Spotlight
Accessing and managing CrowdStrike Falcon Spotlight vulnerabilities
API Scopes
Section titled “API Scopes”- Vulnerabilities: READ
falcon_search_vulnerabilities
Section titled “falcon_search_vulnerabilities”Required scopes: Vulnerabilities: READ
Search for vulnerabilities in your CrowdStrike environment.
Use this to find vulnerabilities by CVE severity, status, host, or remediation
state. Consult falcon://spotlight/vulnerabilities/fql-guide before constructing
filter expressions. Returns vulnerability details including CVE info, host context,
and remediation guidance (based on facet selection).
Responses include pagination.total (the total number of records matching the filter, or null when the API does not report a count) — use it to answer “how many” questions. For cursor-based paging, use pagination.next as the after parameter on the next call.
Example prompts:
- “Show me open HIGH severity vulnerabilities”
- “Find vulnerabilities on host xyz”
Resources
Section titled “Resources”falcon://spotlight/vulnerabilities/fql-guide: Contains the guide for thefilterparam of thefalcon_search_vulnerabilitiestool.