Step-by-step: Building a daily executive summary from the API.

Hello everyone! I've noticed a few threads here asking about practical ways to make the mountain of data from the Falcon console actionable for leadership. After refining this process through several iterations (and a few different roles), I wanted to share my step-by-step workflow for building a clean, automated daily executive summary. This isn't about raw data dumps; it’s about curating a high-level narrative on exposure, detection health, and critical incidents that gets emailed every morning.

My goal was always to answer the three questions my executives actually asked:
1. "Are we more or less secure than yesterday?"
2. "Did anything critical happen while I was sleeping?"
3. "Are our tools and teams working effectively?"

Here’s the framework I built to answer those, pulling directly from the Falcon API. The entire process runs on a scheduled workflow in Make (formerly Integromat), but you could adapt this to Zapier, n8n, or a Python script.

**Step 1: Define Your Core Metrics & API Endpoints**
First, I mapped out the key data points and their corresponding API endpoints. This is the most important planning phase. My daily summary pulls from:

* **Overall Exposure Score & Changes:** From the `GET /spotlight/v2/vulnerabilities/host-and-app-counts` and trend endpoints. I track the absolute score and the 7-day trend.
* **Critical/High Severity Detections (Last 24h):** A filtered pull from `GET /detects/queries/detects/v1`. I exclude false positives and benign for this summary.
* **Prevention Policy Health:** From `GET /policy/combined/policy-members/v1`, looking for any hosts reporting as "Prevention Disabled" or "Sensor Uninstalled."
* **Top 5 Hosts by Exposure:** From `GET /spotlight/v2/vulnerabilities/combined/hosts/v2`, sorted by score.

**Step 2: Build the Data Transformation Logic**
The raw API JSON isn't fit for an exec. This step is where you add the context. For example:
- For the exposure score, I don't just show the number. I calculate the day-over-day change and label it as "Improving," "Stable," or "Concerning."
- For detections, I group them by tactic (MITRE ATT&CK) and count them, so the summary shows "3 instances of Credential Access, 1 of Defense Evasion."
- For policy health, I simply flag "All hosts healthy" or list the count of hosts with issues, which triggers a deeper look.

**Step 3: Template Your Narrative Output**
I use a simple HTML template for the email body. Consistency is key here. The structure looks like this:

**CrowdStrike Falcon Executive Summary | [Date]**

**📊 Exposure Overview**
* Overall Score: **82** (Trend: Stable ±0 from yesterday).
* Top 5 Hosts by Exposure: [Hostname1] (92), [Hostname2] (88)...
* Recommended Action: Review patch compliance for the top 2 hosts.

**🔍 Detection Summary (Last 24 Hours)**
* Total Critical/High Severity Detections: **4**
* Breakdown by Tactics: Discovery (2), Exfiltration (1), Lateral Movement (1).
* Notable Incident: [One-line description of the most notable detection].

**✅ System Health**
* Prevention Policy Status: All 1,247 hosts reporting normally.
* Sensor Versions: 98% on the recommended version.

**Step 4: Automate, Schedule, and Iterate**
The workflow runs at 6:00 AM local time. It authenticates to the API, fetches the data from each endpoint, processes it through the transformation steps, populates the template, and sends it via an email connector to a defined distribution list. The whole process is monitored for failures.

The beauty of this system is its adaptability. I’ve since added a weekly version that includes a comparison to the previous week and a brief summary of closed incidents. The initial setup took me a weekend to perfect, but it has saved me countless hours of manual reporting and has made conversations with leadership profoundly more data-driven.

I'm happy to share more specific details on the filter logic for detections or the exact transformation steps in Make if anyone is interested. Just let me know what would be most helpful!

—Hannah