Import Data from CrowdStrike Falcon Spotlight

Mondoo can import data from CrowdStrike Falcon Spotlight and combine it with your Mondoo findings. The unified view gives you Mondoo's security visualization, prioritization, and ticketing on top of CrowdStrike exposure data.

Prerequisites

• Editor or Owner access to the Mondoo space
• Administrator access to a CrowdStrike Falcon account
• Falcon Spotlight exposure management enabled
• Falcon Discover enabled (optional, lets Mondoo pull software inventory)

Create a CrowdStrike Falcon API client

Mondoo authenticates with a CrowdStrike API client. To learn more, see CrowdStrike OAuth2-Based APIs in the Falcon documentation.

1. Log into the Falcon console as a Falcon Administrator.

   

2. In the left navigation, select Support and resources > API clients and keys.

   

3. Select Create API client.

   

4. Give the client a name that identifies it as Mondoo's.

5. In the Scopes table, check the Read column for each of:

   • Apps
   • Detections
   • Device content
   • Device control policies
   • Hosts
   • Assets (only if Falcon Discover is enabled)
   • Vulnerabilities

6. Select Create.

   

   Falcon shows the client ID, secret, and base URL Mondoo needs. Keep the page open for the next section.

Add a CrowdStrike Falcon integration

In the Mondoo App, navigate to the space where you want to add the integration. In the side navigation bar, select Integrations. In the top right, select + INSTALL. On the integrations page, find the integration you want by browsing or searching by name:

1. Under Third-Party Data, select CrowdStrike.

   

2. In Choose an integration name, enter a name for the integration.

3. Fill in:

   • Provide the client ID. From the API client you just created.
   • Provide the secret. From the API client.
   • Provide the base URL. From the API client.

4. Leave Export data from a specific member CID disabled unless you manage multiple CrowdStrike CIDs. To learn when this matters, see Multiple CrowdStrike CIDs below.

5. Select START IMPORTING.

Multiple CrowdStrike CIDs

If you're an administrator who manages multiple CrowdStrike CIDs (for example, an MSP handling several customers), one API client can access multiple CIDs. Mondoo lets you scope the integration to one CID at a time.

To find the CID:

1. In the Falcon console, go to Host setup and management > Deploy > Sensor downloads.

   

2. Under HOW TO INSTALL, select the copy icon beside the Customer ID. Paste this value in Mondoo's Provide the member CID box and enable the toggle.

Manage this integration

To open an existing integration, navigate to the space, select Integrations > All Integrations in the side navigation, choose the integration type, then select the integration.

From the integration detail page, you can:

• Edit settings. Select the edit (pencil) icon.
• Trigger an immediate import. Select SCHEDULE NOW.
• Pause or resume imports. Select the ellipsis (...) menu, then Pause Imports or Resume Imports.
• Remove the integration. Select the trash can icon and confirm.