CrowdStrike Trigger

CrowdStrike Trigger
Certified
Enterprise Edition
Trigger a flow on a new CrowdStrike Falcon Spotlight vulnerability

Polls SearchVulnerabilities at the configured interval, filtered server-side to vulnerabilities created after the last delivered one, and fires one execution per newly discovered vulnerability (oldest first, one per poll cycle). The trigger tracks the created_timestamp of the newest delivered vulnerability in namespace KV to avoid re-firing; on the first poll, only the current baseline is recorded — no execution is fired — to avoid flooding on initial activation.

yaml
type: io.kestra.plugin.ee.crowdstrike.spotlight.Trigger

Examples

Trigger a flow whenever a new critical vulnerability is detected

yaml
id: crowdstrike_on_new_vulnerability
namespace: company.team

tasks:
  - id: log_vulnerability
    type: io.kestra.plugin.core.log.Log
    message: "New {{ trigger.severity }} vulnerability {{ trigger.cveId }} on {{ trigger.hostname }}"

triggers:
  - id: on_critical_vulnerability
    type: io.kestra.plugin.ee.crowdstrike.spotlight.Trigger
    clientId: "{{ secret('CROWDSTRIKE_CLIENT_ID') }}"
    clientSecret: "{{ secret('CROWDSTRIKE_CLIENT_SECRET') }}"
    filter: "status:'open'+cve.severity:'CRITICAL'"
    interval: PT5M

Properties

clientId *string

API client ID

Client ID of a CrowdStrike API client with the scopes required by the tasks and triggers being used.

clientSecret *string

API client secret

Client secret of the CrowdStrike API client. Exchanged for a short-lived OAuth2 Bearer token on every task run and trigger poll; never logged.

allowConcurrent boolean

Defaultfalse

Specifies whether a trigger is allowed to start a new execution even if a previous run is still in progress.

baseUrl string

Defaulthttps://api.crowdstrike.com

CrowdStrike API base URL

Base URL of the CrowdStrike Falcon API for your cloud region (for example: https://api.crowdstrike.com for US-1, https://api.us-2.crowdstrike.com for US-2, https://api.eu-1.crowdstrike.com for EU-1, or https://api.laggar.gcw.crowdstrike.com for US-GOV-1). Defaults to the US-1 endpoint. Using the wrong region for your tenant results in 403 Forbidden responses.

filter string

FQL filter

CrowdStrike Falcon Query Language expression applied in addition to the trigger's own time cursor (for example: status: 'open'+cve.severity: 'CRITICAL').

interval string

DefaultPT1M

Formatduration

Polling interval

How often to poll the CrowdStrike API for new items. Defaults to PT1M (every minute).

stopAfter array

SubTypestring

Possible Values

CREATEDSUBMITTEDRUNNINGPAUSEDRESTARTEDKILLINGSUCCESSWARNINGFAILEDKILLEDCANCELLEDQUEUEDRETRYINGRETRIEDSKIPPEDBREAKPOINTRESUBMITTED

List of execution states after which a trigger should be stopped (a.k.a. disabled).

when string

Defaulttrue

A condition that determines whether the trigger should run.

A Pebble expression evaluated at trigger time. The trigger fires only when the expression evaluates to a truthy value (true, a non-empty string, a non-zero number). Use this to gate trigger execution on dynamic runtime values such as execution labels, flow variables, or environment conditions.

Outputs

cveId string

CVE identifier

hostId string

Device ID (AID) of the affected host

hostname string

Hostname of the affected host

remediation string

Suggested remediation

severity string

CVE severity