What Changed

The CrowdStrike API Data Connector v3.3.2 introduces sophisticated rate limiting configuration and transitions from preview to General Availability status. The connector now includes custom rate limit handling for the Alerts, Cases, and Detections data types.

Connector Improvements

Three critical enhancements were implemented:

Rate Limit Configuration: Added rateLimitConfig blocks to the polling configuration for Alerts and Detections endpoints with:

  • OnlyWhen429 evaluation mode (responds only to HTTP 429 rate limit errors)
  • Custom header extraction for X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-RetryAfter
  • Retry strategy using reset/retry-after headers for intelligent backoff

GA Status: Connector availability changed from isPreview: true to isPreview: false, indicating production readiness and Microsoft support.

Enhanced Reliability: The rate limiting mechanism prevents API quota exhaustion and connector failures during high-volume ingestion periods.

Security Impact (Visibility & Fidelity)

Prior to this update, deployments could experience ingestion failures when hitting CrowdStrike API rate limits, particularly during alert-heavy periods or when processing detection backlogs. The enhanced rate limiting ensures continuous data flow by:

  • Automatically backing off when API limits are reached
  • Utilizing CrowdStrike rate limit headers for optimal retry timing
  • Preventing connector timeout failures that could create visibility gaps

Deployments using previous versions (≤3.3.1) may experience intermittent data ingestion interruptions during periods of high CrowdStrike alert volume, potentially missing security events during API throttling windows.

Affected Files

Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeAPI_ccp/CrowdStrikeAPI_Definition.json
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeAPI_ccp/CrowdStrikeAPI_PollingConfig.json
(packaging artefacts: 3.3.2.zip, ReleaseNotes.md, Solution_CrowdStrike.json, mainTemplate.json)