About this document
This document outlines how the integration extracts security signals from CrowdStrike to inform risk scoring, mitigation efficacy, and control health.
Data Ingestion Overview
The integration synchronizes data across three primary CrowdStrike modules to build a multi-dimensional view of an asset's security posture:
Falcon (Host Management): Ingests the baseline inventory, including asset metadata, organizational context, and the status of security policies.
Spotlight (Vulnerability Management): Provides high-fidelity vulnerability intelligence, including CVE IDs, remediation status, and exploitability signals.
Discover (Asset Inventory): Serves as a secondary inventory source for installed applications and their corresponding versions across the environment.
Constraints: API Support & Intelligent Fallback
Visibility is governed by the permissions (scopes) assigned to the API token. The integration is designed with a hierarchical fallback mechanism to ensure no asset remains a "blind spot."
Spotlight Priority: The system first attempts to retrieve deep vulnerability intelligence via the Spotlight API.
Permission Fallback: If the API token lacks Spotlight permissions (e.g., access is denied), the integration automatically pivots to the Discover API.
Visibility Guarantee: This ensures that even if granular vulnerability data is blocked, the platform still maintains a baseline inventory of installed software for exposure analysis.
Logic: Control Visibility via Tags
Configurations and operational states are converted into Tags. These tags act as dynamic signals that describe the current enforcement state and "health" of the security control.
Signal Description | Tag Prefix / Result |
|---|---|
Applied state of the Prevention (blocking) policy |
|
Applied state of the host-based Firewall policy |
|
Applied state of the Remote Response (RTR) policy |
|
Agent is in Reduced Functionality Mode (RFM) |
|
Current state of Real-Time Response (RTR) |
|
Current Provision Status of the sensor |
|
Human-readable name of the Host Group |
|
Name of the geographical or logical Site |
|
Active Directory Organizational Unit (OU) membership |
|
Any custom tags applied within the CrowdStrike console | (Raw Tags) |
Risk & Vulnerability Scoring Influence
The presence of CrowdStrike EDR on an asset inherently influences risk scoring, independent of manual tag configurations:
Native EDR Efficacy: The Balbix risk model recognizes the presence of an active EDR (such as CrowdStrike) as a significant mitigation factor. This automatically applies a reduction to the risk score of associated vulnerabilities/findings on the asset, as the EDR acts as a functional control against exploitation.
Manual Risk Mapping: By default, Balbix does not automatically use the specific configuration tags for calculation. However, users can manually map these tags (e.g., Prevention: Applied) via the Tag Manager to influence Impact Level or Asset Zone.
Attribute Mapping: Tags can be mapped to core device attributes such as Asset Type, Operating System Platform, or Business Unit to provide deeper context for risk prioritization.
Targeted Corrective Actions & Asset Grouping
Users can leverage these tags to perform security operations and align with corporate EDR deployment policies:
Identification of Gaps: Filter for assets where the "CrowdStrike Falcon" agent is present but specific operational states (e.g., Prevention: Not Applied) indicate a configuration gap.
Custom Asset Groups: Create dynamic groups based on operational states (e.g., all assets in Reduced Functionality Mode). These groups can be assigned varying levels of prioritization, allowing teams to focus on fixing control health issues on high-value assets first.
CrowdStrike as an EDR: Always-On Inventory
A core principle of the integration is ensuring that the CrowdStrike Falcon agent itself is represented as a managed security control within the software inventory.
Always Pulled: As long as a device record is retrieved via the Falcon or Discover APIs, a software entry named "CrowdStrike Falcon" is automatically created for that asset.
Mode Agnostic: This software entry is generated regardless of whether the agent is in Protect or Detect mode. While the specific mode is captured via tags (as shown in the table above), the presence of the EDR is always recorded in the software inventory.
Version Fidelity: The system directly maps the specific agent version to this software entry, enabling the platform to identify outdated sensors or assets with degraded protection versions.