An IntelliJ IDEA plugin that integrates CrowdStrike's Falcon Cloud Security (FCS) CLI to provide Infrastructure as Code (IaC) security scanning capabilities directly within your IDE.
- Scan Terraform, CloudFormation, Kubernetes, and other IaC files
- Support for multiple file formats: JSON, YAML, XML, Dockerfile, HCL, Bicep, Properties
- Inline security annotations and highlighting
- Integration with IntelliJ's Problems view
- Dedicated tool window for FCS CLI management
- Configurable scan settings and severity filtering
- Auto-scan on file save (optional)
- Manage FCS CLI binary download, installation and updates
- Configurable target paths
- Severity level filtering (Critical, High, Medium, Low, Info)
- Option to exclude secrets scanning
- IntelliJ IDEA 2025.2 or later
Note
API clients are granted one or more API scopes. Scopes allow access to specific CrowdStrike APIs and describe the actions that an API client can perform. To create an API client, see API Clients and Keys.
The following API scopes are available:
| Scope | Permission |
|---|---|
| Cloud Security Tools Download | READ |
| Infrastructure as Code | READ & WRITE |
- Clone this repository
- Open the project in IntelliJ IDEA
- Run the
buildPluginGradle task - Install the generated plugin file from
build/distributions/
- Go to
File→Settings→Plugins - Click
⚙️→Install Plugin from Disk... - Select the built plugin ZIP file
- Restart IntelliJ IDEA
The plugin requires CrowdStrike Falcon API credentials. You can provide them in two ways:
Set the following environment variables and restart IntelliJ IDEA:
export FALCON_CLIENT_ID="your-client-id"
export FALCON_CLIENT_SECRET="your-client-secret"
export FALCON_CLOUD="us-1" # Optional: us-1, us-2, eu-1, etc.
export FCS_VERSION="latest" # Optional: specific version
export HTTPS_PROXY="proxy-url" # Optional: if using proxyIf environment variables are not set, the plugin will prompt for credentials when downloading the FCS CLI binary.
Access the FCS CLI tool window via:
View→Tool Windows→CrowdStrike FCS CLI- Or click the CrowdStrike icon in the right tool window bar
Configure the following settings:
- Plugin Enabled: Toggle plugin functionality
- Target Path: Directory or file to scan (defaults to project root)
- Severities: Select which severity levels to report
- Exclude Secrets: Skip secrets detection in scans
- Auto-scan on save: Automatically scan files when saved
- Scan Timeout: Timeout for CLI scans in seconds. Increase this for large workspaces or slow machines. Defaults to 300 seconds.
- Platforms: Restrict scans to specific IaC platforms. Leave empty to scan all platforms. Valid values are
Ansible,AzureResourceManager,CloudFormation,Crossplane,DockerCompose,Dockerfile,GoogleDeploymentManager,Kubernetes,OpenAPI,Pulumi,ServerlessFW, andTerraform.
- Open the CrowdStrike FCS CLI tool window
- Click "Download FCS CLI" to install the binary
- Configure your scan settings as needed
- Enable the plugin if not already enabled
- Scan-on-open: Scans will invoke automatically when an IaC file within the Target Path is opened
- Auto-scan: Enable "Auto-scan on save" to scan files and update annotations automatically when saved
- View Results: Security issues appear as inline annotations and in the Problems view
- Security issues are highlighted directly in the editor
- Severity levels are color-coded and filterable
- Detailed information appears in the Problems view
- Raw scan output is available in the tool window
src/
├── main/
│ ├── kotlin/com/crowdstrike/fcscliplugin/
│ │ ├── FCSToolWindowFactory.kt # Main UI component
│ │ ├── annotators/
│ │ │ └── FCSExternalAnnotator.kt # Real-time annotations
│ │ ├── filetypes/
│ │ │ └── FCSFileTypes.kt # Custom file type support
│ │ ├── inspections/
│ │ │ └── FCSInspection.kt # Problems view integration
│ │ └── services/
│ │ ├── FCSBinaryService.kt # Binary management
│ │ ├── FCSConfigurationService.kt # Settings persistence
│ │ ├── FCSFileScanTriggerService.kt # Auto-scan functionality
│ │ └── FCSResultsService.kt # Results processing
│ └── resources/
│ ├── META-INF/plugin.xml # Plugin manifest
│ ├── icons/ # UI icons
│ ├── messages/ # Localization
│ └── scripts/fcs_download.sh # Binary download script
├── test/
│ └── kotlin/com/crowdstrike/fcscliplugin/ # Unit test suite
testData/
└── sample-project/ # IaC fixtures used by tests and runIde
# Build the plugin
./gradlew buildPlugin
# Run in IDE for testing
./gradlew runIde
# Run tests
./gradlew test
# Verify plugin compatibility
./gradlew verifyPluginThe project includes predefined run configurations:
| Configuration | Description |
|---|---|
| Run Plugin | Launches IntelliJ IDEA with the plugin installed for testing |
| Run Tests | Executes the plugin test suite |
| Run Verifications | Validates plugin compatibility with specified IntelliJ versions |
- Ensure you have valid CrowdStrike API credentials
- Click "Download FCS CLI" in the tool window
- Check that the binary was downloaded to the correct location
- Verify your Client ID and Client Secret are correct
- Ensure you have proper API Scope in CrowdStrike Falcon
- Try setting environment variables and restarting IntelliJ
- Check that the plugin is enabled in the tool window
- Verify the target path is correct
- Ensure the file types are supported
- Check the Idea log for detailed error messages
- Disable auto-scan on save for large projects
- Adjust severity filters to reduce noise
- Use specific target paths instead of targeting entire project
See CONTRIBUTING.md for setup instructions, how to run tests locally, and the release process.
See LICENSE.txt.
For support with this plugin:
- Check the CrowdStrike Documentation
- Review IntelliJ Plugin Development guides
- Submit issues via the project repository