---
title: "CrowdStrike Connector Guide"
slug: "crowdstrike-v2"
updated: 2026-10-22T15:02:22Z
published: 2026-10-22T15:02:22Z
canonical: "docs.safe.security/crowdstrike-v2"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safe.security/llms.txt
> Use this file to discover all available pages before exploring further.

# CrowdStrike Connector Guide

## **Overview**

CrowdStrike provides unified endpoint security via next-generation antivirus, EDR, vulnerability management (Spotlight), and software inventory and asset intelligence (Discover).

The Balbix–CrowdStrike connector is a consolidated integration that ingests data across the following modules using CrowdStrike APIs:

- Falcon EDR (Endpoint Detection & Response)
- Spotlight VM (Vulnerability Management)
- Discover (Asset Inventory & Software Visibility)

Balbix automatically identifies which of these modules are licensed and accessible based on your API credentials and permissions, streamlining the onboarding process.

## **How Balbix processes CrowdStrike data**

Balbix leverages its AI pipeline to:

- **Aggregate** and ingest data from CrowdStrike Falcon, Spotlight, and Discover.
- **Normalize** and map metadata (e.g., OS, software, network info) to a unified schema.
- **Deduplicate** overlapping or redundant asset records across tools.
- **Classify** each asset according to the Enterprise Asset Classification Model.

Balbix generates insights for:

**Deployment Gap Analysis**: Identify assets without proper protection or lacking software visibility.

**Risk-Based Prioritization**: Rank vulnerabilities by business and operational impact.

**Risk Quantification**: Compute asset- and enterprise-level cyber risk metrics.

## Integration summary

This table provides a summary of the Balbix integration for the CrowdStrike connector.

| **Item** | **Description** |
| --- | --- |
| **Integration Type** | Inbound API (Fetch) |
| **Supported APIs** | Falcon Host APIs, Spotlight APIs, Discover APIs |
| **Modules Covered** | Falcon EDR, Spotlight VM, Discover |
| **Auto Module Detection** | Yes – Balbix detects module availability & access via API scopes |
| **Asset Types Fetched** | Servers, VMs, desktops, laptops |
| **Data Classification** | Based on Enterprise Asset Classification Taxonomy |

## Types of Data Fetched

This table provides a summary of the data fetched by the connector

| **Source** | **Data Ingested** |
| --- | --- |
| **Falcon** | Host metadata (hostname, MAC, IP, OS, BIOS, agent version), timestamps, tags, system state |
| **Spotlight** | Vulnerability data: CVE ID, severity, exploitability, detection timestamps, affected software, remediation state |
| **Discover** | Installed software inventory, application version, vendor/product, first/last seen, installation path, and runtime presence |

## Prerequisites

To configure the Balbix connector, you must first create CrowdStrike API credentials with the appropriate permissions. These credentials are required for completing the configuration process.

**API key**

Create API clients to grant various levels of API access for different purposes.

1. On the API Clients and Keys page ( Support and resources > Resources and tools > API Clients and Keys ), click Create API client.
2. Enter details to define your API client:
  1. Client Name (required)
  2. Description (optional)
  3. API Scopes (required):
    1. Select the Read and/or Write boxes next to a scope to enable access to its endpoints.
    2. At least one scope must be assigned.
    3. Only required scopes are requested per module (e.g., read:hosts, read:vulnerabilities, read:discover).
3. Click Create to save the API client and generate the client ID and secret.

> [!WARNING]
> **Note**: Record your API client secret somewhere safe. After the credential window is closed, the secret is no longer visible.

## Set up your CrowdStrike connector

After completing the prerequisites, follow these steps to configure your Balbix connector for CrowdStrike.

[Embedded content](https://scribehow.com/embed/CrowdStrike_Connector_Guide__KA_FhrvcQfyRSRjNUocnwQ?as=scrollable)

## Asset Classification in Balbix

Assets fetched via CrowdStrike are automatically categorized using Balbix’s unified asset model:

| **CrowdStrike Asset** | **Classification** |
| --- | --- |
| EC2 or Azure/GCP VM | Server → Cloud Virtual Machine |
| On-prem managed server | Server → Physical Server |
| Laptop/Desktop | End User Compute → Physical Workstation |
| Installed software (Discover) | Software Inventory mapped to vendor/product/version |

## Security and Governance

- Credentials are encrypted at rest and during transmission.
- Only required scopes are requested per module (e.g., read:hosts, read:vulnerabilities, read:discover).
- API access is auditable in Balbix.

## API Documentation Links

[CrowdStrike Developer Center](https://developer.crowdstrike.com/)