CrowdStrike SearchVulnerabilities
CertifiedEnterprise EditionSearch CrowdStrike Falcon Spotlight vulnerabilities
CrowdStrike SearchVulnerabilities
Search CrowdStrike Falcon Spotlight vulnerabilities
Searches vulnerabilities with the CrowdStrike Falcon Query Language (FQL) — filter on CVE ID, severity, status, or host fields — and pages through every matching result using cursor-based pagination. Unlike most other CrowdStrike search endpoints, this one requires filter to be set. fetchType=STORE is recommended for large result sets: it streams results to internal storage instead of holding them all in memory or in the execution output.
type: io.kestra.plugin.ee.crowdstrike.spotlight.SearchVulnerabilitiesExamples
Store every open critical vulnerability for downstream processing
id: search_vulnerabilities
namespace: company.team
tasks:
- id: search_vulnerabilities
type: io.kestra.plugin.ee.crowdstrike.spotlight.SearchVulnerabilities
clientId: "{{ secret('CROWDSTRIKE_CLIENT_ID') }}"
clientSecret: "{{ secret('CROWDSTRIKE_CLIENT_SECRET') }}"
filter: "status:'open'+cve.severity:'CRITICAL'"
fetchType: STORE
Properties
clientId *string
API client ID
Client ID of a CrowdStrike API client with the scopes required by the tasks and triggers being used.
clientSecret *string
API client secret
Client secret of the CrowdStrike API client. Exchanged for a short-lived OAuth2 Bearer token on every task run and trigger poll; never logged.
filter *string
FQL filter
CrowdStrike Falcon Query Language expression (for example: status: 'open'+cve.severity: 'CRITICAL'). Required — unlike most other CrowdStrike search endpoints, the Spotlight vulnerabilities endpoint does not match everything when this is omitted.
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150baseUrl string
https://api.crowdstrike.comCrowdStrike API base URL
Base URL of the CrowdStrike Falcon API for your cloud region (for example: https://api.crowdstrike.com for US-1, https://api.us-2.crowdstrike.com for US-2, https://api.eu-1.crowdstrike.com for EU-1, or https://api.laggar.gcw.crowdstrike.com for US-GOV-1). Defaults to the US-1 endpoint. Using the wrong region for your tenant results in 403 Forbidden responses.
fetchType string
FETCHSTOREFETCHFETCH_ONENONEFetch type
FETCH_ONE outputs the first vulnerability, FETCH outputs every vulnerability, STORE streams every vulnerability to internal storage and returns a URI. Defaults to FETCH.
limit integerstring
100Page size
Internal pagination page size, from 1 to 400, used for FETCH and STORE (every matching vulnerability is fetched regardless of this value). Ignored for FETCH_ONE, which requests a single record directly. Defaults to 100.
sort string
Sort order
Sort field and direction (for example: cve.base_score.desc).
Outputs
size integer
Number of vulnerabilities fetched
total integer
Total number of vulnerabilities matching the filter
uri string
uriStored data URI
Populated only when fetchType=STORE.
vulnerabilities array
Fetched vulnerabilities
Populated only when fetchType=FETCH.
io.kestra.plugin.ee.crowdstrike.spotlight.VulnerabilityRecord
UTC timestamp this vulnerability was first detected, ISO-8601.
CVE details for this vulnerability.
io.kestra.plugin.ee.crowdstrike.spotlight.VulnerabilityRecord-Cve
CVSS base score.
Known exploit status (for example EASILY_ACCESSIBLE).
CVE identifier (for example CVE-2024-12345).
CVE severity: LOW, MEDIUM, HIGH, or CRITICAL.
Host the vulnerability was detected on.
io.kestra.plugin.ee.crowdstrike.spotlight.VulnerabilityRecord-HostInfo
Device ID (AID) of the affected host.
Hostname of the affected host.
Platform name (for example Windows).
Spotlight vulnerability ID.
Suggested remediation.
io.kestra.plugin.ee.crowdstrike.spotlight.VulnerabilityRecord-Remediation
Human-readable remediation guidance.
Remediation status: open or closed.
UTC timestamp this vulnerability was last updated, ISO-8601.
vulnerability
First fetched vulnerability
Populated only when fetchType=FETCH_ONE.
io.kestra.plugin.ee.crowdstrike.spotlight.VulnerabilityRecord
UTC timestamp this vulnerability was first detected, ISO-8601.
CVE details for this vulnerability.
io.kestra.plugin.ee.crowdstrike.spotlight.VulnerabilityRecord-Cve
CVSS base score.
Known exploit status (for example EASILY_ACCESSIBLE).
CVE identifier (for example CVE-2024-12345).
CVE severity: LOW, MEDIUM, HIGH, or CRITICAL.
Host the vulnerability was detected on.
io.kestra.plugin.ee.crowdstrike.spotlight.VulnerabilityRecord-HostInfo
Device ID (AID) of the affected host.
Hostname of the affected host.
Platform name (for example Windows).
Spotlight vulnerability ID.
Suggested remediation.
io.kestra.plugin.ee.crowdstrike.spotlight.VulnerabilityRecord-Remediation
Human-readable remediation guidance.
Remediation status: open or closed.
UTC timestamp this vulnerability was last updated, ISO-8601.
