CrowdStrike Integration with DefectDojo

CrowdStrike Falcon Integration with DefectDojo

CrowdStrike Falcon is CrowdStrike's endpoint security platform, built on a lightweight sensor installed on each host. Falcon Spotlight is its vulnerability management module: it uses the software inventory the sensor already collects to report CVEs on each host without running separate network scans, and adds CrowdStrike's ExPRT rating to help prioritize them. Spotlight data, including CVE details, host information, and remediation guidance, is available through the Falcon API as JSON. DefectDojo can import a Spotlight export as a file, and the DefectDojo Pro connector syncs Spotlight vulnerabilities and Falcon EDR detections directly.

CrowdStrike Falcon Integration with DefectDojo

The CrowdStrike Falcon sensor is already on our servers and workstations, so Spotlight gives us vulnerability coverage without scheduling a single scan. Bringing those results into DefectDojo puts host CVEs on the same Assets, SLAs, and reports as our application findings. Each Spotlight vulnerability arrives with its CVSS score, CrowdStrike's own severity and ExPRT rating, a CISA KEV tag when the CVE is known to be exploited, and the remediation steps CrowdStrike recommends.

Why CrowdStrike Falcon Matters

Host vulnerability data is only useful if it is current and covers every machine. Agent-based assessment helps with both.

• Spotlight reports from the sensor's inventory, so laptops off the corporate network and short-lived cloud hosts are covered as long as the sensor is installed.
• ExPRT ratings add CrowdStrike's view of exploitation likelihood on top of CVSS.
• CISA KEV status flags CVEs that attackers are known to use, which usually deserve the shortest SLAs.
• Remediation entities name the patch or action to take, which shortens the path from finding to fix.
• On its own, Spotlight is another console. Endpoint CVEs are easier to act on when they share owners, SLAs, and reporting with every other finding.

Advantages of This Integration

What we gained by routing Falcon data through DefectDojo:

• Priority signals as tags. Each Finding carries exprt:<rating>, cisa-kev when applicable, and the host's own Falcon tags, so rules, filters, and SLAs can key off them.
• One identity for file and API data. File imports and connector syncs share the CrowdStrike:Spotlight - Connectors Import scan type and use the Spotlight vulnerability ID as the unique ID, so the two paths deduplicate against each other.
• Remediated vulnerabilities close. The connector imports only open and reopened Spotlight vulnerabilities, so a reimport after patching closes what was fixed.
• Hosts as Records. The connector creates a Record for each Falcon host, named for its hostname, OS, and type, which you map to the Assets that own them.
• EDR detections too. With the right API scope, the connector also imports Falcon detections as a separate finding type, so SOC and vulnerability data sit in one place.

How This Integration Works

Option 1: CrowdStrike Falcon connector (DefectDojo Pro). Create a Falcon API client in the Falcon console under Support > API Clients and Keys with these scopes: Hosts: Read (required), Vulnerabilities (Spotlight): Read for Spotlight findings, and Alerts: Read for EDR detections. If a scope is missing, that finding type is skipped rather than failing the Sync. Create the client in the CID that holds the hosts. With Falcon Flight Control, that means the child CID, not the parent.

Then add the connector under Connect > Upstream:

1. Enter the API base URL for your Falcon cloud in Location, for example https://api.crowdstrike.com (US-1), https://api.us-2.crowdstrike.com (US-2), or https://api.eu-1.crowdstrike.com (EU-1).
2. Enter the Client ID and Client Secret.
3. Optionally set a Minimum Severity.

On save, DefectDojo reports how many hosts the client can see. A client whose CID has no hosts is saved with a No Data Visible warning. Findings arrive as two types: CrowdStrike:Spotlight and CrowdStrike:Detections.

Option 2: JSON file import. This path exists for teams that can't grant DefectDojo Falcon API credentials. Export combined Spotlight vulnerability entities from the Falcon API's /spotlight/combined/vulnerabilities/v1 endpoint with a status filter for open vulnerabilities and the cve, host_info, and remediation facets (the DefectDojo parser docs include an example request). The parser accepts a bare JSON array or the API's resources envelope. It covers Spotlight vulnerabilities only, not detections.

Upload the file in the UI (Import Scan Results, then CrowdStrike:Spotlight - Connectors Import), or use the API:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=CrowdStrike:Spotlight - Connectors Import" \
  -F "file=@spotlight.json" \
  -F "product_name=datacenter-linux" \
  -F "engagement_name=Spotlight" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "CrowdStrike:Spotlight - Connectors Import" \
  --report-path "./spotlight.json" \
  --product-name "datacenter-linux" \
  --engagement-name "Spotlight" \
  --auto-create-context

Data Granularity: What Gets Imported

The table describes Spotlight vulnerabilities. The file parser mirrors the connector field for field.

Use Cases

KEV-driven patching: A vulnerability management team sets a rule on the cisa-kev tag so known-exploited CVEs get a short SLA and are assigned to the infrastructure on-call queue, while everything else follows the normal severity SLAs.

Fleet-wide endpoint risk with DefectDojo Pro: An IT security team maps Falcon host Records to Assets by business unit. Daily syncs keep each unit's open endpoint CVEs current, and patched vulnerabilities drop out automatically.

Restricted environments: Where an outbound API connection from DefectDojo to CrowdStrike isn't approved, a scheduled job exports Spotlight data and imports the file. If the connector is approved later, findings keep their identity.

SOC and vulnerability management together: With Alerts: Read granted, EDR detections arrive next to Spotlight vulnerabilities, so analysts can see when a host with an open, exploitable CVE also triggered a detection.

Operational Tips

• Severity comes from the CVE's severity, not Spotlight's per-vulnerability rating. Use the ExPRT tag when you want CrowdStrike's prioritization in your filters.
• Spotlight findings are neither static nor dynamic. Reports or rules that split on those flags won't include them.
• Grant only the scopes you need. Without Alerts: Read, the connector imports Spotlight vulnerabilities and skips detections without failing.
• Hostnames that aren't valid endpoint hosts, such as values with spaces, are dropped from endpoints but still appear in the description.
• Choose one path per Asset unless you are migrating. The shared scan type deduplicates, but running both on different Assets splits a host's history.
• Use minimum_severity on file imports, or the connector's Minimum Severity, to keep Low and Info CVEs out if they would bury the actionable ones.