Copy page

CrowdStrike

Vulnerability Findings

Retrieves vulnerability data and associated metadata for assets from Crowdstrike Falcon Spotlight, including details like CVE identifiers, CVSS scores, descriptions, solution information, and affected systems.

Sync Type: Incremental

Requirements

• Before you connect Monad to CrowdStrike, you need a Client ID and Client Secret. Log in to your CrowdStrike portal, and under Support & Resources, click on 'API Client and Keys' to create your credentials.

• Enter a Client Name, Description and API Scopes to define the API client. Ensure read roles for User Management are enabled.
• Click Done.
• Copy the ClientID and ClientSecret key. You'll need them when you set up the Monad connector.

Details

Monad uses the created_timestamp within the filter on the CrowdStrike API to determine what vulnerabilities to display. This field is updated every time a request to get vulnerabilities is successful with the last time a request to get vulnerabilities was initiated. If this was the first time requesting for vulnerabilities, a full sync of the data is performed.

Configuration

The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

Settings

Setting	Type	Required	Description
Cloud Type	string	No	Your cloud type for CrowdStrike. Ex: 'autodiscover', 'us-1', 'us-2', 'eu-1', 'us-gov-1'.
Backfill Start Time	string	No	The date to start fetching data from. If not specified, no past records will be fetched.

Secrets

Secret	Type	Required	Description
Client ID	string	Yes	Client ID for the CrowdStrike API. This is required to authenticate requests.
Client Secret	string	Yes	Client Secret for the CrowdStrike API. This is required to authenticate requests.

OCSF Conversion

The following JQ transformation converts Crowdstrike Vulnerability data to OCSF Version 1.1 compliant format.

Sample Record

Code
{
  "aid": "6defa27b-d63e-4187-e65c-c2c3b99117c0",
  "apps": [
    {
      "evaluation_logic": {
        "aid": "7990ed66-c052-2680-6917-b22738a16ee4",
        "cid": "a8fcb81c-009e-337c-7a67-e9cbf9e6785f",
        "created_timestamp": "2025-08-11T23:46:31Z",
        "data_provider": "Falcon sensor",
        "host_info": {
          "entities_matched": [
            {
              "asset_id": "723f1805-7045-b0d8-ff68-3f9068b2d2e4"
            }
          ]
        },
        "id": "c0550454-9a3c-2d02-0fb8-0a5d8557d9d1",
        "logic": [
          {
            "comparison_check": "at least one",
            "comparisons": {
              "state_comparisons": [
                {
                  "entity_comparisons": [
                    {
                      "actual_value_field": "value",
                      "expected_value": "^Microsoft \\.NET Runtime - 6\\.0[\\d.]+ \\(x64\\)$",
                      "operation": "pattern match",
                      "value_datatype": "string"
                    }
                  ],
                  "entity_operator": "AND"
                }
              ],
              "state_operator": "AND"
            },
            "determined_by_comparison": true,
            "existence_check": "at_least_one_exists",
            "id": "8808f7a8-db13-01ab-4c9d-f11306b5d5cc",
            "items": [
              {
                "comparison_result": "FAILURE",
                "hive": "HKEY_LOCAL_MACHINE",
                "item_type": "registry_item",
                "key": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4BCC5DFD-5D10-4ACC-AAA9-8A1578A9F0C6}",
                "name": "DisplayName",
                "type": "reg_sz",
                "value": [
                  "Microsoft .NET Runtime - 6.0.28 (x64)"
                ],
                "windows_view": "64_bit"
              }
            ],
            "title": "Check if 64 bit .NET core 6.0 is installed",
            "type": "inventory"
          },
          {
            "comparison_check": "all",
            "comparisons": {
              "state_comparisons": [
                {
                  "entity_comparisons": [
                    {
                      "actual_value_field": "value",
                      "expected_value": "^Microsoft \\.NET Runtime - 6\\.0\\.(\\d|1[0-9]|2[0-8]) .*$",
                      "operation": "pattern match",
                      "value_datatype": "string"
                    }
                  ],
                  "entity_operator": "AND"
                }
              ],
              "state_operator": "AND"
            },
            "determined_by_comparison": true,
            "existence_check": "at_least_one_exists",
            "id": "8b07bf96-3a9c-a079-027a-d4759c9892d0",
            "items": [
              {
                "comparison_result": "SUCCESS",
                "hive": "HKEY_LOCAL_MACHINE",
                "item_type": "registry_item",
                "key": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4BCC5DFD-5D10-4ACC-AAA9-8A1578A9F0C6}",
                "name": "DisplayName",
                "type": "reg_sz",
                "value": [
                  "Microsoft .NET Runtime - 6.0.28 (x64)"
                ],
                "windows_view": "64_bit"
              }
            ],
            "title": "Check if the version of .NET core runtime 6.0 is less than 6.0.29",
            "type": "vulnerability"
          }
        ],
        "updated_timestamp": "2025-08-11T23:46:31Z"
      },
      "product_name_normalized": ".NET Core",
      "product_name_version": ".NET Core 6.0",
      "remediation": {
        "ids": [
          "aaf750cd-3381-d1c5-803c-d75d73f977bc"
        ]
      },
      "sub_status": "open"
    }
  ],
  "cid": "681e7823-7517-1b38-835f-368e1e8be1b8",
  "confidence": "confirmed",
  "created_timestamp": "2025-08-11T23:46:31Z",
  "cve": {
    "actors": null,
    "base_score": 7.3,
    "cisa_info": {
      "is_cisa_kev": false
    },
    "cwes": [
      ""
    ],
    "description": ".NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability\n",
    "exploitability_score": 1.3,
    "exprt_rating": "MEDIUM",
    "id": "CVE-2024-21409",
    "impact_score": 5.9,
    "published_date": "2024-04-09T07:00:00Z",
    "references": [
      "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21409"
    ],
    "remediation_level": "O",
    "severity": "INFO",
    "spotlight_published_date": "2024-04-11T07:43:00Z",
    "types": [
      "Vulnerability"
    ],
    "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
    "vendor_advisory": [
      "https://msrc.microsoft.com/update-guide/en-us/vulnerability/CVE-2024-21409"
    ]
  },
  "data_providers": [
    {
      "ports": null,
      "provider": "Falcon sensor"
    }
  ],
  "host_info": {
    "asset_criticality": "Unassigned",
    "asset_roles": null,
    "groups": null,
    "hostname": "DESKTOP-4AN8HUC",
    "internet_exposure": "No",
    "local_ip": "192.203.104.40",
    "machine_domain": "",
    "managed_by": "Falcon sensor",
    "os_build": "19045",
    "os_version": "Windows 10",
    "ou": "",
    "platform": "Windows",
    "product_type_desc": "Workstation",
    "site_name": "",
    "subsidiaries": null,
    "system_manufacturer": "Dell Inc.",
    "tags": [],
    "third_party_asset_ids": null
  },
  "id": "32c9c936-30e5-258b-72f9-b4ec1292ca7c",
  "remediation": {
    "entities": [
      {
        "action": "Update Microsoft .Net Core to the latest available version",
        "id": "c63b7267-3be7-b14e-3350-0e67ade8dffb",
        "link": "",
        "reference": "cpe:/a:microsoft:.net_core::::",
        "title": "Update Microsoft .Net Core",
        "vendor_url": ""
      }
    ],
    "ids": null
  },
  "services": null,
  "status": "open",
  "suppression_info": {
    "is_suppressed": false
  },
  "updated_timestamp": "2025-08-11T23:46:31Z",
  "vulnerability_id": "CVE-2024-21409"
}

Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See Input Sync Frequency for details.