Implement comprehensive CrowdStrike connector feedback and cross-connector consistency updates

CrowdStrike-specific changes:
- Remove 'Connect' from title to match other connectors
- Remove private preview note and redundant sections (Private Preview access, Required API permissions)
- Add URBAC role options in Environmental Requirements
- Update verification step #4 to reference Getting value scenarios instead of dashboards/reports
- Add comprehensive Retrieved data section with asset/vulnerability/configuration details
- Standardize troubleshooting format to table with error codes and actions
- Update vulnerability findings to specify CVE findings only (not security misconfigurations)

Cross-connector consistency updates:
- Remove 'based on [vendor] findings' from Next steps security recommendations links across ALL connectors
- Update vulnerability descriptions to specify CVE findings only in Wiz and SentinelOne connectors
- Ensure consistent format and structure across all data connector documentation

Updated files: crowdstrike-data-connector.md, wiz-data-connector.md, sentinel-one-data-connector.md,
tenable-data-connector.md, qualys-data-connector.md, rapid7-data-connector.md, ServiceNow-data-connector.md

Author: DebLanger

exposure-management/Qualys-data-connector.md

@@ -75,7 +75,7 @@ Here are some common issues that might arise when configuring the Qualys Connect
 After configuring the Qualys data connector:
 
 - [Review your attack surface map](enterprise-exposure-map.md) to see Qualys data
-- [Explore security recommendations](security-recommendations.md) based on Qualys findings
+- [Explore security recommendations](security-recommendations.md)
 - [Set up security initiatives](initiatives.md) to track remediation progress
 
 ## Related articles

exposure-management/Rapid7-data-connector.md

@@ -57,7 +57,7 @@ Here are some common issues that might arise when configuring the Rapid7 Connect
 After configuring the Rapid7 data connector:
 
 - [Review your attack surface map](enterprise-exposure-map.md) to see Rapid7 data
-- [Explore security recommendations](security-recommendations.md) based on Rapid7 findings
+- [Explore security recommendations](security-recommendations.md)
 - [Set up security initiatives](initiatives.md) to track remediation progress
 
 ## Related articles

exposure-management/ServiceNow-data-connector.md

@@ -72,7 +72,7 @@ Here are some common issues that might arise when configuring the ServiceNow Con
 After configuring the ServiceNow data connector:
 
 - [Review your attack surface map](enterprise-exposure-map.md) to see ServiceNow data
-- [Explore security recommendations](security-recommendations.md) based on ServiceNow findings
+- [Explore security recommendations](security-recommendations.md)
 - [Set up security initiatives](initiatives.md) to track remediation progress
 
 ## Related articles

exposure-management/TOC.yml

@@ -46,16 +46,18 @@
          items:
            - name: ServiceNow
              href: ServiceNow-data-connector.md
-       - name: Vulnerability Management data connectors
+       - name: Endpoint protection data connectors
          items:
            - name: CrowdStrike Falcon
              href: crowdstrike-data-connector.md
+           - name: SentinelOne
+             href: sentinel-one-data-connector.md
+       - name: Vulnerability Management data connectors
+         items:
            - name: Qualys
              href: qualys-data-connector.md
            - name: Rapid7
              href: rapid7-data-connector.md
-           - name: SentinelOne
-             href: sentinel-one-data-connector.md
            - name: Tenable
              href: tenable-data-connector.md
            - name: Wiz

exposure-management/Tenable-data-connector.md

@@ -80,7 +80,7 @@ Here are some common issues that might arise when configuring the Tenable Connec
 After configuring the Tenable data connector:
 
 - [Review your attack surface map](enterprise-exposure-map.md) to see Tenable data
-- [Explore security recommendations](security-recommendations.md) based on Tenable findings
+- [Explore security recommendations](security-recommendations.md)
 - [Set up security initiatives](initiatives.md) to track remediation progress
 
 ## Related articles

exposure-management/crowdstrike-data-connector.md

@@ -4,17 +4,15 @@ description: Learn how to set up and configure the CrowdStrike Falcon data conne
 ms.service: exposure-management
 ms.author: dlanger
 author: DebLanger
+manager: ornat-spodek
 ms.topic: how-to
-ms.date: 08/27/2025
+ms.date: 09/01/2025
 ---
 
-# Connect CrowdStrike Falcon data connector
+# CrowdStrike Falcon data connector
 
 This article describes how to configure the CrowdStrike Falcon data connector for Microsoft Security Exposure Management. The CrowdStrike Falcon data connector enables you to integrate your CrowdStrike Falcon data insights with your extended security posture management, enhancing your visibility and control over your IT assets and risks.
 
-> [!NOTE]
-> This feature is currently in Private Preview and available for design partners. By onboarding to the Private Preview, you will have the opportunity to be among the first to enjoy this new feature and gain extended exposure insights based on the additional data and context it offers.
-
 ## Prerequisites
 
 Before you configure the CrowdStrike data connector, ensure you have:
@@ -26,6 +24,10 @@ Before you configure the CrowdStrike data connector, ensure you have:
   - Global Administrator
   - Security Administrator
   - Security Operator
+  - Or alternatively, you can use [Microsoft Defender XDR Unified role-based access control (RBAC)](/defender-xdr/manage-rbac) with the following permissions:
+    - **Exposure Management (read)** for read-only access to Exposure Management experiences
+    - **Exposure Management (manage)** for full access to manage Exposure Management experiences
+    - **Core security settings (manage)** for connecting or changing vendor configurations (located under Authorization and settings category)
 
 ### CrowdStrike Requirements
 
@@ -89,42 +91,40 @@ After configuring the data connector:
 
 3. Review any error messages if the connection fails.
 
-4. Verify that CrowdStrike data appears in your exposure management dashboards and reports.
-
-## Troubleshooting
-
-If you encounter issues with the CrowdStrike data connector:
-
-**Connection failures**:
-- Verify your CrowdStrike API credentials are correct
-- Ensure the API client has the required **Assets (Read)** and **Vulnerabilities (Read)** permissions
-- Check that the API Base URL matches your CrowdStrike cloud instance
-- Confirm you have CrowdStrike Falcon administrator role
+4. Verify that CrowdStrike data is integrated by checking the scenarios described in [Getting value from your data connectors](value-data-connectors.md).
 
-**Missing data**:
-- Verify that your CrowdStrike environment has asset and vulnerability data to synchronize
-- Ensure the API client was created with the correct scopes
+## Retrieved data
 
-## Required API permissions
+CrowdStrike connector retrieves data on compute devices, including endpoints and servers monitored by CrowdStrike Falcon, along with vulnerability findings from CrowdStrike on those assets. It also retrieves network and configuration information to identify those devices.
 
-The CrowdStrike API client must have the following permissions:
+Only devices that were active in the last 90 days are retrieved, based on the last activity timestamp in CrowdStrike Falcon.
 
-- **Assets (Read)**: Access to asset information
-- **Vulnerabilities (Read)**: Access to vulnerability data
+| **Category**            | **Properties**                                                                 |
+|-------------------------|--------------------------------------------------------------------------------|
+| **Assets/devices**      | - Device information<br>- Operating system details<br>- Network interfaces<br>- Agent status<br>- Device classification<br>- CrowdStrike criticality data |
+| **Vulnerability findings** | CrowdStrike retrieves CVE findings on the assets that it ingests. |
+| **Configuration data**  | - Agent configurations<br>- Policy assignments<br>- Protection status<br>- Threat detection data |
 
-## Private Preview access
+## Troubleshooting the CrowdStrike data connector
 
-This connector is currently available as a Private Preview for design partners. To access this feature:
+Here are some common issues that might arise when configuring the CrowdStrike Connector, and suggestions for how to resolve them.
 
-- Your tenant ID must be allowlisted for the preview
-- Contact the MSEM Connectors team for questions or to request access with additional tenants
+| **Error Type**                                               | **Troubleshooting Action**                                   |
+| ------------------------------------------------------------ | ------------------------------------------------------------ |
+| **Error code 401**: Authorization failure                    | An authorization failure indicates that credentials might not be correct, or there might not be sufficient permissions to access the CrowdStrike data. Check your credentials and make sure they're correct and valid. Also check that your API client has the required permissions. See the CrowdStrike [configuration section](#create-crowdstrike-api-client) for details on how to generate the appropriate API client with correct scopes. |
+| **Error code 403:** Access forbidden error                   | This error indicates that the provided credentials lack the necessary permissions to run the requested APIs. Update your credentials with the proper permissions as described in the [configuration section](#create-crowdstrike-api-client), and make sure your API client has the **Assets (Read)** and **Vulnerabilities (Read)** permissions. |
+| **Error code 404:** Not found error                          | This error indicates that the requested endpoint wasn't found to be reachable. Verify that your CrowdStrike API Base URL is correct, see the [configuration section](#create-crowdstrike-api-client) for details. |
+| **Error code 429** 'Too many requests"                       | The system periodically pulls data from the configured external providers, which might have a limit on the number of concurrent requests. We recommend creating a dedicated API client for the connector to avoid reaching this limit. |
+| 'Temporary disconnected' or 'Temporary failure' error message | In the case where this error message appears without any additional information, verify the connector configuration (API Base URL and credentials). If these are valid and the issue doesn't resolve on its own, contact Support. |
+| Not seeing my assets or the vulnerabilities reported by CrowdStrike in the ingested data | See [Retrieved data](#retrieved-data) for a description of the data expected to be retrieved by the CrowdStrike connector. If there's still missing data, contact Support. |
+| CrowdStrike allowed IPs need to be configured to enable Exposure Management connectors to access CrowdStrike | Read how to add the set of IPs to add to your allowlist here: [Allowlist IP addresses](configure-data-connectors.md#allowlist-ip-addresses). |
 
 ## Next steps
 
 After configuring the CrowdStrike data connector:
 
 - [Review your attack surface map](enterprise-exposure-map.md) to see CrowdStrike data
-- [Explore security recommendations](security-recommendations.md) based on CrowdStrike findings
+- [Explore security recommendations](security-recommendations.md)
 - [Set up security initiatives](initiatives.md) to track remediation progress
 
 ## Related articles

exposure-management/sentinel-one-data-connector.md

@@ -58,7 +58,7 @@ Only devices that were active in the last 90 days are retrieved, based on the la
 | **Category**            | **Properties**                                                                 |
 |-------------------------|--------------------------------------------------------------------------------|
 | **Assets/devices**      | - Endpoint information<br>- Operating system details<br>- Network interfaces<br>- Agent status<br>- Device classification<br>- SentinelOne criticality data |
-| **Security findings**   | SentinelOne retrieves threat detection findings, malware detections, and security events on the assets that it ingests. |
+| **Security findings**   | SentinelOne retrieves CVE findings on the assets that it ingests. |
 | **Configuration data**  | - Agent configurations<br>- Policy assignments<br>- Compliance status<br>- Protection status |
 
 ## Troubleshooting the SentinelOne data connector
@@ -80,7 +80,7 @@ Here are some common issues that might arise when configuring the SentinelOne Co
 After configuring the SentinelOne data connector:
 
 - [Review your attack surface map](enterprise-exposure-map.md) to see SentinelOne data
-- [Explore security recommendations](security-recommendations.md) based on SentinelOne findings
+- [Explore security recommendations](security-recommendations.md)
 - [Set up security initiatives](initiatives.md) to track remediation progress
 
 ## Related articles

exposure-management/wiz-data-connector.md

@@ -60,7 +60,7 @@ Only devices that were active in the last 90 days are retrieved, based on the la
 | **Category**            | **Properties**                                                                 |
 |-------------------------|--------------------------------------------------------------------------------|
 | **Assets/devices**      | - Cloud provider information<br>- Resource type<br>- IP address<br>- Operating system<br>- Configuration details<br>- Wiz criticality data |
-| **Vulnerability findings** | Wiz retrieves CVE findings and security misconfigurations on the assets that it ingests. |
+| **Vulnerability findings** | Wiz retrieves CVE findings on the assets that it ingests. |
 | **Configuration data**  | - Security groups<br>- Network configurations<br>- Access policies<br>- Compliance status |
 
 ## Troubleshooting the Wiz data connector
@@ -82,7 +82,7 @@ Here are some common issues that might arise when configuring the Wiz Connector,
 After configuring the Wiz data connector:
 
 - [Review your attack surface map](enterprise-exposure-map.md) to see Wiz data
-- [Explore security recommendations](security-recommendations.md) based on Wiz findings
+- [Explore security recommendations](security-recommendations.md)
 - [Set up security initiatives](initiatives.md) to track remediation progress
 
 ## Related articles