CrowdStrike Spotlight (Direct)
Connect CrowdStrike Falcon Spotlight directly to RAD Security and query vulnerabilities, affected applications, CVEs and remediations in CrowdStrike's own vocabulary.
RAD Security connects directly to the CrowdStrike Falcon API with an OAuth2 API client and imports Falcon Spotlight vulnerabilities into four dedicated data types: vulnerabilities, the applications each one affects, the CVEs and the remediations.
The data keeps CrowdStrike's vocabulary. A vulnerability keeps Spotlight's own id, status (open, reopen, closed, expired), ExPRT rating and confidence, so a number in RAD and the same filter in the Falcon console answer the same question.
Read-only integration. RAD exchanges the API client's credentials for a short-lived token and only reads vulnerabilities. It never suppresses, closes or changes anything in Falcon.
Direct, or through the CrowdStrike Falcon Spotlight card? This page covers the CrowdStrike Spotlight card, which connects to Falcon directly and keeps CrowdStrike's fields. The older CrowdStrike Falcon Spotlight card maps findings into RAD's shared vulnerability views. Both can run side by side.
Prerequisites
- A CrowdStrike Falcon subscription with Spotlight
- Permission to create API clients in the Falcon console (Falcon Administrator)
- Your Falcon cloud region (US-1, US-2, US-3, EU-1, US-GOV-1 or US-GOV-2)
- A RAD Security workspace with integration permissions
What RAD stores
| Object | RAD data type | One row per |
|---|---|---|
| Vulnerabilities | crowdstrike_spotlight_vulnerabilities | Spotlight vulnerability (host × CVE), with the CVE and host details copied onto the row |
| Affected applications | crowdstrike_spotlight_vulnerability_apps | application affected by a vulnerability |
| CVEs | crowdstrike_spotlight_cves | CVE |
| Remediations | crowdstrike_spotlight_remediations | remediation (patch or action) |
Each vulnerability row carries:
- State:
status,is_open,confidence,is_suppressedand the suppression reason, created / updated / closed times,ttr_days - CVE: id, severity, CVSS base, exploitability and impact scores, exploit status, ExPRT rating, remediation level, CWEs, threat actors, CISA KEV flag and due date, published dates
- Host: hostname, local IP, OS version and build, platform, machine domain, OU, site, manufacturer, product type, asset criticality, internet exposure, cloud instance and account, host groups and tags
- Applications and fixes: the affected product versions and the remediation ids
The four types are queryable in the Evidence Room, dashboard widgets, the data API and radbot.
Step 1: Create an API client in Falcon
Open API clients and keys
Sign in to the Falcon console as a Falcon Administrator and open Support and resources > API clients and keys.
Create the client
Select Create API client and name it, for example RAD Security - Spotlight.
Grant one scope
Tick Read for Vulnerabilities (Vulnerabilities:read). Nothing else is needed.
Falcon issues a token for an API client that lacks the scope, and refuses only the first read. RAD's verification makes that first read, so a missing scope is reported when you save the integration, not days later.
Copy the Client ID and Secret
Falcon shows the Client Secret only once. Copy both values before you close the dialog. The console also shows the Base URL, which tells you the region (for example api.us-2.crowdstrike.com is US-2).
Step 2: Configure in RAD Security
Open Data Sources > Integrations > Vulnerabilities, add the CrowdStrike Spotlight integration and fill in the fields.
| Field | Required | Value |
|---|---|---|
| Client ID | Yes | The API client's Client ID |
| Client Secret | Yes | The API client's Client Secret |
| Falcon Cloud Region | Yes | Your Falcon cloud: us-1, us-2, us-3, eu-1, us-gov-1 or us-gov-2 |
| Member CID | No | Leave blank unless the API client belongs to a Flight Control (MSSP) parent CID — see below |
RAD calls only the gateway of the region you pick. The wrong region fails to connect rather than quietly reading another cloud.
Member CID is for Flight Control (MSSP) parents only. If the API client belongs to a parent CID, enter the CID of the one child whose data this integration should import; every other child is then imported by nothing, with no error. Left blank on a parent credential, rows from several children arrive together in this one RAD workspace. On an ordinary (non-MSSP) tenant, leave it blank.
The same API client can serve both this integration and CrowdStrike Insight if it carries both scopes. RAD shares one token between them, so two integrations on one credential do not double the token load.
Once the status shows Connected, the first pass walks your whole vulnerability history and can take several sync cycles on a large estate. After that each cycle reads only what changed.
Reading the data
Open is a column
A vulnerability is open when is_open = 1: its status is open or reopen and it has not dropped out of Spotlight. Suppression is deliberately not part of is_open; filter is_suppressed separately when you want to exclude suppressed vulnerabilities.
One row per Spotlight vulnerability
The row id is Spotlight's own vulnerability id, unchanged, so a row in RAD and the vulnerability in Falcon are the same object. Each row is the current state of that vulnerability; RAD stores every observation as a version and reads back the latest.
Remediation time
ttr_days is written when a vulnerability closes: the days between Spotlight's created and closed times. Compute MTTR as avg(ttr_days) over closed vulnerabilities; vulnerabilities that are still open leave it empty and are excluded from the average.
Only closed counts as a remediation. expired means the host went away with nothing fixed, so it leaves ttr_days empty too.
Sync cadence
Each sync cycle reads the vulnerabilities created or updated since the last one, in one-hour windows, and a cycle is bounded to about ten minutes so a large backlog is worked off over several cycles instead of holding a long call open. RAD periodically re-reads the open set to pick up vulnerabilities that closed.