CrowdStrike Endpoint Security Connector

Before configuring the connector in Qualys ETM, ensure you have the following ready:

1. Ensure you have admin-level access to your CrowdStrike Falcon platform to create API clients.
2. Create an API client in the CrowdStrike portal. Navigate to Support > API Clients and Keys and click Add new API Client. Assign the required scopes (see Permissions Required below). Copy and save the Client ID and Client Secret immediately, as the secret cannot be viewed again.
3. Confirm network connectivity: Qualys cloud must be able to reach your CrowdStrike API endpoint over HTTPS (port 443).
4. Identify your CrowdStrike Auth URL based on your cloud region (for example, https://api.us-2.crowdstrike.com or https://api.eu-1.crowdstrike.com).

Creating an API Client in CrowdStrike Falcon

Follow these steps to create the API client that the connector will use to authenticate.

1. Log in to your CrowdStrike Falcon platform with admin credentials.
2. Navigate to Support > API Clients and Keys.
3. Click Add new API Client. Provide a name and description, and assign the required scopes (see Permissions Required below).
4. Click Add. The platform displays the Client ID and Client Secret. Copy and save both values immediately, as the secret cannot be retrieved after this screen is closed.

Identifying Your Auth URL

Your Auth URL depends on your CrowdStrike cloud region. Common values include:

• https://api.us-2.crowdstrike.com for US-2
• https://api.eu-1.crowdstrike.com for EU-1

You can find your region in the CrowdStrike Falcon console URL or by checking with your CrowdStrike account representative.

Entering Credentials in Qualys ETM

During connector setup in Qualys ETM, select CrowdStrike Spotlight as the supported format and enter the Auth URL, Client ID, and Client Secret in the authentication fields on the Profile & Connectivity screen. The connector uses these credentials to authenticate against the CrowdStrike OAuth2 token endpoint and access the Spotlight and Discover APIs.

Permissions Required

The CrowdStrike API client must have Read permissions for the following scopes. Assign these scopes when creating the API client in the CrowdStrike Falcon console:

• Hosts – Read
• Host Groups – Read
• Vulnerabilities – Read

Scope and Data Access

The connector queries the CrowdStrike Spotlight vulnerabilities endpoint and the Discover hosts endpoint to retrieve vulnerability and asset data. Optional filters can be configured in the connector profile, including Product Type (to filter by asset categories) and Data Provider (to select between Falcon Network Scan and Active Directory sources).

Key Rotation

If the Client Secret is lost or compromised, regenerate it in the CrowdStrike Falcon console under Support > API Clients and Keys. After generating a new secret, update the credential in Qualys ETM via the Edit Connector option. OAuth2 access tokens have a standard 30-minute lifespan and are automatically refreshed by the connector.

This step configures the connector's identity and authenticates with CrowdStrike.

Connector Details

Authentication Details

Enter the OAuth2 credentials generated from the CrowdStrike Falcon console.

After entering all authentication fields, click Test Connection. Qualys ETM performs the following checks:

• Network Reachability — Verifies that the connector endpoint is reachable over HTTPS (port 443).
• TLS Handshake — Confirms that a secure TLS connection can be established with the remote endpoint.
• Authentication Credential Check — Validates the configured credentials against the source system's authentication endpoint.
• Authorization Scope Check — Confirms that the provided credentials have the required permissions to access the configured data scope.
• Data Fetch — Verifies that data can be successfully retrieved from the source system using the configured connection.

All five checks must pass before you can proceed to Step 2. If any check fails, refer to the Troubleshooting section for resolution steps.

Select the data to ingest from CrowdStrike and configure when the connector should run.

Data to Sync – Choose one of the following options:

• Assets & Findings (default) – Syncs both host asset records and vulnerability findings (CVEs) from CrowdStrike Spotlight.
• Assets – Syncs host asset records only, without vulnerability findings.

Schedule – Set the Occurs field to define how frequently the connector runs. The default is Daily.

Click Advanced Settings to optionally configure filters, transformation maps, and risk severity mapping (see Advanced Settings).

Sampling Mode - Limit Sync to Top 1,000 Assets and Findings

Sampling Mode can restrict data ingestion to a targeted subset of up to 1,000 assets and their associated findings. You can quickly validate integration and review meaningful security data without a full environment sync.

You can select the Limit sync to top 1,000 assets and findings checkbox to limit the fetch 1000 assets using risk-based filter criteria. The assets, along with their associated findings, are discovered and shared with ETM. The connector applies risk-based filters during asset fetch to ensure the ingested subset represents the most relevant assets in your environment rather than a random or arbitrary sample.

Assets are fetched based on the last-seen timestamp, configured in the connector's advanced settings in the UI. The fetch is scoped to specific endpoint categories such as servers, workstations, and domain controllers, ensuring coverage across your most critical managed device types.

Review all settings before creating the connector. If all settings are correct, click Create. The connector connection is created and immediately transitions to the Registered state.