CrowdStrike Falcon Spotlight Plugin for Risk Exchange

This document explains how to configure the CrowdStrike Falcon Spotlight v1.0.0 plugin with the Risk Exchange module of the Netskope Cloud Exchange platform. This plugin is used to fetch Vulnerabilities from the Exposure Management > Vulnerability Management > Vulnerabilities page in your CrowdStrike tenant. This plugin does not support any actions on Vulnerabilities in the CrowdStrike tenant.

Prerequisites

To configure this plugin, you need:

A Netskope tenant (or multiple, for example, production and development/test instances).
A Netskope Cloud Exchange instance with the Netskope Tenant and Risk Exchange plugin already configured.
CrowdStrike Falcon Spotlight platform access (Base URL, Client ID, Client Secret)
Connectivity to the following host: https://api.<region>.crowdstrike.com
If you have the IP allowlist configured on CrowdStrike, make sure to add the public IP of the machine where cloud exchange is running. For more information, refer to the documentation.

CrowdStrike Falcon Spotlight Plugin Support

This plugin is used to fetch Vulnerabilities from the Exposure Management > Vulnerability Management > Vulnerabilities page of the CrowdStrike tenant. This plugin does not support any actions on Vulnerabilities in CrowdStrike tenant.

Type of Data Pulled	Actions Supported
Vulnerabilities	No action

Mappings

Mapping will be used to view the pulled Vulnerabilities and their respective details. Mapped fields during plugin configuration will be visible on the Records page once the data is pulled. Below is the suggested mapping that should be used while configuring the plugin.

Pull Mapping for Vulnerabilities

Plugin Field Label	Expected Data Type	Suggested Field Label	Suggested Aggregate Strategy
ID	String	ID	Unique
AID	String	AID	Overwrite
Status	String	Status	Overwrite
Confidence	String	Confidence	Overwrite
Hostname	String	Hostname	Overwrite
Local IP	String	Local IP	Overwrite
Machine Domain	String	Machine Domain	Overwrite
Site Name	String	Site Name	Overwrite
Tags	List	Tags	Overwrite
Asset Criticality	String	Asset Criticality	Overwrite
Internet Exposure	String	Internet Exposure	Overwrite
Instance ID	String	Instance ID	Overwrite
Service Provider Account ID	String	Service Provider Account ID	Overwrite
Service Provider	String	Service Provider	Overwrite
Managed By	String	Managed By	Overwrite
Host Confidence	String	Host Confidence	Overwrite
CVE ID	String	CVE ID	Overwrite
CVE Base Score	Number	CVE Base Score	Overwrite
CVE Severity	String	CVE Severity	Overwrite
CVE Exploit Status	String	CVE Exploit Status	Overwrite
CVE ExPRT Rating	String	CVE ExPRT Rating	Overwrite
CVE Name	String	CVE Name	Overwrite
CVE Types	List	CVE Types	Overwrite
CVE Actors	List	CVE Actors	Overwrite
CVE Description	String	CVE Description	Overwrite
CVE Exploitability Score	Number	CVE Exploitability Score	Overwrite
CVE Impact Score	Number	CVE Impact Score	Overwrite
CVE Vector	String	CVE Vector	Overwrite

Note

If you have the same records across multiple plugins, make sure you map the same field in the plugins.

Permissions

You will need this permission to pull Users and Applications records: Vulnerabilities – Read access.

API Details

List of API Details

API Endpoint	Method	Use Case
/oauth2/token	POST	Generate Access Token
/spotlight/combined/vulnerabilities/v1	GET	Fetch Vulnerabilities

Generate Access Token

Endpoint: https://<BASE_URL>/oauth2/token

Method: POST

Headers:

Key	Value
User-Agent	netskope-ce-6.0.0-cre-crowdstrike-falcon-spotlight/1.0.0
Content-Type	application/x-www-form-urlencoded

Request Body:

Key	Value
grant_type	client_credentials
client_id	<Client ID>
client_secret	<Client Secret>

Sample Response

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expires_in": 1799,
  "token_type": "bearer"
}

Fetch Vulnerabilities

Endpoint: https://<BASE_URL>/spotlight/combined/vulnerabilities/v1

Method: GET

Headers:

Key	Value
User-Agent	netskope-ce-6.0.0-cre-crowdstrike-falcon-spotlight/1.0.0
Authorization	Bearer <access_token>

Query Parameters

Key	Value
limit	5000
facet	[“host_info”, “cve”]
sort	updated_timestamp.asc

Sample Response


{
    "meta": {
        "query_time": 0.47325536,
        "pagination": {
            "limit": 500,
            "total": 96128,
            "after": "next_page_token"
        },
        "powered_by": "spapi",
        "trace_id": "6120930d-fb71-45e6-b93b-b7e938d5bc22"
    },
    "resources": [
        {
            "id": "u:ip:a6dc46f29f9d952826910ea2baca3c1a4d1e857949b9f0e59f04c84e8d6c1f5e_bc5f0e094c76339fa2da49dac2943448",
            "cid": "c17f3a80ded0418eb107db3d26a27983",
            "aid": "c17f3a80ded0418eb107db3d26a27983_ASCB75xg0shOejrl80b5msNO4NpbjSrOX5OYPq_e34Yk1JUn2NDFbK0a",
            "vulnerability_id": "CVE-2023-48795",
            "data_providers": [
                {
                    "provider": "Falcon EASM"
                }
            ],
            "created_timestamp": "2025-10-16T02:08:07Z",
            "closed_timestamp": "2025-10-25T21:50:43Z",
            "updated_timestamp": "2025-10-25T21:50:54Z",
            "status": "closed",
            "apps": [
                {
                    "vendor_normalized": "Openbsd",
                    "product_name_version": "openssh 6.0",
                    "product_name_normalized": "openssh",
                    "sub_status": "closed",
                    "remediation": {},
                    "evaluation_logic": {
                        "id": ""
                    }
                }
            ],
            "suppression_info": {
                "is_suppressed": false
            },
            "services": [
                {
                    "port": 122,
                    "transport": "tcp",
                    "protocol": "ssh"
                }
            ],
            "confidence": "potential",
            "host_info": {
                "hostname": "54.193.116.198",
                "local_ip": "",
                "machine_domain": "",
                "os_version": "",
                "ou": "",
                "site_name": "",
                "system_manufacturer": "",
                "tags": [],
                "platform": "",
                "asset_criticality": "Unassigned",
                "internet_exposure": "Yes",
                "instance_id": "i-09d14923a29da1be3",
                "service_provider_account_id": "703303484057",
                "service_provider": "AWS",
                "third_party_asset_ids": [
                    "Falcon EASM: a6dc46f29f9d952826910ea2baca3c1a4d1e857949b9f0e59f04c84e8d6c1f5e"
                ],
                "managed_by": "Unmanaged",
                "confidence_label": "High",
                "subsidiaries": [
                    "Netskope"
                ],
                "host_last_seen_timestamp": "2025-10-15T00:00:00Z"
            },
            "remediation": {},
            "cve": {
                "id": "CVE-2023-48795",
                "base_score": 5.9,
                "severity": "MEDIUM",
                "exploit_status": 90,
                "exprt_rating": "CRITICAL",
                "cisa_info": {
                    "is_cisa_kev": false
                },
                "spotlight_published_date": "2023-12-19T11:39:00Z",
                "name": "Terrapin",
                "types": [
                    "Vulnerability"
                ],
                "actors": [
                    "COZY BEAR",
                    "LABYRINTH CHOLLIMA",
                    "SILENT CHOLLIMA"
                ],
                "cwes": [
                    "CWE-222"
                ],
                "description": "",
                "published_date": "2023-12-18T00:00:00Z",
                "vendor_advisory": [
                    "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MKQRBF3DWMWPH36LBCOBUTSIZRTPEZXB/"
                ],
                "references": [
                    "http://packetstormsecurity.com/files/176280/Terrapin-SSH-Connection-Weakening.html",
                    "http://seclists.org/fulldisclosure/2024/Mar/21"
                ],
                "exploitability_score": 2.2,
                "impact_score": 3.6,
                "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
            }
        },
        {
            "id": "09ea7af71597467089d06313b4fe337d_ce97718801cb38ef9d3d7908fd878ae4",
            "cid": "c17f3a80ded0418eb107db3d26a27983",
            "aid": "09ea7af71597467089d06313b4fe337d",
            "vulnerability_id": "CVE-2025-26634",
            "data_providers": [
                {
                    "provider": "Falcon sensor"
                }
            ],
            "created_timestamp": "2025-03-13T02:39:46Z",
            "updated_timestamp": "2025-03-13T02:39:46Z",
            "status": "open",
            "apps": [
                {
                    "vendor_normalized": "Microsoft",
                    "product_name_version": "Windows Server 2022",
                    "product_name_normalized": "Windows Server 2022",
                    "sub_status": "open",
                    "remediation": {
                        "ids": [
                            "07c271aa28eb328da300ebaf6afa625f"
                        ]
                    },
                    "evaluation_logic": {
                        "id": "eab3262f71893574b3ea99391191845c"
                    },
                    "remediation_info": {
                        "recommended_id": "07c271aa28eb328da300ebaf6afa625f"
                    }
                }
            ],
            "suppression_info": {
                "is_suppressed": false
            },
            "confidence": "confirmed",
            "host_info": {
                "hostname": "EC2AMAZ-32GSOEF",
                "local_ip": "172.31.19.16",
                "machine_domain": "",
                "os_version": "Windows Server 2022",
                "ou": "",
                "site_name": "",
                "system_manufacturer": "Xen",
                "tags": [],
                "platform": "Windows",
                "instance_id": "i-09d14923a29da1be3",
                "service_provider_account_id": "703303484057",
                "service_provider": "AWS",
                "os_build": "20348",
                "product_type_desc": "Server",
                "asset_criticality": "Unassigned",
                "internet_exposure": "No",
                "managed_by": "Falcon sensor"
            },
            "cve": {
                "id": "CVE-2025-26634",
                "base_score": 7.5,
                "severity": "HIGH",
                "exploit_status": 0,
                "exprt_rating": "HIGH",
                "remediation_level": "O",
                "cisa_info": {
                    "is_cisa_kev": false
                },
                "spotlight_published_date": "2025-03-12T17:23:00Z",
                "types": [
                    "Vulnerability"
                ],
                "cwes": [
                    ""
                ],
                "description": "Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges over a network.\n",
                "published_date": "2025-03-11T07:00:00Z",
                "vendor_advisory": [
                    "https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2025-26634",
                    "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26634"
                ],
                "exploitability_score": 1.6,
                "impact_score": 5.9,
                "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
            }
        },
        {
            "id": "280f4d789bcexxxxxxxxx9abcc3811914f",
            "cid": "0123456789ABCDEFGHIJKLMNOPQRSTUV-WX",
            "aid": "280f4d…2a7f7bbd",
            "vulnerability_id": "CVE-2025-26633",
            "data_providers": [
                {
                    "provider": "Falcon sensor"
                }
            ],
            "created_timestamp": "2025-06-03T00:38:46Z",
            "updated_timestamp": "2025-06-06T00:10:34Z",
            "status": "open",
            "apps": [
                {
                    "vendor_normalized": "Microsoft",
                    "product_name_version": "Windows Server 2012 R2",
                    "product_name_normalized": "Windows Server 2012 R2",
                    "sub_status": "open",
                    "remediation": {
                        "ids": [
                            "91b4ee1abe763150a74150dfddf93840"
                        ]
                    },
                    "evaluation_logic": {
                        "id": "9b022daf26493769863d5a22be528b9b"
                    },
                    "remediation_info": {
                        "recommended_id": "91b4ee1abe763150a74150dfddf93840",
                        "minimum_id": "ec48482667043f9e9578742143ed29bf",
                        "patch_publication_date": "2025-03-11T00:00:00Z"
                    },
                    "patch_publication_date": "2025-03-11T00:00:00Z"
                }
            ],
            "suppression_info": {
                "is_suppressed": false
            },
            "confidence": "confirmed",
            "app": {
                "vendor_normalized": "Microsoft",
                "product_name_version": "Windows Server 2012 R2",
                "product_name_normalized": "Windows Server 2012 R2"
            },
            "cve": {
                "id": "CVE-2025-26633",
                "base_score": 7,
                "severity": "HIGH",
                "exploit_status": 90,
                "exprt_rating": "CRITICAL",
                "remediation_level": "O",
                "cisa_info": {
                    "is_cisa_kev": true,
                    "due_date": "2025-04-01T00:00:00Z"
                },
                "spotlight_published_date": "2025-03-12T17:23:00Z",
                "name": "MSC EvilTwin",
                "types": [
                    "Vulnerability"
                ],
                "cwes": [
                    ""
                ],
                "description": "CVE-2025-26633 is a security feature bypass vulnerability (CWE-1023) in Microsoft Management Console due to improper neutralization of input.",
                "published_date": "2025-03-11T07:00:00Z",
                "vendor_advisory": [
                    "https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2025-26633"
                ],
                "references": [
                    "https://www.vicarius.io/vsociety/posts/cve-2025-26633-security-feature-bypass-in-microsoft-management-console-detection-script"
                ],
                "exploitability_score": 1,
                "impact_score": 5.9,
                "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
            },
            "host_info": {
                "hostname": "CsFlows_win_280f4d789bce47a28e3769052a7f7bbd",
                "local_ip": "222.116.81.67",
                "machine_domain": "nelsonosborn.com",
                "os_version": "Windows 10",
                "ou": "chase79",
                "site_name": "desktop-66.maxwell.org",
                "system_manufacturer": "CsFlows System Manufacturer Inc",
                "groups": [
                    {
                        "id": "7023064081fa41578f00c5f6f8aaeba0",
                        "name": "CsFlows_win"
                    }
                ],
                "tags": [
                    "SensorGroupingTags/main/tags",
                    "SensorGroupingTags/wp-content/explore"
                ],
                "platform": "Windows",
                "os_build": "17134",
                "product_type_desc": "Workstation",
                "asset_criticality": "Unassigned",
                "internet_exposure": "No",
                "managed_by": "Falcon sensor",
                "host_last_seen_timestamp": "2025-06-03T00:00:00Z"
            }
        }
    ]
}

Performance Matrix

Here is the performance matrix conducted on a Large Cloud Exchange stack with these specifications by pulling 500k Vulnerabilities.

Description	Specification
Stack Size	Large RAM: 32 GB Cores: 16
Time taken to store the pulled and updated device records	~9 mins

User Agent

netskope-ce-6.0.0-cre-crowdstrike-falcon-spotlight/1.0.0

Workflow

Get your Client ID and Client Secret in CrowdStrike.
Configure the CrowdStrike Falcon Spotlight plugin.
Add a Business Rule for CrowdStrike Falcon Spotlight.
Add an Action for CrowdStrike Falcon Spotlight.
Validate the CrowdStrike Falcon Spotlight plugin.

Watch a Video

Click play to watch a video.

Get your Client ID and Client Secret from CrowdStrike Platform

Log in to CrowdStrike and go to menu Icon > Support and resources > API clients and Keys.
Click Add new API Client.
Add the following scopes for using the CrowdStrike plugin:
API Scopes Permissions

Scope

Read

Write

Vulnerabilities

Yes

–

Make a Note of the Client ID and Secret.

Configure the CrowdStrike Falcon Spotlight Plugin

In Cloud Exchange, go to Settings > Plugin Store. Search for and select the CrowdStrike Falcon Spotlight v1.0.0 (CRE) plugin box.
Add a plugin configuration name and change sync interval if needed.
Click Next and enter the Configuration Parameters:
- Base URL: Base URL of CrowdStrike instance (like https://api.crowdstrike.com).
- Client ID: Client ID generated in CrowdStrike.
- Client Secret: Client Secret generated in CrowdStrike.
- Initial Range (in days): Number of days to pull the data for the initial run. Value must be between 0 and 200.
Click Next and select the Entity from the Entity dropdown. The Entity fields can be created from the Schema Editor page or using + Add Field from the field dropdown. Provide the field mappings. For the suggested mapping, refer to ‘Mapping’.

Note

The ID field is required to pull the Vulnerabilities.
Click Save.

Add a Risk Exchange Business Rule for CrowdStrike Falcon Spotlight

In Risk Exchange, go to Business Rules and click Create New Rule.
Enter a Rule Name and select the Entity in which the user records are stored, and configure the query based on your requirements.
Click Save.

Add a Risk Exchange Action for CrowdStrike Falcon Spotlight

CrowdStrike Falcon Spotlight supports the No Action action type.

No Action

No action will be performed for this action. You can generate UBA alerts in Ticket Orchestrator by using this action and enabling the Generate Alerts toggle.

Note

You can perform the actions on the users and vulnerabilities of hosts pulled from CrowdStrike Falcon Spotlight on the Netskope Tenant.

In Risk Exchange, go to Actions and click Add Action Configuration.
Select a Business rule, Configuration (name of your configured plugin).
For Actions, select No actions and enable the Generate Alert toggle to generate alerts in the Ticket Orchestrator module.
Enable the Require Approval toggle if Approval is needed before performing action on the Users.
Click Save.

Validate the CrowdStrike Falcon Spotlight Plugin

Validate in Cloud Exchange

To validate the pulling:

In Risk Exchange go to Records. Select the Entity that was used while configuring the field mapping for Vulnerabilities to view the pulled data from the plugin.

Go to Logging and search for the logs of the plugin.

When a record matches one of the configured business rules, the configured action will be performed on the vulnerabilities of hosts. This can be seen in Action Logs.

Validate in CrowdStrike Falcon Spotlight

To verify the Users for pulling from CrowdStrike, note that vulnerability details are pulled from Exposure Management > Vulnerability Management > Vulnerabilities in the CrowdStrike tenant.

Troubleshooting the CrowdStrike Falcon Spotlight Plugin

Unable to configure the CrowdStrike Falcon Spotlight plugin.

If you are unable to configure the CrowdStrike Falcon Spotlight plugin, it could be due to one of these reasons:

Provided the incorrect Client ID or Client Secret.
Provided Credentials that don’t have sufficient permissions.

What to do:

To get the Client ID and Client Secret, follow these steps.
To provide proper permissions to the configuration parameter, refer to steps .

Receiving 403 forbidden error while configuring the plugin

If you are receiving a 403 error, it could be due to one of these reasons:

Check if the provided Client ID and Client Secret values are correct.
The API client has proper permissions.
Check if you have proper permissions provided to the API Client.
You have IP groups added in the IP Allowlist Management page.

To add your Cloud Exchange’s public IP to CrowdStrike’s IP allowlist:

On your CrowdStrike tenant, go to Host setup and management > Falcon users > IP Allowlist Management and check if any IP groups are added. If added, it will be listed on the page. If not, your screen will look as below. Follow these steps in case you have the IP groups added in the IP Allowlist Management page.
If you have some IP allowlist groups configured on your CrowdStrike tenant, make sure to add the Public IP Address of the virtual machine where Cloud Exchange is running into an existing group, or you can create a new IP allowlist Group. While adding that, make sure you have the API Access Type selected.

Unable to pull Vulnerabilities

If you are unable to pull Vulnerabilities from the CrowdStrike Falcon Spotlight plugin, it could be due to one of these reasons:

No Vulnerabilities are present on the CrowdStrike Falcon Spotlight platform.
An error is received while pulling Vulnerabilities from the platform.
Mapping is not added while configuring the plugin in the entity source page.

What to do:

Check on the CrowdStrike Falcon Spotlight platform if Vulnerabilities exist or not.
Receiving 500 error: The server might be down, wait for a while and check later.
Receiving 403 error: The plugin configuration parameter does not have sufficient permissions or the credentials no longer exist. Verify the permission for the Client ID and Secret.
If there is no error in the logs, it might be the case that the Vulnerabilities are not available on the Platform to pull. Check the Device available on CrowdStrike Falcon Spotlight and confirm the same.
Make sure that the mapping is added and the Device ID field was mapped while configuring the plugin.

Unable to View Vulnerabilities details on the Records page

If you are unable to view Vulnerabilities details on the Records table, it could be due to the mapping for all the CrowdStrike Falcon Spotlight fields were not provided while configuring the CrowdStrike Falcon Spotlight plugin.

What to do:

Check on the CrowdStrike Falcon Spotlight platform if Vulnerabilities exist or not.
Receiving 500 error: The server might be down, wait for a while and check later.
Receiving 403 error: The plugin configuration parameter does not have sufficient permissions or the credentials no longer exist. Verify the permission for the Client ID and Secret.
If there is no error in the logs, it might be the case that the Vulnerabilities are not available on the Platform to pull. Check the Device available on CrowdStrike Falcon Spotlight and confirm the same.
Make sure that the mapping is added and the Device ID field was mapped while configuring the plugin.