An Update on Recently Archived Community Content

Expanding Falcon Spotlight to include Falcon EASM

BenjaminGB
Tera Contributor

‎06-16-2026 03:28 PM

Hey There,

Currently finishing up USEM upgrade and tweaking our Falcon Vulnerability intake from Crowdstrike.

We would like to add Falcon EASM and needs some adivce on the setup.
When I went to the Conenctor Configuration to enable the Falcon EASM it said to create a second Connector Configurationm which I did.
Now I am stuck how to get the Second Configuration to actually run in the scheduled runs, I viewed the x_crowd_vulnerabil.Vulns Script and it has a section where it would complain about Multiple Configs, but it doesnt look like it actually runs the second configs:

 

 retrieveData: function () {
            var keyConfig = this.util.getConfiguration();
            var configItems = keyConfig.length - 1;
            this.configItems = configItems;
            if (keyConfig.length > 1) {
                gs.info('Found multiple configuration instances...');
            }

 

Where do I go from here to get the Falcom EASM config to actually run.

0 Helpfuls
  • 586 Views
1 REPLY 1

abdulrehmanArif
Tera Expert

3 weeks ago


Hi Benjamin, 

The message shown in the Script Include is informational; it is not rejecting the second configuration. Also, keyConfig.length - 1 represents the last array index, not the number of configurations that will be skipped.

I would not modify x_crowd_vulnerabil.Vulns or create a custom scheduled script. This is a CrowdStrike Store application, and the supported approach is to let the existing Spotlight ingest job process the active connector configurations.

Please check the following:

  1. Confirm the CrowdStrike application is updated to the latest available version. Version 4.x changed the main Spotlight ingest process so the Host Import, Vulnerable Item Detection and Backfill integrations run sequentially.

  2. Confirm both Connector Configuration records are active and the second record has Falcon EASM selected.

  3. Validate the connection and ensure the CrowdStrike OAuth client has Vulnerabilities Read access.

  4. Run the existing OOB Spotlight ingest job manually and review the execution logs to confirm which configuration records were processed.

  5. Verify that the EASM configuration is returning EASM/provider data from CrowdStrike. The Spotlight Vulnerabilities API supports provider-based results and EASM-specific service information.

If the latest application version still processes only one active configuration, this should be raised with CrowdStrike support as a connector defect or configuration issue. A custom Global or scoped script should not directly call the internal x_crowd_vulnerabil.Vulns Script Include unless CrowdStrike has explicitly exposed it for cross-scope execution.

If this helped you Mark "Helpful"
If this assisted you mark "Accept as Solution".

Abdul Rehman Arif
XAAS Solutions LLC.

0 Helpfuls