CrowdStrike SearchVulnerabilities
CertifiedEnterprise EditionSearch CrowdStrike Falcon Spotlight vulnerabilities
CrowdStrike SearchVulnerabilities
Search CrowdStrike Falcon Spotlight vulnerabilities
Searches vulnerabilities with the CrowdStrike Falcon Query Language (FQL) — filter on CVE ID, severity, status, or host fields — and pages through every matching result using cursor-based pagination. Unlike most other CrowdStrike search endpoints, this one requires filter to be set. fetchType=STORE is recommended for large result sets: it streams results to internal storage instead of holding them all in memory or in the execution output.
type: io.kestra.plugin.ee.crowdstrike.spotlight.SearchVulnerabilitiesExamples
Store every open critical vulnerability for downstream processing
id: search_vulnerabilities
namespace: company.team
tasks:
- id: search_vulnerabilities
type: io.kestra.plugin.ee.crowdstrike.spotlight.SearchVulnerabilities
clientId: "{{ secret('CROWDSTRIKE_CLIENT_ID') }}"
clientSecret: "{{ secret('CROWDSTRIKE_CLIENT_SECRET') }}"
filter: "status:'open'+cve.severity:'CRITICAL'"
fetchType: STORE
Properties
clientId *Requiredstring
API client ID
Client ID of a CrowdStrike API client with the scopes required by the tasks and triggers being used.
clientSecret *Requiredstring
API client secret
Client secret of the CrowdStrike API client. Exchanged for a short-lived OAuth2 Bearer token on every task run and trigger poll; never logged.
filter *Requiredstring
FQL filter
CrowdStrike Falcon Query Language expression (for example: status: 'open'+cve.severity: 'CRITICAL'). Required — unlike most other CrowdStrike search endpoints, the Spotlight vulnerabilities endpoint does not match everything when this is omitted.
baseUrl string
https://api.crowdstrike.comCrowdStrike API base URL
Base URL of the CrowdStrike Falcon API for your cloud region (for example: https://api.crowdstrike.com for US-1, https://api.us-2.crowdstrike.com for US-2, https://api.eu-1.crowdstrike.com for EU-1, or https://api.laggar.gcw.crowdstrike.com for US-GOV-1). Defaults to the US-1 endpoint. Using the wrong region for your tenant results in 403 Forbidden responses.
fetchType string
FETCHSTOREFETCHFETCH_ONENONEFetch type
FETCH_ONE outputs the first vulnerability, FETCH outputs every vulnerability, STORE streams every vulnerability to internal storage and returns a URI. Defaults to FETCH.
limit integerstring
100Page size
Internal pagination page size, from 1 to 400, used for FETCH and STORE (every matching vulnerability is fetched regardless of this value). Ignored for FETCH_ONE, which requests a single record directly. Defaults to 100.
sort string
Sort order
Sort field and direction (for example: cve.base_score.desc).
Outputs
size integer
Number of vulnerabilities fetched
total integer
Total number of vulnerabilities matching the filter
uri string
uriStored data URI
Populated only when fetchType=STORE.
vulnerabilities array
Fetched vulnerabilities
Populated only when fetchType=FETCH.
io.kestra.plugin.ee.crowdstrike.spotlight.VulnerabilityRecord
UTC timestamp this vulnerability was first detected, ISO-8601.
CVE details for this vulnerability.
io.kestra.plugin.ee.crowdstrike.spotlight.VulnerabilityRecord-Cve
CVSS base score.
Known exploit status (for example EASILY_ACCESSIBLE).
CVE identifier (for example CVE-2024-12345).
CVE severity: LOW, MEDIUM, HIGH, or CRITICAL.
Host the vulnerability was detected on.
io.kestra.plugin.ee.crowdstrike.spotlight.VulnerabilityRecord-HostInfo
Device ID (AID) of the affected host.
Hostname of the affected host.
Platform name (for example Windows).
Spotlight vulnerability ID.
Suggested remediation.
io.kestra.plugin.ee.crowdstrike.spotlight.VulnerabilityRecord-Remediation
Human-readable remediation guidance.
Remediation status: open or closed.
UTC timestamp this vulnerability was last updated, ISO-8601.
vulnerability
First fetched vulnerability
Populated only when fetchType=FETCH_ONE.
io.kestra.plugin.ee.crowdstrike.spotlight.VulnerabilityRecord
UTC timestamp this vulnerability was first detected, ISO-8601.
CVE details for this vulnerability.
io.kestra.plugin.ee.crowdstrike.spotlight.VulnerabilityRecord-Cve
CVSS base score.
Known exploit status (for example EASILY_ACCESSIBLE).
CVE identifier (for example CVE-2024-12345).
CVE severity: LOW, MEDIUM, HIGH, or CRITICAL.
Host the vulnerability was detected on.
io.kestra.plugin.ee.crowdstrike.spotlight.VulnerabilityRecord-HostInfo
Device ID (AID) of the affected host.
Hostname of the affected host.
Platform name (for example Windows).
Spotlight vulnerability ID.
Suggested remediation.
io.kestra.plugin.ee.crowdstrike.spotlight.VulnerabilityRecord-Remediation
Human-readable remediation guidance.
Remediation status: open or closed.
UTC timestamp this vulnerability was last updated, ISO-8601.
