March 3rd, 2026

Improved

Feature

CrowdStrike Falcon Integration — Now Unified with Flight Control Support

Big update to our CrowdStrike Falcon integration! We've consolidated the experience into a single, modular integration and added Flight Control (MSSP) support — so whether you're managing one tenant or hundreds, the Praetorian Guard Platform (PGP) has you covered.

Continuous Visibility Into What's Exposed

Your CrowdStrike Falcon deployment already sees your endpoints and their vulnerabilities — now PGP pulls that data in automatically to enrich your attack surface. Hosts sync as assets, open CVEs from Spotlight flow in as risks filtered to network-reachable attack vectors, and everything correlates against your external exposure. The result: you can trace attack paths from the internet to vulnerable internal endpoints and prioritize remediation based on what's actually reachable — not just what has a high CVSS score.

What's New

  • One integration, three toggleable modules — Hosts, Spotlight, and Shield are now managed from a single CrowdStrike integration with per-module checkboxes in the UI. Smart cross-module caching means Spotlight reuses the Hosts device cache for vulnerability-to-asset correlation, eliminating redundant API calls.
  • Flight Control (MSSP) support — Connect at the master CID level and PGP automatically discovers all child tenants, fanning out per-tenant syncs using a single set of parent credentials. No more onboarding child CIDs one by one.

How It Connects to CrowdStrike

The integration authenticates via OAuth2 client credentials (POST /oauth2/token), with automatic member_cid scoping for Flight Control child tenants. Each module probes its API scope with a lightweight limit=1 query before running to ensure your credentials have the right permissions.

ModuleWhat It SyncsCrowdStrike APIs
HostsEndpoint inventory → PGP assets/devices/queries/devices-scroll/v1 (scrolls device IDs, filtered to non-Workstation devices seen in the last 7 days) → /devices/entities/devices/v2 (hydrates in batches of 100)
SpotlightOpen CVEs → PGP risks/spotlight/queries/vulnerabilities/v1 (paginates open vulns, non-Workstation, updated in last 7 days) → /spotlight/entities/vulnerabilities/v2 (hydrates in batches of 100)
ShieldSaaS security posture (coming soon)/saas-security/queries/saas-resources/v1 (scope validation only — full sync coming in a future release)
Flight ControlChild CID discovery → per-tenant syncs/mssp/queries/children/v1 (paginates all child CIDs under the master)

Concurrency & Rate Limits

PGP caps concurrent API requests at 10 parallel calls during device hydration and vulnerability fetching. CrowdStrike enforces its own API rate limits on the Falcon side. If you're running into rate limiting issues with large environments, reach out to your Praetorian team and we'll work with you to tune throughput.