Overview
CrowdStrike provides unified endpoint security via next-generation antivirus, EDR, vulnerability management (Spotlight), and software inventory and asset intelligence (Discover).
The Balbix–CrowdStrike connector is a consolidated integration that ingests data across the following modules using CrowdStrike APIs:
Falcon EDR (Endpoint Detection & Response)
Spotlight VM (Vulnerability Management)
Discover (Asset Inventory & Software Visibility)
Balbix automatically identifies which of these modules are licensed and accessible based on your API credentials and permissions, streamlining the onboarding process.
How Balbix processes CrowdStrike data
Balbix leverages its AI pipeline to:
Aggregate and ingest data from CrowdStrike Falcon, Spotlight, and Discover.
Normalize and map metadata (e.g., OS, software, network info) to a unified schema.
Deduplicate overlapping or redundant asset records across tools.
Classify each asset according to the Enterprise Asset Classification Model.
Balbix generates insights for:
Deployment Gap Analysis: Identify assets without proper protection or lacking software visibility.
Risk-Based Prioritization: Rank vulnerabilities by business and operational impact.
Risk Quantification: Compute asset- and enterprise-level cyber risk metrics.
Integration summary
This table provides a summary of the Balbix integration for the CrowdStrike connector.
Item | Description |
Integration Type | Inbound API (Fetch) |
Supported APIs | Falcon Host APIs, Spotlight APIs, Discover APIs |
Modules Covered | Falcon EDR, Spotlight VM, Discover |
Auto Module Detection | Yes – Balbix detects module availability & access via API scopes |
Asset Types Fetched | Servers, VMs, desktops, laptops |
Data Classification | Based on Enterprise Asset Classification Taxonomy |
Types of Data Fetched
This table provides a summary of the data fetched by the connector
Source | Data Ingested |
Falcon | Host metadata (hostname, MAC, IP, OS, BIOS, agent version), timestamps, tags, system state |
Spotlight | Vulnerability data: CVE ID, severity, exploitability, detection timestamps, affected software, remediation state |
Discover | Installed software inventory, application version, vendor/product, first/last seen, installation path, and runtime presence |
Prerequisites
To configure the Balbix connector, you must first create CrowdStrike API credentials with the appropriate permissions. These credentials are required for completing the configuration process.
API key
Create API clients to grant various levels of API access for different purposes.
On the API Clients and Keys page ( Support and resources > Resources and tools > API Clients and Keys ), click Create API client.
Enter details to define your API client:
Client Name (required)
Description (optional)
API Scopes (required):
Select the Read and/or Write boxes next to a scope to enable access to its endpoints.
At least one scope must be assigned.
Only required scopes are requested per module (e.g., read:hosts, read:vulnerabilities, read:discover).
Click Create to save the API client and generate the client ID and secret.
Note: Record your API client secret somewhere safe. After the credential window is closed, the secret is no longer visible.
Set up your CrowdStrike connector
After completing the prerequisites, follow these steps to configure your Balbix connector for CrowdStrike.
Asset Classification in Balbix
Assets fetched via CrowdStrike are automatically categorized using Balbix’s unified asset model:
CrowdStrike Asset | Classification |
EC2 or Azure/GCP VM | Server → Cloud Virtual Machine |
On-prem managed server | Server → Physical Server |
Laptop/Desktop | End User Compute → Physical Workstation |
Installed software (Discover) | Software Inventory mapped to vendor/product/version |
Security and Governance
Credentials are encrypted at rest and during transmission.
Only required scopes are requested per module (e.g., read:hosts, read:vulnerabilities, read:discover).
API access is auditable in Balbix.