov1, or usGov2.
  5. Optionally check Deploy, then save.

First run queries vulnerabilities with updated_timestamp after roughly the last 24 hours. Subsequent polls advance from the last committed checkpoint.

Operational notes​

  • Assessment lag: New vulnerabilities appear after endpoint assessment completes; empty polls during quiet periods are normal.
  • Large fleets: Pagination may span multiple runs when many vulnerabilities update in one interval.
  • Separate from Event Streams: Spotlight uses a different API and scope than the CrowdStrike Event Streams connector — create a dedicated API client.

Reference​