CrowdStrike Falcon
Identity & securityClient credentials
Investigate and respond in CrowdStrike Falcon: search hosts, contain them, triage alerts, find vulnerabilities and manage IOCs.
13 actions
| Action | Effect | Data handled | Scope |
|---|---|---|---|
| crowdstrike_search_hostsSearches hosts by FQL filter (hostname, platform, IP, status and more) and returns full host records | read | Personal data | |
| crowdstrike_get_hostsReturns host details for up to 100 host (agent) ids | read | Personal data | |
| crowdstrike_get_host_online_stateReturns whether each host is online, offline or unknown | read | General | |
| crowdstrike_perform_host_actionNetwork-contains a host or lifts containment, or hides or unhides it | write | General | |
| crowdstrike_update_host_tagsAdds or removes Falcon grouping tags (FalconGroupingTags/<name>) on hosts | write | General | |
| crowdstrike_list_host_groupsLists host groups with their type and assignment rule, by FQL filter | read | General | |
| crowdstrike_list_alertsReturns full alerts matching an FQL filter, newest first by default, with an after token for the next page | read | Personal data | |
| crowdstrike_search_alert_idsReturns the composite ids of alerts matching an FQL filter or free-text search, with offset paging | read | General | |
| crowdstrike_get_alertsReturns alerts by composite id | read | Personal data | |
| crowdstrike_update_alertsChanges the status of alerts, assigns or unassigns them, comments, or adds and removes tags | write | General | |
| crowdstrike_search_vulnerabilitiesSearches Spotlight vulnerabilities by FQL filter, with host, CVE and remediation details on request | read | General | |
| crowdstrike_search_iocsLists custom indicators of compromise (hashes, domains, IPs) by FQL filter | read | General | |
| crowdstrike_create_iocCreates a custom indicator of compromise that Falcon detects or blocks | write | General |