---
title: CrowdStrike Falcon Spotlight Connector Guide
slug: rbvm-help/crowdstrike-falcon-spotlight-connector-guide
createdAt: 2026-10-26T13:51:22.379Z
---

**Summary**: How to set up and use the CrowdStrike Falcon Spotlight connector in Ivanti Neurons RBVM/ASPM/VULN KB.

## Overview

CrowdStrike Falcon Spotlight offers security teams an assessment of vulnerability exposure on their endpoints that is always current. Falcon Spotlight's native integration into the CrowdStrike Falcon platform enables customers to operate vulnerability management within a complete endpoint protection framework.

The Ivanti Neurons RBVM/ASPM/VULN KB platform provides an API-based connector that integrates with CrowdStrike Falcon Spotlight, enabling customers to bring in their findings. It allows customers to gain visibility into their overall risk due to vulnerabilities in their endpoint and a more straightforward, more efficient way to manage those vulnerabilities.

## User Prerequisites/CrowdStrike Falcon Spotlight Setup

CrowdStrike Falcon Spotlight is a cloud-based solution.

- Requires a subscription to CrowdStrike Falcon Spotlight.
- Requires a user account with API access and can read asset data along with their associated vulnerabilities.

## CrowdStrike Falcon Spotlight Connector API Calls

The following API calls are performed during a connector run to pull vulnerabilities from CrowdStrike Falcon Spotlight into Neurons RBVM/ASPM/VULN KB.

| **API Type**                                 | **Endpoint**                                                       |
| -------------------------------------------- | ------------------------------------------------------------------ |
| Authentication                               | https\://api.crowdstrike.com/oauth2/token                          |
| Fetch List of AgentIds                       | https\://api.crowdstrike.com/devices/queries/devices/v1            |
| Fetch detailed information about each Host   | https\://api.crowdstrike.com/devices/entities/devices/v1?ids=      |
| Fetch the list of Vulnerabilities            | https\://api.crowdstrike.com/spotlight/queries/vulnerabilities/v1  |
| Fetch the list of Vulnerabilities in detail  | https\://api.crowdstrike.com/spotlight/entities/vulnerabilities/v2 |
| Fetch the Remediation for each Vulnerability | https\://api.crowdstrike.com/spotlight/entities/remediations/v2    |

## Configuring CrowdStrike Falcon Spotlight Connector in Neurons RBVM/ASPM/VULN KB

Navigate to the **Automate > Integrations** page.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/N6T9UnB5FOanUDKWj7uEe_palo-alto-xpanse-expander.png" alt="Navigation - Automation - Integrations" position="flex-start" size="33" width="229" height="151" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander.png" showCaption="false"}

Using the search bar in the upper-right corner of the **Integrations** page, type **Falcon** to find the connector.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/XDeBJuohFFoBMSDiGhKrN_crowdstrike-falcon-spotlight.png" alt="Crowdstrike Connector - Search for Connector" position="flex-start" size="98" width="687" height="134" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/CrowdStrike Falcon Spotlight.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/CrowdStrike Falcon Spotlight.png" showCaption="false"}

Locate the **CrowdStrike Falcon Spotlight **card on the page and click **Configuration**.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/tymi7M3zDY8G75n8Zk0bc_crowdstrike-falcon-spotlight1.png" alt="Crowdstrike Connector - Configuration Button Location" position="flex-start" size="34" width="240" height="248" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/CrowdStrike Falcon Spotlight_1.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/CrowdStrike Falcon Spotlight_1.png" showCaption="false"}

In the new window under **Connection**, complete the required fields, as described below.

- **Name**: The connector’s name.
- **URL**: The URL to access CrowdStrike Falcon Spotlight API https\://api.crowdstrike.com.
- **Client Id**: One-half of an API client's authentication credentials. Similar to a username.
- **Client Secret**: The other half of an API client's authentication credentials. Similar to a password.
- **SSL**: Optional instance SSL certificate in base64 format.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/EuBv9WJG9FiECcO0Z42R5_crowdstrike-falcon-spotlight2.png" alt="Crowdstrike Connector - Connection Window" position="flex-start" size="61" width="427" height="466" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/CrowdStrike Falcon Spotlight_2.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/CrowdStrike Falcon Spotlight_2.png" showCaption="false"}

Click the **Test Credentials** button to ensure the credentials are correct and have the necessary access to make CrowdStrike Falcon Spotlight API calls.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/HGzMAj0PmqgKYqAulZwW__palo-alto-xpanse-expander4.png" alt="Crowdstrike Connector - Test Credentials" position="flex-start" size="28" width="195" height="136" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander_4.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/Palo Alto Xpanse Expander_4.png" showCaption="false"}

Under Schedule, you can configure the desired schedule for the connector to retrieve results from the CrowdStrike Falcon Spotlight instance.

Users can optionally turn on **Enable auto URBA (Update Remediation by Assessment)**.

On marking the **Create Assets that do not have vulnerabilities** options, RiskSense will create applications with zero findings. This option is selected by default, and the user can opt to turn it off.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/9Rm-yeJB_wlY7_AryO1D0_crowdstrike-falcon-spotlight3.png" alt="Crowdstrike Connector - Schedule Section" position="flex-start" size="78" width="543" height="299" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/CrowdStrike Falcon Spotlight_3.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/CrowdStrike Falcon Spotlight_3.png" showCaption="false"}

Click the **Save** button to save the connector’s configuration and create the connector. Once saved, the connector is now visible on the **Integrations** page under **Currently Configured Integrations**.

Clicking the **History** button displays the connector details for each pull. The **Sync** button allows users to perform on-demand sync. The **Edit** button allows the user to edit the connector configuration. The **Delete** button allows the user to delete the connector.

::Image[]{src="https://api.archbee.com/api/optimize/9rfvxhrv8FA-8bxcK2IRv/6wqC4MTuQL6_Jr8v9J9Wv_crowdstrike-falcon-spotlight4.png" alt="Crowdstrike Connector - Configured Connector" position="flex-start" size="33" width="231" height="277" initialPath="Resources/Images/RS KB Mirror for Ivanti - 2022/CrowdStrike Falcon Spotlight_4.png" githubPath="RBVM_14.70_help/Resources/Images/RS KB Mirror for Ivanti - 2022/CrowdStrike Falcon Spotlight_4.png" showCaption="false"}

Once files have been processed on the Uploads page, view the ingested data by navigating to the **Hosts** and **Host Findings** pages.

## Mapping CrowdStrike Falcon Spotlight fields in Neurons RBVM/ASPM/VULN KB

This table showcases the high-level mapping of CrowdStrike Falcon Spotlight API fields in Neurons RBVM/ASPM/VULN KB.

| **Neurons** **RBVM/ASPM/VULN KB Fields** | **CrowdStrike Fields**                         |
| ---------------------------------------- | ---------------------------------------------- |
| AgentId                                  | resources -> device\_id                        |
| Scanner Severity                         | resources -> cve -> severity                   |
| Scanner Plugin                           | resources -> cve -> id                         |
| Possible Solution                        | resources -> remediation                       |
| Plugin Instance Id                       | resources -> id                                |
| Plugin Source Status                     | resources -> status                            |
| Remediation ID                           | resources → remediation → ids                  |
| Remediation URL                          | resources → remediation → entities → link      |
| Remediation Title                        | resources → remediation → entities → title     |
| Remediation Reference                    | resources → remediation → entities → reference |
| Remediation Action                       | resources → remediation → entities → action    |

### Neurons RBVM/ASPM/VULN KB Tags

The following fields from CrowdStrike Falcon Spotlight APIs are converted into Neurons RBVM/ASPM/VULN KB tags. Use these tags for searching, playbook automation, and better visualization in Neurons RBVM/ASPM/VULN KB Dashboards.

- resources -> tags
- resources -> ou

### Common Fields in Neurons RBVM/ASPM/VULN KB

The following fields in Neurons RBVM/ASPM/VULN KB are defined for CrowdStrike Falcon Spotlight, along with their default values.

- The Scanner Name will be **FalconSpotlight**.