CrowdStrike Falcon Spotlight
Configure CrowdStrike Falcon Spotlight for real-time vulnerability assessment with RAD Security.
This guide walks you through integrating CrowdStrike Falcon Spotlight with RAD Security for real-time vulnerability detection and assessment, allowing you to correlate vulnerability data with runtime security events.
CrowdStrike Falcon Spotlight provides agent-based vulnerability detection with runtime context, helping you prioritize vulnerabilities based on actual exposure and exploitation risk.
Prerequisites
Before you begin, ensure you have:
- Admin access to CrowdStrike Falcon console
- Falcon Administrator role assigned to your account
- Access to RAD Security workspace with integration permissions
If you need to create a separate user for managing this integration, navigate to Host setup and management > Falcon users > User management in CrowdStrike Falcon.
Step 1: Log in to CrowdStrike Falcon
Access Falcon Console
Log in to the CrowdStrike Falcon UI as an administrator
Verify Permissions
Ensure your account has the Falcon Administrator role assigned. This role is required to create API clients.
Step 2: Create API Client and Keys
Navigate to API Clients
In the CrowdStrike Falcon console, go to:
Support and resource > Resources and tools > API clients and keys
Create New API Client
Click Create API client to open the configuration dialog
Configure Client Details
In the API client creation dialog:
- Enter a Client name (e.g., "RAD Security Integration")
- Add a Description (e.g., "API client for RAD Security vulnerability integration")
Set API Scopes
In the scopes section, grant the following read permissions:
- Hosts - Check the Read checkbox
- Vulnerabilities - Check the Read checkbox
These scopes allow RAD Security to read vulnerability findings and host information from CrowdStrike Falcon Spotlight.
Create and Save Credentials
- Click Create to generate the API client
- A new dialog will appear with your credentials
- Copy and save the following values securely:
- Client ID
- Secret
- Base URL
Save your credentials immediately! The Client Secret will only be displayed once. Store it in a secure location, as you won't be able to retrieve it later.
Step 3: Configure in RAD Security
Navigate to your RAD Security workspace and configure the CrowdStrike Falcon Spotlight integration with the following parameters:
Required Parameters
| Parameter | Description | Example |
|---|---|---|
| Base URL | The Base URL from Step 2 | https://api.crowdstrike.com |
| Client ID | The Client ID from Step 2 | a1b2c3d4e5f6... |
| Client Secret | The Secret from Step 2 | X1Y2Z3A4B5C6... |
Verify Integration
After completing the setup, verify your integration is working:
- Navigate to Data Sources > Integrations > Vulnerabilities in RAD Security
- Locate your CrowdStrike Falcon Spotlight integration
- Check the connection status shows as Connected
- Verify vulnerability data is being synced
Your CrowdStrike Falcon Spotlight integration is now configured! RAD Security can now import vulnerability findings and correlate them with runtime security events.
What Data is Synced
Once configured, RAD Security will sync the following data from CrowdStrike Falcon Spotlight:
Use Cases
Runtime Exploit Detection Detect when vulnerabilities identified by Falcon Spotlight are actively being exploited in your environment.
Risk-Based Prioritization Prioritize vulnerabilities based on runtime exposure, active exploitation, and criticality.
Automated Response Trigger automated responses when high-risk vulnerabilities are detected on critical assets.
Compliance Validation Verify vulnerability remediation efforts with runtime validation.
Troubleshooting
Security Best Practices
Least Privilege Access Only grant Read access to Hosts and Vulnerabilities. Avoid granting Write or Admin permissions.
Dedicated API Client Create a dedicated API client specifically for RAD Security integration rather than reusing existing clients.
Secure Credential Storage Store API credentials securely. Never commit them to version control or share them via unsecured channels.
Regular Audits Periodically review API client access and permissions in CrowdStrike Falcon.