CrowdStrike Falcon — Integration Setup
Prerequisites
- CrowdStrike Falcon subscription (any tier)
- Falcon console admin access to create API clients
- CMDash Essentials tier or above
How authentication works
CrowdStrike connects with an OAuth 2.0 client-credentials pair (client ID + secret) from an API client you create in your own Falcon console. The connection stores that pair: the client ID as a plain setting and the secret encrypted (never shown again, erased when you disconnect). CMDash never uses one shared Falcon client for several organizations.
- CMDash Cloud (hosted): you enter your own client ID and secret on the connection (Step 2).
- Self-hosted on a licensed install (on-prem / customer-AWS): you may enter them on the
connection too; a connection made before this change that has none keeps using the deployment's
CROWDSTRIKE_CLIENT_ID/CROWDSTRIKE_CLIENT_SECRET, and only on those installs.
Today the connector only talks to CrowdStrike's US-1 cloud (https://api.crowdstrike.com); it
does not offer a region selector for US-2, EU-1 or US-GOV-1.
Step 1: Create an API Client (Falcon admin)
- Log in to Falcon Console
- Go to Support and resources → API clients and keys
- Click Create API client
- Name:
CMDash Integration - Description:
Read-only access for CMDash posture scoring - Assign the following Read scopes:
- Hosts — Read device inventory
- Spotlight Vulnerabilities — Read vulnerability assessments
- Detections — Read detection summaries
- Click Create
- Copy the Client ID and Client Secret (the secret is shown once).
Step 2: Connect in CMDash
- Navigate to Integrations in your CMDash dashboard
- Find CrowdStrike Falcon and click Connect
- Enter the API client ID and API client secret from Step 1
- Click Connect — CMDash requests a token as your client and the connection goes active only if that token works. To revoke access, delete the API client in the Falcon console (and disconnect here, which erases the stored secret).
What Syncs
| Data Type | Falcon API | Sync Frequency |
|---|---|---|
| Devices | /devices/queries/devices/v1 + /devices/entities/devices/v2 | Every 4 hours by default |
| Vulnerabilities | /spotlight/queries/vulnerabilities/v1 | Every 4 hours by default |
| Detections | /detects/queries/detects/v1 + /detects/entities/summaries/GET/v1 | Every 4 hours by default |
Troubleshooting
- 401 Unauthorized: the client ID or secret is wrong, or the API client was revoked; create a new client in the Falcon console and reconnect
- 403 Forbidden: verify the API client has the required read scopes listed above
- Empty device list: ensure the Falcon sensor is deployed to at least one host
- Rate limiting (429): CrowdStrike enforces per-client rate limits; CMDash uses batched requests to stay within limits
Rate Limits & Sync Behavior
| Setting | Value |
|---|---|
| Sync frequency | Every 4 hours by default (configurable per integration) |
| First sync | Historical data pulled on initial connection (devices and vulnerabilities back to account creation) |
| Rate limit handling | Per-(tenant, provider) token bucket; requests are batched and rate-limited automatically |
| 429 handling | Exponential backoff triggered; sync rescheduled automatically |
| Vendor rate limit | 100 req/min for most endpoints |
| CMDash batch size | 100 assets per request |
| Failed sync retry | Dead-letter queue — see docs/developers/dead-letter.md |
CrowdStrike enforces per-client rate limits. CMDash batches device and vulnerability queries in chunks of 100 and spreads requests evenly across the sync window. If a 429 is returned, CMDash reads the X-RateLimit-RetryAfter header, backs off exponentially, and reschedules the affected sync slice without blocking other integrations.
Credential Rotation
CrowdStrike API client secrets do not expire, but CMDash recommends rotating them quarterly following the principle of least privilege. The secret is stored on your connection, so rotating it is an edit of that connection.
To rotate:
- Log in to the Falcon console and create a new API client (or regenerate the secret on the existing one).
- Copy the new Client Secret.
- In CMDash, edit the connection and paste the new secret (the field shows a mask; leaving the mask keeps the stored value).
- The next token renewal uses the new credential; the old secret is no longer used.
Note: CrowdStrike secrets have no expiry, so set a calendar reminder for quarterly rotation.
Multiple Instances / Multi-Site
Because the Falcon API client is configured once for the whole deployment (see "How authentication works" above), CMDash supports connecting to a single CrowdStrike Customer ID (CID) today. If your organization uses multiple CIDs — for example, separate CIDs for different business units or regions — only one can be connected per CMDash deployment at this time.
Compliance Framework Coverage
The CrowdStrike integration provides evidence for the following controls. Coverage is automatically mapped when data is synced.
| Framework | Control | Description |
|---|---|---|
| PCI DSS | 11.3 | Vulnerability scanning — Spotlight data satisfies internal scan evidence |
| PCI DSS | 6.2 | Patch management — device patch posture derived from Spotlight and host data |
| PCI DSS | 10.2 | Event log monitoring — Falcon Detection summaries mapped to log review evidence |
| HITRUST | 09.ab | Monitoring system use — Detection and device telemetry |
| HITRUST | 10.m | Patch management — Spotlight vulnerability age and remediation status |
| CMMC L2 | SI.1.210 | System monitoring — continuous endpoint telemetry via Falcon sensor |
| CMMC L2 | SI.1.213 | Security alerts — Detection summaries mapped to alert evidence |
| SOC 2 | CC7.1 | Threat detection — Falcon detections feed the threat-detection evidence bucket |
| SOC 2 | CC7.2 | Anomaly identification — behavioral detections from Falcon mapped to anomaly evidence |