CrowdStrike Falcon Cloud Security Connector

The CrowdStrike Falcon Cloud Security Connector ingests cloud asset and vulnerability data from CrowdStrike Falcon Cloud Security (CWP) into Qualys Enterprise TruRisk Management (ETM). This enables centralized visibility of cloud workloads and security risks within the ETM platform for improved risk analysis and prioritization.

The CrowdStrike Falcon Cloud Security Connector can be activated only after Unified Asset Inventory (UAI) is enabled for your subscription. Contact your Technical Account Manager (TAM) or Qualys Support to activate UAI and the CrowdStrike Falcon Cloud Security connector.

Connector Details

Here is a comprehensive overview of what the CrowdStrike Falcon Cloud Security Connector supports.

Vendor	CrowdStrike
Product Name	CrowdStrike Falcon Cloud Security
Connector Category	CNAPP
Asset Types Supported	We are covering the following four Assets:  Compute  Serverless Container Image Container Instance. These assets can be part of these three cloud providers - AWS GCP Azure Findings for Compute AWS and Container Images
Finding Types Supported	Vulnerabilities
Supported Cloud Providers	AWS, Azure, GCP
Version	1.0.0
Supported Version & Type	SaaS (Latest)
Integration Method	API Integration (REST / GraphQL)
Direction	Unidirectional (CrowdStrike to Qualys)
Incremental Sync (Delta)	Not Supported
Import of Installed Software	Not Supported
Import of Source Tags	Not Supported
Filters / Filter Query	Not Supported

Connection Settings

User Roles and Permissions

To configure the connector, you must generate API credentials in the CrowdStrike Falcon console with the required permissions.

Required API permissions:

• read: Vulnerabilities
• read: Hosts
• read: Assets
• read: Host Groups
• read: Cloud Security API Assets
• read: Cloud Security API Detection
• read: Falcon Container Image

Authentication Details

Provide the following credentials in the connector configuration screen.

Name	Key	Type	Description
Auth URL	auth_url	String	CrowdStrike authentication endpoint
Client ID	client_id	String	API client identifier
Client Secret	client_secret	Encrypted	API client secret
API Token	api_token	String	CrowdStrike API token
Domain	domain	String	Example: https://api.<domain>.crowdstrike.com

Creating an API Client

1. Log in to the CrowdStrike Falcon console.
2. Navigate to Support > API Clients and Keys.
3. Select Add new API client.
4. Provide a client name.
5. Assign the required API scopes and permissions.
6. Generate and save the API token.

Save the generated API token securely. The token cannot be retrieved again after creation.

Connector Configuration

Basic Details

1. Log in to Qualys ETM.
2. Navigate to Connectors > Integration.
3. Locate CrowdStrike Falcon Cloud Security CWP.
4. Click Manage.
5. Provide a Name and Description.
6. Enter the required authentication details.

Schedule

Schedules control the execution and scope of the connector.

Configure the following options:

• Execution schedule
• Supported asset types
• Findings to ingest

Mapping Details

Data Model

The CrowdStrike Falcon Cloud Security connector provides default transformation mappings that convert CrowdStrike asset and vulnerability data into the Qualys ETM data model.

Transform Maps

Default transform maps are automatically applied during connector execution. You may clone or modify these maps in ETM if customization is required.

Profiles

Profiles control how the connector executes.

1. Click + to create a new profile.
2. Provide a Name and Description.
3. Select the required Transform Map.
4. Set Status (Active or Inactive).
5. Configure a schedule (single run or recurring).

Scoring

Use the scoring screen to map vendor severity values to the Qualys Detection Score (QDS) scale from 0 to 100.

Identification Rules

Identification Rules determine how findings are associated with assets in ETM. Qualys CSAM provides default precedence rules for matching imported data.

These rules currently apply to Compute asset types. You may proceed without modifying them.

How Does a Connection Work?

When the connector runs (scheduled or on-demand), it authenticates with the CrowdStrike API and retrieves selected asset classes and vulnerability findings. The data is then transformed using the default ETM mappings and imported into the ETM inventory.

In the Connector screen, your newly configured connector will appear with the state Processed once execution completes.

Connector States

• Registered – Connector created successfully.
• Scheduled – Connector scheduled for execution.
• Processing – Data is currently being fetched.
• Processed – Data ingestion completed.

The entire import process may take several hours depending on the data volume.

Viewing Assets and Findings in ETM

After ingestion, view imported data in ETM.

• Assets
  Enterprise TruRisk Management > Inventory > Assets > All Assets
  Filter using: inventory.source:"CrowdStrike Falcon Cloud Security"
• Findings
  Enterprise TruRisk Management > Risk Management > Findings > Vulnerability
  Filter using: finding.vendorProductName:"CrowdStrike Falcon Cloud Security"

Additional Resources

Additional Information related to the Crowdstrike Connector.

API Reference

Here are the APIs executed for the Crowdstrike connection.

Name	Filters	Endpoint
Auth API	N/A	https://api.<domain>.crowdstrike.com/oauth2/token
Fetch Vulnerabilities API	Finding Type: Vulnerabilities	/spotlight/queries/vulnerabilities/v1 /spotlight/entities/vulnerabilities/v2 /container-security/combined/images/detail/v1
	Fetch Devices associated with Vulnerabilities	/devices/queries/devices/v1
Fetch Assets/Resources API	Asset type: Hosts	/cloud-security-assets/queries/resources/v1 /cloud-security-assets/entities/resources/v1
Fetch Containers	Asset type: Containers	/container-security/combined/containers/v1
	Asset type: Container Images	/image-assessment/entities/reports/v2

Crowdstrike CWP Falcon Cloud Security Transformation Map

The default transformation map for different asset classes, configured for the Crowdstrike Cloud Security connector is fetched from the database and utilized during the execution of the connector profile to perform data transformation.

Compute

AWS EC2 instanceAWS EC2 instance

Azure VM InstanceAzure VM Instance

Compute GCP VMCompute GCP VM

OCI VM InstanceOCI VM Instance

Container ImageContainer Image

Container Instance

AWS ContainerAWS Container

Container Instance

GCP CloudRunGCP CloudRun

Serverless

AWS Lambda functionAWS Lambda function

Azure FunctionAzure Function

GCP FunctionGCP Function

Vulnerability Compute AWS EC2Vulnerability Compute AWS EC2