CrowdStrike Endpoint Security

Endpoint Protection

Overview
Setup
Data & mappings
Operations & API
Changelog

The CrowdStrike Endpoint Security (ES) connector integrates with the CrowdStrike Falcon Spotlight and Devices modules, synchronizing endpoint devices, Spotlight vulnerabilities, and vulnerability definitions. Evaluation logic data is included inline with vulnerabilities via the evaluation_logic facet.

Data retrieved from CrowdStrike Endpoint Security

Connector Object	Required	Maps to Data Model
🖥️ Device	Yes	Host
⚠️ Vulnerability	Yes	Vulnerability
📖 Vulnerability Definition	Yes	Vulnerability Definition

Model relationships

note

For detailed steps on how to view the data retrieved from CrowdStrike Endpoint Security in the Brinqa Platform, see How to view your data.

note

As part of aligning with the broader suite of CrowdStrike solutions, the connector formerly known as CrowdStrike was renamed to CrowdStrike Endpoint Security in connector version 3.2.0.

note

Note: If the caller already provides a last_seen_within value in the FQL filter string, the connector does not override it.

note

Note: host_info.machine_domain is not a supported filter field for the Spotlight API. The field is present in the API response but cannot be used for server-side filtering. Attempting to filter by this field returns a 400 Bad Request: invalid filter error. This is a CrowdStrike API limitation.

Connection settings

When setting up a data integration, select CrowdStrike Endpoint Security from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API URL	Yes	`https://<region>.crowdstrike.com`	CrowdStrike API URL
Client ID	Yes	—	CrowdStrike API client Id
Client secret	Yes	—	CrowdStrike API client secret
Page size	No	`5000`	The number of records to fetch for each paged request
Parallel requests	No	`4` (capped at available processors)	The maximum number of parallel requests
Maximum retries	No	`10`	The maximum number of retry attempts before giving up a request

Authentication

CrowdStrike uses OAuth 2.0 Client Credentials flow.

Endpoint

Method	URL
`POST`	`https://<region>.crowdstrike.com/oauth2/token`

Request Headers

Header	Value
`Content-Type`	`application/x-www-form-urlencoded`

Request Body

client_id=<your-client-id>&client_secret=<your-client-secret>

Sample Response

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI...",
  "expires_in": 1799,
  "token_type": "bearer"
}

Response Fields

Field	Type	Description
`access_token`	String	Bearer token for API requests
`expires_in`	Integer	Token lifetime in seconds
`token_type`	String	Token type (always `bearer`)

Usage

Once authenticated, all subsequent API requests include the bearer token:

Authorization: Bearer <access_token>

Sync Behavior

The connector performs incremental (delta) syncs. When a since timestamp is provided, each model applies a time-based FQL filter; otherwise the first run behaves as a beginning-of-time (full) sync.

Device — Incremental. When since is set, a last_seen:>='<timestamp>' FQL clause is appended (unless the caller's filter already specifies last_seen:); otherwise all devices are enumerated.
Vulnerability — Incremental. Uses the Spotlight combined-vulnerabilities endpoint with a last_seen_within FQL filter derived from the sync token: a beginning-of-time sync uses the maximum 45 days, and incremental syncs use the days between since and now, clamped to 3–45 days.
Vulnerability Definition — Incremental. Shares the same Spotlight combined-vulnerabilities pipeline as Vulnerability, with the same last_seen_within (3–45 day) constraint.

Per-model incremental details are documented under each model's Sync Duration Parameter below.

How to obtain CrowdStrike Endpoint Security credentials

Generate a CrowdStrike client secret

For the CrowdStrike Endpoint Security connector to use the CrowdStrike API, you must provide a client secret. CrowdStrike Endpoint Security does not allow retrieving the client secret for an existing user, therefore, you must generate a new client secret instead. To do so, follow these steps:

Log in to your organization's CrowdStrike Falcon portal as an administrator.
From the navigation menu, click Support and resources, and then click API clients and keys.
Click Create API client.

The Create API client window displays.
Fill out the Client name, Description, and select the appropriate API scopes for the user.
Click Create.

Your new client ID, client secret, and recommended Base URL display. You cannot view the client secret again after this. Copy and save it to a secure location.

Note: If you do not have permissions to create a client secret, contact your CrowdStrike Endpoint Security administrator. For additional information, see CrowdStrike documentation.

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

🖥️ Device

Source Field Name	SDM Attribute
Aggregated	IP_ADDRESSES
Computed	NAME
Computed	DESCRIPTION
Computed	OPERATING_SYSTEM
`device_policies.device_control.applied`	DEVICE_CONTROL_POLICY_APPLIED
`device_policies.device_control.policy_id`	DEVICE_CONTROL_POLICY_ID
`device_policies.global_config.applied`	GLOBAL_CONFIG_POLICY_APPLIED
`device_policies.global_config.policy_id`	GLOBAL_CONFIG_POLICY_ID
`device_policies.prevention.applied`	PREVENTION_POLICY_APPLIED
`device_policies.prevention.policy_id`	PREVENTION_POLICY_ID
`device_policies.sensor_update.applied`	SENSOR_UPDATE_POLICY_APPLIED
`device_policies.sensor_update.policy_id`	SENSOR_UPDATE_POLICY_ID
`DeviceResource.agent_load_flags()`	AGENT_LOAD_FLAGS
`DeviceResource.agent_local_time()`	AGENT_LOCAL_TIME
`DeviceResource.agent_version()`	AGENT_VERSION
`DeviceResource.bios_manufacturer()`	BIOS_MANUFACTURER
`DeviceResource.bios_version()`	BIOS_VERSION
`DeviceResource.build_number()`	BUILD_NUMBER
`DeviceResource.chassis_type_desc()`	CHASSIS_TYPE
`DeviceResource.cid()`	CUSTOMER_ID
`DeviceResource.connection_ip()`	CONNECTION_IP
`DeviceResource.connection_mac_address()`	CONNECTION_MAC_ADDRESS
`DeviceResource.default_gateway_ip()`	DEFAULT_GATEWAY_IP
`DeviceResource.device_id()`	UID
`DeviceResource.external_ip()`	PUBLIC_IP_ADDRESSES
`DeviceResource.first_login_timestamp()`	FIRST_LOGIN
`DeviceResource.first_login_user()`	FIRST_LOGIN_USER
`DeviceResource.first_seen()`	FIRST_SEEN
`DeviceResource.groups()`	GROUPS
`DeviceResource.hostname()`	HOSTNAMES
`DeviceResource.hostname()`	PRIVATE_DNS_NAMES
`DeviceResource.instance_id()`	INSTANCE_ID
`DeviceResource.kernel_version()`	KERNEL_VERSION
`DeviceResource.last_login_timestamp()`	LAST_LOGIN
`DeviceResource.last_login_user()`	LAST_LOGIN_USER
`DeviceResource.last_reboot()`	LAST_STARTED
`DeviceResource.last_seen()`	LAST_SEEN
`DeviceResource.local_ip()`	PRIVATE_IP_ADDRESSES
`DeviceResource.mac_address()`	MAC_ADDRESSES
`DeviceResource.machine_domain()`	MACHINE_DOMAIN
`DeviceResource.major_version()`	MAJOR_VERSION
`DeviceResource.minor_version()`	MINOR_VERSION
`DeviceResource.modified_timestamp()`	SOURCE_LAST_MODIFIED
`DeviceResource.notes()`	NOTES
`DeviceResource.os_build()`	OS_BUILD
`DeviceResource.os_product_name()`	OS_PRODUCT_NAME
`DeviceResource.os_version()`	OS_VERSION
`DeviceResource.ou()`	OU
`DeviceResource.platform_id()`	PLATFORM_ID
`DeviceResource.platform_name()`	PLATFORM_NAME
`DeviceResource.product_type_desc()`	CATEGORIES
`DeviceResource.provision_status()`	PROVISION_STATUS
`DeviceResource.reduced_functionality_mode()`	REDUCED_FUNCTIONALITY_MODE
`DeviceResource.serial_number()`	SERIAL_NUMBER
`DeviceResource.status()`	STATUS
`DeviceResource.system_manufacturer()`	SYSTEM_MANUFACTURER
`DeviceResource.system_product_name()`	MODEL
`DeviceResource.tags()`	TAGS
Generated	LAST_CAPTURED

⚠️ Vulnerability

Source Field Name	SDM Attribute
Computed	NAME
Computed	LAST_FOUND
Computed	STATUS_CATEGORY
Computed	EVALUATION_LOGIC
Computed	EVALUATION_LOGIC_RAW
Computed	RESULTS
`EvaluationLogicDetail.dataProvider()`	DATA_PROVIDER
Generated	TYPE
Generated	LAST_CAPTURED
Normalized	SEVERITY
Normalized	SOURCE_STATUS
Normalized	STATUS
`VulnerabilityResource.aid()`	TARGETS
`VulnerabilityResource.cid()`	CUSTOMER_ID
`VulnerabilityResource.closed_timestamp()`	LAST_FIXED
`VulnerabilityResource.created_timestamp()`	FIRST_FOUND
`VulnerabilityResource.created_timestamp()`	SOURCE_CREATED_DATE
`VulnerabilityResource.cve.exprt_rating()`	EX_PRT_RATING
`VulnerabilityResource.cve.severity()`	SOURCE_SEVERITY
`VulnerabilityResource.host_info.hostname()`	HOSTNAMES
`VulnerabilityResource.host_info.local_ip()`	IP_ADDRESSES
`VulnerabilityResource.id()`	UID
`VulnerabilityResource.status()`	PROVIDER_STATUS
`VulnerabilityResource.updated_timestamp()`	SOURCE_LAST_MODIFIED

📖 Vulnerability Definition

Source Field Name	SDM Attribute
Calculated	SEVERITY_SCORE
Computed	NAME
Computed	AFFECTED
Computed	RECOMMENDATION
Computed	PATCH_AVAILABLE
Generated	UID
Generated	LAST_CAPTURED
Normalized	SEVERITY
`VulnerabilityResource.cve.description()`	DESCRIPTION
`VulnerabilityResource.cve.description()`	SUMMARY
`VulnerabilityResource.cve.exploit_status()`	EXPLOITABILITY
`VulnerabilityResource.cve.published_date()`	PUBLISHED_DATE
`VulnerabilityResource.cve.references()`	REFERENCES
`VulnerabilityResource.cve.severity()`	SOURCE_SEVERITY
`VulnerabilityResource.vulnerability_id()`	CVE_IDS
`VulnerabilityResource.vulnerability_id()`	CVE_RECORDS

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

🖥️ Device

Operation options

Option	Type	Default	Description
`filter`	String	—	Raw FQL filter string passed directly to the Devices API
`machine_domain`	String	—	Filters devices by Active Directory domain

Delta sync

Supported.

API

Type: REST · Endpoint: GET /devices/queries/devices-scroll/v1
Default filters: When since is provided, an FQL last_seen:>='<timestamp>' clause is appended unless the caller's filter already specifies last_seen:

note

Any valid CrowdStrike FQL field for the Device resource can be used as a key-value operation option. See CrowdStrike API documentation for the full list of supported fields.

info

The filter option and individual key-value filters are mutually exclusive. When filter is provided, all other key-value filter options are ignored.

⚠️ Vulnerability

Operation options

Option	Type	Default	Description
`includeEvaluationLogic`	Boolean	`false`	When `true`, adds the `evaluation_logic` facet to the Spotlight API call and populates `EVALUATION_LOGIC`, `EVALUATION_LOGIC_RAW`, and `DATA_PROVIDER` attributes. When `false` or absent, those attributes are omitted from the connector object.
`filter`	String	—	Raw FQL filter string passed directly to the Spotlight API
`status`	String	—	Filters vulnerabilities by status. On BOT (beginning of time) syncs, `status` defaults to excluding `expired` if not explicitly set

Delta sync

Supported.

API

Type: REST · Endpoint: GET /spotlight/combined/vulnerabilities/v1
Default filters: Facets host_info, cve, remediation are always requested (plus evaluation_logic when includeEvaluationLogic is true). An FQL last_seen_within:<3–45> clause is appended unless the caller's filter already specifies it. On BOT syncs with no explicit status, status:!'expired' is added.

note

Any valid CrowdStrike Spotlight FQL field can also be used as a key-value operation option to filter vulnerabilities.

info

The filter option and individual key-value filters are mutually exclusive. When filter is provided, all other key-value filter options are ignored.

📖 Vulnerability Definition

Operation options

This object does not support any operation options.

Delta sync

Supported.

API

Type: REST · Endpoint: GET /spotlight/combined/vulnerabilities/v1
Default filters: Shares the same Spotlight pipeline as Vulnerability — definitions are derived from the same combined-vulnerabilities response (facets host_info, cve, remediation; same last_seen_within 3–45 day constraint)

Changelog

The CrowdStrike Endpoint Security connector has undergone the following changes:

Version	Description	Migration Steps
3.2.22	Improvements - Connector-sourced attribute values now take precedence over non-connector data channels (manual edits, bulk imports, UI input) when the platform consolidates records, so CrowdStrike data is no longer overridden by lower-priority sources. Bug Fixes - Behavior model: corrected 14 detection-flag attributes (Detect, Indicator, Inddet mask, Kill parent/process/subprocess, Operation blocked, Policy disabled, Process blocked, Quarantine file/machine, Registry operation blocked, Rooting, Sensor only) from text to true/false (Boolean), matching the values returned by the API. - Incident "Status" attribute corrected from a numeric type to text. - Detection "Max confidence" is now read as a number (the API field was incorrectly modeled as a timestamp). - Behavior "Pattern ID" is now stored as text consistently (it is populated from both the numeric pattern id and the string behavior id).	• Behavior, Incident, Detection: the attributes above changed data type. Re-sync the CrowdStrike Endpoint Security connector to repopulate these records with the corrected types.
3.2.21	No changes in this release.	N/A
3.2.20	No changes in this release.	N/A
3.2.19	No changes in this release.	N/A
3.2.18	New Features - Vulnerability records now include an "Evaluation logic (raw JSON)" attribute alongside the human-readable evaluation logic, and a "Data provider" attribute identifying the source of the evaluation. Evaluation logic is now populated only when the corresponding facet is enabled, avoiding unnecessary API overhead. Improvements - The standalone Evaluation Logic model has been retired; the same information is now surfaced directly on Vulnerability records.	• Evaluation Logic: this model is no longer synced. Purge existing Evaluation Logic records, then re-sync the connector so evaluation details are repopulated on Vulnerability records.
3.2.17	No changes in this release.	N/A
3.2.16	No changes in this release.	N/A
3.2.15	No changes in this release.	N/A
3.2.14	Improvements - Vulnerability Definition records now include a "Remediation titles" attribute summarizing recommended and minimum remediation titles. - Hardened timestamp parsing for vulnerability and CVE fields so records with empty or malformed dates sync reliably.	N/A
3.2.13	No changes in this release.	N/A
3.2.12	No changes in this release.	N/A
3.2.11	Improvements - Vulnerability remediation details are now parsed more completely, capturing the full set of remediation entities (reference, title, action, link, and publication date) returned by Spotlight.	N/A
3.2.10	Improvements - Vulnerability recommendations now include the normalized product name for affected products, making the affected-software list clearer.	N/A
3.2.9	No changes in this release.	N/A
3.2.8	Improvements - Simplified how the vulnerability "Last found" date is determined: open vulnerabilities use the host's last-seen time (falling back to the sync time), and closed vulnerabilities use their closed timestamp.	N/A
3.2.7	No changes in this release.	N/A
3.2.6	Improvements - Refined the vulnerability "Last found" date for open findings to prefer the host's last-seen timestamp, improving the accuracy of aging and SLA calculations.	N/A
3.2.5	Improvements - The vulnerability "Last found" date now uses the host's last-seen timestamp when available, with sensible fallbacks for open and closed findings.	N/A
3.2.4	Improvements - Reverted the previous release's evaluation-logic change: vulnerabilities again expose the multi-valued "Evaluation logic" attribute populated from the evaluation logic identifiers.	• Vulnerability: the "Evaluation logic" attribute was re-keyed back to its prior form. Re-sync the connector to repopulate this attribute.
3.2.3	Improvements - Reworked how vulnerability evaluation logic is captured, replacing the "Evaluation logic" attribute with an "Evaluation results" attribute sourced from the detailed evaluation-logic API response.	• Vulnerability: the evaluation-logic attribute was renamed and re-sourced. Re-sync the connector to repopulate this attribute.
3.2.2	Improvements - Vulnerability "Last found" now uses the source updated timestamp, and Vulnerability Definition records use a more appropriate display ordering.	N/A
3.2.1	No changes in this release.	N/A
3.2.0	Improvements - The CrowdStrike Endpoint Security integration has been re-platformed onto its own dedicated connector as part of splitting the original CrowdStrike connector into focused products (Endpoint Security, Cloud Security, and SaaS Security). The Device, Vulnerability, Vulnerability Definition, and Evaluation Logic models, their identifiers, and their attributes are unchanged.	N/A
3.1.12	Improvements - Vulnerability hostnames are now stored in the multi-valued "Hostnames" attribute, and vulnerability targets are split to correctly handle CrowdStrike instances that report identifiers in a `customerID-agentID` format.	• Vulnerability: the host identifier was re-keyed from "Hostname" to the multi-valued "Hostnames" attribute. Re-sync the connector to repopulate these records.
3.1.11	New Features - Added a new Evaluation Logic model that synchronizes CrowdStrike Spotlight evaluation logic as its own records.	N/A
3.1.10	New Features - Vulnerability records now include an "Evaluation logic" attribute describing the affected products and the logic CrowdStrike used to evaluate each finding.	N/A
3.1.9	New Features - Vulnerability Definition records now include an "Evaluation logic" attribute summarizing affected products and CrowdStrike's evaluation logic.	N/A
3.1.8	New Features - Device and Vulnerability records now carry lifecycle information so the platform can automatically retire assets and findings that CrowdStrike has not reported recently (devices not seen in the last 7 days; vulnerabilities tied to their host's lifecycle). - Vulnerabilities now expose both the provider's raw status and a normalized connector status for consistent reporting across platform versions.	N/A
3.1.7	New Features - Vulnerability Definition records now include an "Affected" attribute.	N/A
3.1.6	Bug Fixes - The device "Device control policy ID" attribute is now stored as text (it was previously, incorrectly, typed as a true/false value).	• Device: the "Device control policy ID" attribute changed type from boolean to text. Re-sync the connector to repopulate device records.
3.1.5	No changes in this release.	N/A
3.1.4	Bug Fixes - Corrected the vulnerability "Last found" date to use the sync time consistently.	N/A
3.1.3	Bug Fixes - Fixed vulnerability recommendation text so it is generated correctly for all findings, including those without open affected products.	N/A
3.1.2	No changes in this release.	N/A
3.1.1	No changes in this release.	N/A
3.1.0	Improvements - Vulnerability and Vulnerability Definition records now resolve a single remediation URL, preferring the CrowdStrike link and falling back to the vendor URL when needed, and more reliably derive vulnerability and CVE identifiers.	N/A
3.0.24	Improvements - Vulnerability recommendation text now includes a dedicated "Remediation" section listing the remediation actions for the finding, and clarifies the affected/unaffected product version headings.	N/A
3.0.23	Improvements - Vulnerability results now clearly label affected versus unaffected product versions based on each product's status.	N/A
3.0.22	Improvements - Vulnerability Definition identifiers now support a configurable prefix (defaulting to `CSID`), making it easier to align definition UIDs with your environment. Bug Fixes - The vulnerability "Coarse score" and "Fine score" attributes are now stored as full-precision decimals instead of single-precision values.	• Vulnerability: the "Coarse score" and "Fine score" attributes changed type to double-precision decimals. Re-sync the connector to repopulate these records.
3.0.21	Improvements - Improved the vulnerability "Last found" date so open findings without an explicit last-found value fall back to the source updated timestamp or sync time.	N/A
3.0.20	Improvements - Device synchronization now uses CrowdStrike's scroll-based query endpoint for more reliable paging over large device populations. - Vulnerability Definition syncing now filters by the source updated timestamp for accurate incremental syncs.	N/A
3.0.19	Bug Fixes - The device "Last login user" attribute is now stored as text (it was previously, incorrectly, treated as a timestamp).	• Device: the "Last login user" attribute changed type from timestamp to text. Re-sync the connector to repopulate device records.
3.0.18	Improvements - Vulnerability Definitions are now streamed to the platform as they are discovered, reducing memory use and improving sync throughput.	N/A
3.0.17	New Features - Device records now include a broad set of additional attributes, including chassis type, connection IP and MAC, default gateway, kernel and OS build details, reduced-functionality mode, policy assignments, hostnames, IP addresses, login history, and last-started time.	N/A
3.0.16	No changes in this release.	N/A
3.0.15	Improvements - Improved formatting of the vulnerability results text describing affected product versions.	N/A
3.0.14	Improvements - Vulnerability records now populate "Source last modified", "Last found", and a normalized status category, improving finding aging and reporting accuracy.	N/A
3.0.13	Improvements - Temporary working data created during synchronization is now cleaned up automatically, preventing buildup of stale files between syncs.	N/A
3.0.12	Improvements - When the same CVE appears across multiple vulnerabilities, the connector now prioritizes data from open findings, and exposes the "ExPRT rating" on vulnerabilities.	N/A
3.0.11	New Features - Vulnerability Definition records now include a "Patch available" attribute indicating whether CrowdStrike reports an available remediation.	N/A
3.0.10	Improvements - Device hostnames are now normalized, and private DNS names are detected and stored in a dedicated attribute.	N/A
3.0.9	New Features - Device records now include a "Serial number" attribute. Improvements - Improved paging defaults and vulnerability storage handling for more reliable large syncs.	N/A
3.0.8	No changes in this release.	N/A
3.0.7	No changes in this release.	N/A
3.0.6	Improvements - Increased the default page size for faster synchronization, and improved parsing of remediation due dates and remediation details.	N/A
3.0.5	New Features - Added a configurable "Max retries" setting to control how many times API requests are retried on transient failures. Bug Fixes - Corrected configuration validation so the parallelism level is validated against the correct setting.	N/A
3.0.4	New Features - Device records now include an "Instance ID" attribute. Bug Fixes - Vulnerability Definition CVE identifiers are now populated from the correct CVE value.	N/A
3.0.3	Improvements - Vulnerability Definition identifiers are now prefixed with `CSID-` for consistency.	N/A
3.0.2	Improvements - Device synchronization now supports a configurable parallelism level and applies page-size and last-seen filters more efficiently for faster, more reliable syncs.	N/A
3.0.1	New Features - Vulnerability Definition records now include an "Exploitability" attribute (mapped from CrowdStrike's exploit status) and an "ExPRT rating" attribute. Improvements - Expired vulnerabilities are now excluded by default during synchronization.	N/A
3.0.0	Overview The CrowdStrike Endpoint Security connector integrates with the CrowdStrike Falcon platform to synchronize managed devices, their vulnerabilities, and vulnerability definitions sourced from CrowdStrike Spotlight. Category: Endpoint Protection Models	N/A

Data retrieved from CrowdStrike Endpoint Security​

Model relationships​

Connection settings​

Authentication​

Endpoint​

Request Headers​

Request Body​

Sample Response​

Response Fields​

Usage​

Sync Behavior​

Generate a CrowdStrike client secret​

Attribute mappings​

Operations & API​

Changelog​

Data retrieved from CrowdStrike Endpoint Security

Model relationships

Connection settings

Authentication

Endpoint

Request Headers

Request Body

Sample Response

Response Fields

Usage

Sync Behavior

Generate a CrowdStrike client secret

Attribute mappings

Operations & API

Changelog