Skip to content
Try for free
On this page

Integrations

CrowdStrike

Investigate and respond to CrowdStrike Falcon alerts, hosts, IOCs, and vulnerabilities

CrowdStrike is a cybersecurity platform providing endpoint protection, threat intelligence, and identity security through its Falcon suite. This integration authenticates with a Falcon API client ID and secret against a chosen cloud region and covers the Alerts, Hosts, Host Groups, IOC Management, Spotlight, Real Time Response, Case Management, and Identity Protection APIs.

With this integration, you can:

  • Triage alerts: Search Falcon alerts with Falcon Query Language, pull full alert records by composite ID, and update status, assignment, tags, comments, and console visibility
  • Respond on hosts: Contain or lift containment on a host, and hide or unhide it from the Falcon console
  • Manage host groups: Search groups, read group details, and add or remove hosts from static groups
  • Manage custom indicators: Search, read, create, update, and delete indicators of compromise
  • Review vulnerabilities: Query Spotlight vulnerabilities and read CVE, host, application, and remediation details
  • Run read-only Real Time Response: Open a session, run a documented read-only command, poll for output, and close the session
  • Read cases: Search Case Management cases and read case details
  • Query identity sensors: Search Identity Protection sensors, fetch sensor details, and run aggregate queries

Each operation maps to a specific Falcon API scope — for example Alerts: Read and Alerts: Write, Hosts: Write for containment, Host groups: Read/Write, IOC Management: Read/Write, Vulnerabilities: Read, Real time response: Read, and Cases: Read. Containment and indicator deletion change live protection behavior, so scope the credential to only the operations your workflows need.

Note that CrowdStrike decommissioned the legacy Detects API (September 30, 2025) and the CrowdScore Incidents API (March 9, 2026). This integration uses the current Alerts API and Case Management API in their place.

Use the block

Triage alerts, contain hosts, manage host groups and custom indicators of compromise, review Spotlight vulnerabilities, run read-only Real Time Response commands, read Case Management cases, and query Identity Protection sensors.

Actions

CrowdStrike Create Indicators

Create custom CrowdStrike Falcon indicators of compromise (POST /iocs/entities/indicators/v1). Each indicator can allow, detect, or block activity across the fleet, so a wrong value can suppress detections or break legitimate software. Requires the "IOC Management: Write" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
indicatorsjsonYesJSON array of indicators to create. Each entry requires type, value, and applied_globally (boolean). type is one of sha256, md5, domain, ipv4, ipv6; action is one of no_action, allow, prevent, detect (prevent_no_ui is widely reported and appears in the Falcon console, but CrowdStrike does not enumerate it in the IOC API docs - call GET /iocs/queries/actions/v1 to read the actions your tenant actually accepts); severity is one of informational, low, medium, high, critical; platforms entries are windows, mac, or linux. Other documented fields: host_groups (array), description, source, tags (array), expiration (ISO 8601), mobile_action, metadata ({ filename }). Either applied_globally must be true or host_groups must be supplied. Tenants can extend these value sets, so treat them as the documented defaults rather than a closed list.
commentstringNoAudit comment explaining why these indicators were created
retrodetectsbooleanNoWhether to generate retroactive detections for the new indicators
ignoreWarningsbooleanNoWhether to create the indicators even when CrowdStrike returns warnings

Output

ParameterTypeDescription
indicatorsarrayCreated CrowdStrike indicator records
↳ idstringIndicator identifier
↳ typestringIndicator type
↳ valuestringIndicator value
↳ actionstringAction taken when the indicator matches
↳ mobileActionstringAction taken on mobile platforms when the indicator matches
↳ severitystringIndicator severity
↳ descriptionstringIndicator description
↳ sourcestringIndicator source
↳ appliedGloballybooleanWhether the indicator applies to all hosts
↳ platformsarrayPlatforms the indicator applies to
↳ hostGroupsarrayHost group IDs the indicator is scoped to
↳ tagsarrayTags applied to the indicator
↳ expirationstringIndicator expiration timestamp
↳ expiredbooleanWhether the indicator has expired
↳ deletedbooleanWhether the indicator is deleted
↳ fromParentbooleanWhether the indicator was inherited from a parent CID
↳ parentCidNamestringParent CID name
↳ createdBystringUser who created the indicator
↳ createdOnstringIndicator creation timestamp
↳ modifiedBystringUser who last modified the indicator
↳ modifiedOnstringIndicator modification timestamp
↳ metadatajsonFile metadata CrowdStrike resolved for the indicator
↳ avHitsnumberAntivirus hit count
↳ companyNamestringCompany name
↳ fileDescriptionstringFile description
↳ fileVersionstringFile version
↳ filenamestringFile name
↳ originalFilenamestringOriginal file name
↳ productNamestringProduct name
↳ productVersionstringProduct version
↳ signedbooleanWhether the file is signed
countnumberNumber of indicators created
errorsarrayErrors CrowdStrike returned alongside a partially successful response
↳ codenumberCrowdStrike error code
↳ idstringIdentifier the error applies to
↳ messagestringError message

CrowdStrike Delete Indicators

Permanently delete custom CrowdStrike Falcon indicators of compromise (DELETE /iocs/entities/indicators/v1). Cannot be undone; deleting a blocking indicator removes that protection from every host, and a broad filter can delete far more than intended. Supply an ID list or a filter, never both -- CrowdStrike lets a filter silently override the IDs, so this tool rejects that instead. Requires the "IOC Management: Write" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
indicatorIdsjsonNoJSON array of CrowdStrike IOC IDs to delete. Cannot be combined with a filter.
filterstringNoFalcon Query Language filter selecting indicators to delete in bulk. Cannot be combined with an ID list.
commentstringNoAudit comment explaining why these indicators were deleted

Output

ParameterTypeDescription
deletedIdsarrayIOC IDs CrowdStrike deleted
countnumberNumber of indicators deleted
errorsarrayErrors CrowdStrike returned alongside a partially successful response
↳ codenumberCrowdStrike error code
↳ idstringIdentifier the error applies to
↳ messagestringError message

CrowdStrike Delete RTR Session

Close an open CrowdStrike Falcon Real Time Response session (DELETE /real-time-response/entities/sessions/v1). Requires the "Real time response: Read" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
sessionIdstringYesRTR session ID to close

Output

ParameterTypeDescription
sessionIdstringRTR session ID that was closed
deletedbooleanWhether CrowdStrike accepted the session deletion
errorsarrayErrors CrowdStrike returned alongside a partially successful response
↳ codenumberCrowdStrike error code
↳ idstringIdentifier the error applies to
↳ messagestringError message

CrowdStrike Execute RTR Command

Run a read-only Real Time Response command in an open CrowdStrike Falcon session (POST /real-time-response/entities/command/v1). baseCommand names the family only (cat, cd, clear, csrutil, env, eventlog, filehash, getsid, help, history, ifconfig, ipconfig, ls, mount, netstat, ps, reg, users); subcommands go in commandString. Host-modifying commands need the Active Responder or Admin endpoints. Requires the "Real time response: Read" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
sessionIdstringYesRTR session ID returned by Init RTR Session
baseCommandstringYesRead-only RTR base command family, one of: cat, cd, clear, csrutil, env, eventlog, filehash, getsid, help, history, ifconfig, ipconfig, ls, mount, netstat, ps, reg, users. Subcommands belong in commandString, not here — and only reg query is read-tier, since reg set and reg delete are Active Responder commands.
commandStringstringYesFull command line to run, such as "ls C:\Windows" or "reg query HKLM\Software"

Output

ParameterTypeDescription
cloudRequestIdstringCloud request ID to poll for command output
sessionIdstringRTR session the command ran in
queuedCommandOfflinebooleanWhether the command was queued for an offline host
errorsarrayErrors CrowdStrike returned alongside a partially successful response
↳ codenumberCrowdStrike error code
↳ idstringIdentifier the error applies to
↳ messagestringError message

CrowdStrike Get Alert Details

Get full CrowdStrike Falcon alert records for one or more composite alert IDs (POST /alerts/entities/alerts/v2). Requires the "Alerts: Read" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
compositeIdsjsonYesJSON array of CrowdStrike composite alert IDs
includeHiddenbooleanNoInclude previously hidden alerts (CrowdStrike defaults this to true)

Output

ParameterTypeDescription
alertsarrayCrowdStrike alert records
↳ compositeIdstringComposite alert ID
↳ idstringAlert ID
↳ cidstringCrowdStrike customer identifier
↳ aggregateIdstringAggregate identifier
↳ agentIdstringAgent (sensor) identifier
↳ deviceIdstringDevice identifier from the alert device
↳ hostnamestringHostname from the alert device
↳ namestringAlert name
↳ displayNamestringAlert display name
↳ descriptionstringAlert description
↳ typestringAlert type
↳ productstringFalcon product that raised the alert
↳ platformstringPlatform the alert was raised on
↳ severitynumberNumeric severity
↳ severityNamestringSeverity name
↳ confidencenumberConfidence score
↳ statusstringAlert status
↳ assignedToNamestringAssignee display name
↳ assignedToUidstringAssignee user ID
↳ assignedToUuidstringAssignee user UUID
↳ tacticstringMITRE ATT&CK tactic
↳ tacticIdstringMITRE ATT&CK tactic ID
↳ techniquestringMITRE ATT&CK technique
↳ techniqueIdstringMITRE ATT&CK technique ID
↳ scenariostringAlert scenario
↳ objectivestringAdversary objective
↳ resolutionstringAlert resolution
↳ showInUibooleanWhether the alert is shown in Falcon
↳ tagsarrayTags applied to the alert
↳ filenamestringTriggering file name
↳ filepathstringTriggering file path
↳ cmdlinestringTriggering command line
↳ sha256stringSHA256 of the triggering file
↳ sha1stringSHA1 of the triggering file
↳ md5stringMD5 of the triggering file
↳ userNamestringUser name associated with the alert
↳ userIdstringUser ID associated with the alert
↳ patternIdnumberDetection pattern ID
↳ falconHostLinkstringDeep link into the Falcon console
↳ controlGraphIdstringControl graph identifier
↳ externalbooleanWhether the alert is external
↳ emailSentbooleanWhether a notification email was sent
↳ isAggregatedbooleanWhether the alert is aggregated
↳ isFalconPlatformIoabooleanWhether the alert is a Falcon platform IOA
↳ dataDomainsarrayData domains the alert belongs to
↳ iocValuesarrayIndicator values associated with the alert
↳ linkedCaseIdsarrayCase IDs linked to the alert
↳ linkedBehavioralDetectionsarrayBehavioral detection IDs linked to the alert
↳ timestampstringAlert timestamp
↳ createdTimestampstringAlert creation timestamp
↳ updatedTimestampstringAlert update timestamp
↳ crawledTimestampstringAlert crawl timestamp
↳ contextTimestampstringAlert context timestamp
countnumberNumber of alerts returned
errorsarrayErrors CrowdStrike returned alongside a partially successful response
↳ codenumberCrowdStrike error code
↳ idstringIdentifier the error applies to
↳ messagestringError message

CrowdStrike Get Case Details

Get CrowdStrike Falcon Case Management case records for one or more case IDs (POST /cases/entities/cases/v2). Requires the "Cases: Read" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
caseIdsjsonYesJSON array of CrowdStrike case IDs

Output

ParameterTypeDescription
casesarrayCrowdStrike Case Management case records
↳ idstringCase identifier
↳ cidstringCrowdStrike customer identifier
↳ namestringCase name
↳ descriptionstringCase description
↳ descriptionFormatstringFormat of the case description
↳ statusstringCase status
↳ severitynumberNumeric case severity
↳ severityLevelstringCase severity level name
↳ referenceIdstringHuman-readable case reference ID
↳ versionnumberCase version for optimistic concurrency
↳ tagsarrayTags applied to the case
↳ assignedTojsonFalcon user the case is assigned to
↳ uuidstringFalcon user UUID
↳ emailstringFalcon user email
↳ fullNamestringFalcon user full name
↳ createdByjsonFalcon user who created the case
↳ uuidstringFalcon user UUID
↳ emailstringFalcon user email
↳ fullNamestringFalcon user full name
↳ lastUpdatedByjsonFalcon user who last updated the case
↳ uuidstringFalcon user UUID
↳ emailstringFalcon user email
↳ fullNamestringFalcon user full name
↳ createdTimestampstringCase creation timestamp
↳ updatedTimestampstringCase update timestamp
↳ startTimestampstringCase start timestamp
↳ endTimestampstringCase end timestamp
↳ templateIdstringCase template identifier
↳ templateNamestringCase template name
↳ slaIdstringSLA identifier applied to the case
↳ slaNamestringSLA name applied to the case
↳ isReadOnlybooleanWhether the case is read only
countnumberNumber of cases returned
errorsarrayErrors CrowdStrike returned alongside a partially successful response
↳ codenumberCrowdStrike error code
↳ idstringIdentifier the error applies to
↳ messagestringError message

CrowdStrike Get Host Group Details

Get CrowdStrike Falcon host group records for one or more group IDs (GET /devices/entities/host-groups/v1). Requires the "Host groups: Read" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
hostGroupIdsjsonYesJSON array of CrowdStrike host group IDs

Output

ParameterTypeDescription
hostGroupsarrayCrowdStrike host group records
↳ idstringHost group identifier
↳ namestringHost group name
↳ descriptionstringHost group description
↳ groupTypestringGroup type (static, dynamic, staticByID)
↳ assignmentRulestringFQL assignment rule for dynamic groups
↳ createdBystringUser who created the group
↳ createdTimestampstringGroup creation timestamp
↳ modifiedBystringUser who last modified the group
↳ modifiedTimestampstringGroup modification timestamp
countnumberNumber of host groups returned
errorsarrayErrors CrowdStrike returned alongside a partially successful response
↳ codenumberCrowdStrike error code
↳ idstringIdentifier the error applies to
↳ messagestringError message

CrowdStrike Get Indicator Details

Get custom CrowdStrike Falcon indicator of compromise (IOC) records for one or more IOC IDs (GET /iocs/entities/indicators/v1). Requires the "IOC Management: Read" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
indicatorIdsjsonYesJSON array of CrowdStrike IOC IDs

Output

ParameterTypeDescription
indicatorsarrayCrowdStrike indicator of compromise records
↳ idstringIndicator identifier
↳ typestringIndicator type
↳ valuestringIndicator value
↳ actionstringAction taken when the indicator matches
↳ mobileActionstringAction taken on mobile platforms when the indicator matches
↳ severitystringIndicator severity
↳ descriptionstringIndicator description
↳ sourcestringIndicator source
↳ appliedGloballybooleanWhether the indicator applies to all hosts
↳ platformsarrayPlatforms the indicator applies to
↳ hostGroupsarrayHost group IDs the indicator is scoped to
↳ tagsarrayTags applied to the indicator
↳ expirationstringIndicator expiration timestamp
↳ expiredbooleanWhether the indicator has expired
↳ deletedbooleanWhether the indicator is deleted
↳ fromParentbooleanWhether the indicator was inherited from a parent CID
↳ parentCidNamestringParent CID name
↳ createdBystringUser who created the indicator
↳ createdOnstringIndicator creation timestamp
↳ modifiedBystringUser who last modified the indicator
↳ modifiedOnstringIndicator modification timestamp
↳ metadatajsonFile metadata CrowdStrike resolved for the indicator
↳ avHitsnumberAntivirus hit count
↳ companyNamestringCompany name
↳ fileDescriptionstringFile description
↳ fileVersionstringFile version
↳ filenamestringFile name
↳ originalFilenamestringOriginal file name
↳ productNamestringProduct name
↳ productVersionstringProduct version
↳ signedbooleanWhether the file is signed
countnumberNumber of indicators returned
errorsarrayErrors CrowdStrike returned alongside a partially successful response
↳ codenumberCrowdStrike error code
↳ idstringIdentifier the error applies to
↳ messagestringError message

CrowdStrike Get RTR Command Status

Get the status and output of a Real Time Response command by cloud request ID (GET /real-time-response/entities/command/v1). Long output is chunked across sequences, so increment the sequence ID to read the next chunk. Requires the "Real time response: Read" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
cloudRequestIdstringYesCloud request ID returned by Execute RTR Command
sequenceIdnumberNoOutput chunk to retrieve, starting at 0

Output

ParameterTypeDescription
completebooleanWhether the command has finished running
stdoutstringStandard output from the command
stderrstringStandard error from the command
baseCommandstringBase command that was run
sessionIdstringRTR session the command ran in
taskIdstringTask identifier for the command
sequenceIdnumberOutput chunk sequence this response covers
errorsarrayErrors CrowdStrike returned alongside a partially successful response
↳ codenumberCrowdStrike error code
↳ idstringIdentifier the error applies to
↳ messagestringError message

CrowdStrike Get Sensor Aggregates

Aggregate CrowdStrike Identity Protection sensors from a JSON aggregate query body (POST /identity-protection/aggregates/devices/GET/v1). These are the domain controllers Falcon Identity Protection monitors, not Falcon endpoint sensors. Requires the "Identity Protection Entities: Read" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
aggregateQueryjsonYesJSON aggregate query body documented by CrowdStrike for sensor aggregates

Output

ParameterTypeDescription
aggregatesarrayAggregate result groups returned by CrowdStrike
↳ bucketsarrayBuckets within the aggregate result
↳ countnumberBucket document count
↳ fromnumberBucket lower bound
↳ keyAsStringstringString representation of the bucket key
↳ labeljsonBucket label object
↳ stringFromstringString lower bound
↳ stringTostringString upper bound
↳ subAggregatesarrayNested aggregate results for this bucket
↳ tonumberBucket upper bound
↳ valuenumberBucket metric value
↳ valueAsStringstringString representation of the bucket value
↳ docCountErrorUpperBoundnumberUpper bound for bucket count error
↳ namestringAggregate result name
↳ sumOtherDocCountnumberDocument count not included in the returned buckets
countnumberNumber of aggregate result groups returned
errorsarrayErrors CrowdStrike returned alongside a partially successful response
↳ codenumberCrowdStrike error code
↳ idstringIdentifier the error applies to
↳ messagestringError message

CrowdStrike Get Sensor Details

Get CrowdStrike Identity Protection sensor details for one or more device IDs (POST /identity-protection/entities/devices/GET/v1). These are the domain controllers Falcon Identity Protection monitors, not Falcon endpoint sensors. Requires the "Identity Protection Entities: Read" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
idsjsonYesJSON array of CrowdStrike sensor device IDs

Output

ParameterTypeDescription
sensorsarrayCrowdStrike identity sensor detail records
↳ agentVersionstringSensor agent version
↳ cidstringCrowdStrike customer identifier
↳ deviceIdstringSensor device identifier
↳ heartbeatTimenumberLast heartbeat timestamp
↳ hostnamestringSensor hostname
↳ idpPolicyIdstringAssigned Identity Protection policy ID
↳ idpPolicyNamestringAssigned Identity Protection policy name
↳ ipAddressstringSensor local IP address
↳ kerberosConfigstringKerberos configuration status
↳ ldapConfigstringLDAP configuration status
↳ ldapsConfigstringLDAPS configuration status
↳ machineDomainstringMachine domain
↳ ntlmConfigstringNTLM configuration status
↳ osVersionstringOperating system version
↳ rdpToDcConfigstringRDP to domain controller configuration status
↳ smbToDcConfigstringSMB to domain controller configuration status
↳ statusstringSensor protection status
↳ statusCausesarrayDocumented causes behind the current status
↳ tiEnabledstringThreat intelligence enablement status
countnumberNumber of sensors returned
paginationjsonPagination metadata (limit, offset, total)
↳ limitnumberPage size used for the query
↳ offsetnumberOffset returned by CrowdStrike
↳ totalnumberTotal records available
errorsarrayErrors CrowdStrike returned alongside a partially successful response
↳ codenumberCrowdStrike error code
↳ idstringIdentifier the error applies to
↳ messagestringError message

CrowdStrike Get Vulnerability Details

Get CrowdStrike Falcon Spotlight vulnerability records for one or more vulnerability IDs, including CVE, affected host, application, and remediation details (GET /spotlight/entities/vulnerabilities/v2). Requires the spotlight-vulnerabilities:read API scope, shown as "Vulnerabilities: Read" in the Falcon API client UI.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
vulnerabilityIdsjsonYesJSON array of Spotlight vulnerability IDs (maximum 400 per request)

Output

ParameterTypeDescription
vulnerabilitiesarrayCrowdStrike Spotlight vulnerability records
↳ idstringVulnerability identifier
↳ aidstringAgent identifier of the affected host
↳ cidstringCrowdStrike customer identifier
↳ statusstringVulnerability status (open, closed, reopen)
↳ confidencestringDetection confidence
↳ vulnerabilityIdstringUnderlying vulnerability ID
↳ createdTimestampstringCreation timestamp
↳ updatedTimestampstringLast update timestamp
↳ closedTimestampstringClosure timestamp
↳ cvejsonCVE details for the vulnerability
↳ idstringCVE identifier
↳ baseScorenumberCVSS base score
↳ severitystringCVE severity
↳ exprtRatingstringCrowdStrike ExPRT rating
↳ exploitStatusnumberExploit status code
↳ exploitabilityScorenumberCVSS exploitability score
↳ impactScorenumberCVSS impact score
↳ remediationLevelstringCVSS remediation level
↳ descriptionstringCVE description
↳ publishedDatestringCVE publication date
↳ vectorstringCVSS vector string
↳ typesarrayCVE types
↳ isCisaKevbooleanWhether the CVE is in the CISA Known Exploited Vulnerabilities catalog
↳ cisaDueDatestringCISA remediation due date
↳ appjsonAffected application
↳ productNameNormalizedstringNormalized product name
↳ productNameVersionstringProduct name and version
↳ vendorNormalizedstringNormalized vendor name
↳ hostInfojsonAffected host details
↳ hostnamestringHost name
↳ localIpstringLocal IP address
↳ machineDomainstringMachine domain
↳ osVersionstringOperating system version
↳ platformstringPlatform name
↳ productTypeDescstringProduct type description
↳ assetCriticalitystringAsset criticality
↳ internetExposurestringInternet exposure
↳ tagsarrayHost tags
↳ groupsarrayHost group names the host belongs to
↳ remediationIdsarrayRemediation IDs for the vulnerability
↳ remediationsarrayRemediation entities for the vulnerability
↳ idstringRemediation identifier
↳ titlestringRemediation title
↳ actionstringRemediation action
↳ typestringRemediation type
↳ linkstringRemediation link
↳ referencestringRemediation reference
↳ vendorUrlstringVendor advisory URL
↳ suppressionInfojsonSuppression state for the vulnerability
↳ isSuppressedbooleanWhether the finding is suppressed
↳ reasonstringSuppression reason
countnumberNumber of vulnerabilities returned
errorsarrayErrors CrowdStrike returned alongside a partially successful response
↳ codenumberCrowdStrike error code
↳ idstringIdentifier the error applies to
↳ messagestringError message

CrowdStrike Init RTR Session

Open a CrowdStrike Falcon Real Time Response session against a host so read-only commands can be run on it (POST /real-time-response/entities/sessions/v1). This connects a live remote shell to the endpoint. Requires the "Real time response: Read" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
deviceIdstringYesCrowdStrike host agent ID (AID) to open the session against
queueOfflinebooleanNoQueue the session so it runs when an offline host comes back online
originstringNoOptional session origin string recorded by CrowdStrike

Output

ParameterTypeDescription
sessionIdstringRTR session ID to use for subsequent commands
deviceIdstringHost agent ID for the session
platformstringPlatform of the connected host
pwdstringWorking directory the session started in
offlineQueuedbooleanWhether the session was queued for an offline host
existingAidSessionsnumberNumber of sessions already open against this host
createdAtstringSession creation timestamp
errorsarrayErrors CrowdStrike returned alongside a partially successful response
↳ codenumberCrowdStrike error code
↳ idstringIdentifier the error applies to
↳ messagestringError message

CrowdStrike Perform Host Action

Act on CrowdStrike Falcon hosts (POST /devices/entities/devices-actions/v2). Actions: contain, lift_containment, hide_host, unhide_host, detection_suppress, detection_unsuppress. contain network-isolates the host so it can only reach the Falcon cloud; hide_host removes the host record from the console. Both are immediately disruptive. Up to 100 host IDs per call. Requires the "Hosts: Write" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
actionNamestringYesAction to take: contain, lift_containment, hide_host, unhide_host, detection_suppress, or detection_unsuppress. "contain" network-isolates the host; "hide_host" removes it from the Falcon console.
deviceIdsjsonYesJSON array of up to 100 CrowdStrike host agent IDs (AIDs) to act on

Output

ParameterTypeDescription
affectedarrayEntities affected by the action
↳ idstringAffected entity identifier
↳ pathstringAPI path of the affected entity
countnumberNumber of hosts the action was applied to
errorsarrayErrors CrowdStrike returned alongside a partially successful response
↳ codenumberCrowdStrike error code
↳ idstringIdentifier the error applies to
↳ messagestringError message

CrowdStrike Perform Host Group Action

Add hosts to or remove hosts from a CrowdStrike Falcon static host group (POST /devices/entities/host-group-actions/v1). Group membership drives policy assignment, so changing it changes which policies apply to those hosts. Requires the "Host groups: Write" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
actionNamestringYesAction to take: add-hosts or remove-hosts
hostGroupIdstringYesCrowdStrike host group ID to modify (static groups only)
deviceIdsjsonYesJSON array of CrowdStrike host agent IDs (AIDs) to add to or remove from the group

Output

ParameterTypeDescription
hostGroupsarrayHost group records returned after the action
↳ idstringHost group identifier
↳ namestringHost group name
↳ descriptionstringHost group description
↳ groupTypestringGroup type (static, dynamic, staticByID)
↳ assignmentRulestringFQL assignment rule for dynamic groups
↳ createdBystringUser who created the group
↳ createdTimestampstringGroup creation timestamp
↳ modifiedBystringUser who last modified the group
↳ modifiedTimestampstringGroup modification timestamp
countnumberNumber of host group records returned
errorsarrayErrors CrowdStrike returned alongside a partially successful response
↳ codenumberCrowdStrike error code
↳ idstringIdentifier the error applies to
↳ messagestringError message

CrowdStrike Query Alerts

Search CrowdStrike Falcon alerts with a Falcon Query Language filter and return their composite IDs. Uses the current Alerts API (GET /alerts/queries/alerts/v2), which replaced the Detects API decommissioned on September 30, 2025. Requires the "Alerts: Read" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
filterstringNoFalcon Query Language filter over alert fields
qstringNoFree-text search across all alert metadata
limitnumberNoMaximum number of alert IDs to return (max 10000)
offsetnumberNoPagination offset for the alert query
sortstringNoSort expression such as "created_timestamp|desc"
includeHiddenbooleanNoInclude previously hidden alerts (CrowdStrike defaults this to true)

Output

ParameterTypeDescription
alertIdsarrayComposite alert IDs matching the query, ready for Get Alert Details
countnumberNumber of alert IDs returned
paginationjsonPagination metadata (limit, offset, total)
↳ limitnumberPage size used for the query
↳ offsetnumberOffset returned by CrowdStrike
↳ totalnumberTotal records available

CrowdStrike Query Cases

Search CrowdStrike Falcon Case Management cases with a Falcon Query Language filter and return their IDs (GET /cases/queries/cases/v1). Case Management supersedes the CrowdScore Incidents API, which CrowdStrike has removed from its published API spec. Requires the "Cases: Read" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
filterstringNoFalcon Query Language filter. Exact-match fields include cid and id; wildcard fields include assigned_to_name and assigned_to_uuid; range fields include created_timestamp and updated_timestamp.
qstringNoFree-text search across all case metadata
limitnumberNoMaximum number of case IDs to return (max 10000, default 100)
offsetnumberNoPagination offset for the case query
sortstringNoSort expression such as "created_timestamp|desc" or "status|asc"

Output

ParameterTypeDescription
caseIdsarrayCase IDs matching the query
countnumberNumber of case IDs returned
paginationjsonPagination metadata (limit, offset, total)
↳ limitnumberPage size used for the query
↳ offsetnumberOffset returned by CrowdStrike
↳ totalnumberTotal records available

CrowdStrike Query Host Groups

Search CrowdStrike Falcon host groups with a Falcon Query Language filter and return their IDs (GET /devices/queries/host-groups/v1). Requires the "Host groups: Read" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
filterstringNoFalcon Query Language filter over host group fields
limitnumberNoMaximum number of host group IDs to return (1-5000)
offsetnumberNoPagination offset for the host group query
sortstringNoSort expression such as "name.asc" or "modified_timestamp.desc"

Output

ParameterTypeDescription
hostGroupIdsarrayHost group IDs matching the query
countnumberNumber of host group IDs returned
paginationjsonPagination metadata (limit, offset, total)
↳ limitnumberPage size used for the query
↳ offsetnumberOffset returned by CrowdStrike
↳ totalnumberTotal records available

CrowdStrike Query Indicators

Search custom CrowdStrike Falcon indicators of compromise (IOCs) with a Falcon Query Language filter and return their IDs (GET /iocs/queries/indicators/v1). Requires the "IOC Management: Read" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
filterstringNoFalcon Query Language filter over IOC fields
limitnumberNoMaximum number of IOC IDs to return (default 100). CrowdStrike publishes no maximum for this endpoint; Sim caps it at 500 to keep a single request bounded
offsetnumberNoPagination offset. Mutually exclusive with the after cursor; use after beyond 10,000 IOCs.
afterstringNoPagination cursor from a previous response. Mutually exclusive with offset.
sortstringNoSort expression. Supported fields include action, applied_globally, created_by, created_on, expiration, expired, modified_by, modified_on, severity_number, source, type, and value.

Output

ParameterTypeDescription
indicatorIdsarrayIOC IDs matching the query
countnumberNumber of IOC IDs returned
paginationjsonPagination metadata (limit, offset, total, after)
↳ limitnumberPage size used for the query
↳ offsetnumberOffset returned by CrowdStrike
↳ totalnumberTotal records available
↳ afterstringCursor for the next page

CrowdStrike Query Sensors

Search CrowdStrike Identity Protection sensors -- the domain controllers Falcon Identity Protection monitors, not Falcon endpoint sensors -- and return their device IDs (GET /identity-protection/queries/devices/v1). Sort uses the dot form, for example status.desc. Requires the "Identity Protection Entities: Read" API scope, a separate entitlement from Hosts and Alerts.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
filterstringNoFalcon Query Language filter for identity sensor search
limitnumberNoMaximum number of sensor records to return
offsetnumberNoPagination offset for the identity sensor query
sortstringNoSort expression for identity sensor results

Output

ParameterTypeDescription
sensorsarrayMatching CrowdStrike identity sensor records
↳ agentVersionstringSensor agent version
↳ cidstringCrowdStrike customer identifier
↳ deviceIdstringSensor device identifier
↳ heartbeatTimenumberLast heartbeat timestamp
↳ hostnamestringSensor hostname
↳ idpPolicyIdstringAssigned Identity Protection policy ID
↳ idpPolicyNamestringAssigned Identity Protection policy name
↳ ipAddressstringSensor local IP address
↳ kerberosConfigstringKerberos configuration status
↳ ldapConfigstringLDAP configuration status
↳ ldapsConfigstringLDAPS configuration status
↳ machineDomainstringMachine domain
↳ ntlmConfigstringNTLM configuration status
↳ osVersionstringOperating system version
↳ rdpToDcConfigstringRDP to domain controller configuration status
↳ smbToDcConfigstringSMB to domain controller configuration status
↳ statusstringSensor protection status
↳ statusCausesarrayDocumented causes behind the current status
↳ tiEnabledstringThreat intelligence enablement status
countnumberNumber of sensors returned
paginationjsonPagination metadata (limit, offset, total)
↳ limitnumberPage size used for the query
↳ offsetnumberOffset returned by CrowdStrike
↳ totalnumberTotal records available
errorsarrayErrors CrowdStrike returned alongside a partially successful response
↳ codenumberCrowdStrike error code
↳ idstringIdentifier the error applies to
↳ messagestringError message

CrowdStrike Query Vulnerabilities

Search CrowdStrike Falcon Spotlight vulnerabilities with a required Falcon Query Language filter and return their IDs (GET /spotlight/queries/vulnerabilities/v1). Requires the spotlight-vulnerabilities:read API scope, shown as "Vulnerabilities: Read" in the Falcon API client UI.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
filterstringYesFalcon Query Language filter (required by Spotlight). Filterable fields include status, aid, cid, last_seen_within, cve.id, cve.severity, cve.exprt_rating, cve.is_cisa_kev, cve.base_score, host_info.platform_name, host_info.groups, host_info.tags, host_info.internet_exposure, and suppression_info.is_suppressed.
limitnumberNoMaximum number of vulnerability IDs to return (1-400, default 100)
afterstringNoPagination cursor from a previous response. Spotlight does not support offset.
sortstringNoSort expression such as "updated_timestamp|desc" or "closed_timestamp|asc"

Output

ParameterTypeDescription
vulnerabilityIdsarraySpotlight vulnerability IDs matching the query
countnumberNumber of vulnerability IDs returned
paginationjsonCursor pagination metadata (limit, total, after)
↳ limitnumberPage size used for the query
↳ totalnumberTotal records available
↳ afterstringCursor for the next page

CrowdStrike Update Alerts

Update CrowdStrike Falcon alerts by composite ID: change status, assign or unassign an analyst, add or remove tags, append a comment, or toggle visibility (PATCH /alerts/entities/alerts/v3). This modifies live alerts in the Falcon console. Requires the "Alerts: Write" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
compositeIdsjsonYesJSON array of CrowdStrike composite alert IDs to update
updateStatusstringNoNew alert status: new, in_progress, reopened, or closed
assignToUuidstringNoAssign the alert to this Falcon user UUID
assignToUserIdstringNoAssign the alert to this Falcon user ID, such as user@example.com
assignToNamestringNoAssign the alert to this Falcon username, such as John Doe
unassignbooleanNoClear the assigned user UUID, user ID, and username from the alert
appendCommentstringNoComment to append to the alert in the Falcon console
addTagstringNoTag to add to the alert
removeTagstringNoTag to remove from the alert
removeTagsByPrefixstringNoRemove every tag on the alert that starts with this prefix
showInUibooleanNoWhether the alert is displayed in the Falcon console
actionParametersjsonNoRaw JSON array of additional CrowdStrike action parameters, each shaped { "name": string, "value": string }
includeHiddenbooleanNoInclude previously hidden alerts (CrowdStrike defaults this to true)

Output

ParameterTypeDescription
updatedIdsarrayComposite alert IDs the update was submitted for
countnumberNumber of alerts the update was submitted for
errorsarrayErrors CrowdStrike returned alongside a partially successful response
↳ codenumberCrowdStrike error code
↳ idstringIdentifier the error applies to
↳ messagestringError message

CrowdStrike Update Indicators

Update custom CrowdStrike Falcon indicators of compromise by ID (PATCH /iocs/entities/indicators/v1). DESTRUCTIVE: omitted fields may be cleared, so read each indicator with crowdstrike_get_indicator_details first and resend its full field set with your edits applied. Changing action or scope changes prevention behavior fleet-wide. type and value are immutable. Requires the "IOC Management: Write" API scope.

Inputs and outputs

Input

ParameterTypeRequiredDescription
clientIdstringYesCrowdStrike Falcon API client ID
clientSecretstringYesCrowdStrike Falcon API client secret
cloudstringYesCrowdStrike Falcon cloud region
indicatorsjsonYesJSON array of indicators to update. Each entry requires id, and should also repeat every field it wants to keep: an updatable field the entry omits may be cleared. Updatable fields: action, severity, description, source, tags (array), platforms (array), applied_globally (boolean), host_groups (array), expiration (ISO 8601), mobile_action, metadata ({ filename }). type and value cannot be changed.
commentstringNoAudit comment explaining why these indicators were updated
retrodetectsbooleanNoWhether to generate retroactive detections for the updated indicators
ignoreWarningsbooleanNoWhether to apply the updates even when CrowdStrike returns warnings

Output

ParameterTypeDescription
indicatorsarrayUpdated CrowdStrike indicator records
↳ idstringIndicator identifier
↳ typestringIndicator type
↳ valuestringIndicator value
↳ actionstringAction taken when the indicator matches
↳ mobileActionstringAction taken on mobile platforms when the indicator matches
↳ severitystringIndicator severity
↳ descriptionstringIndicator description
↳ sourcestringIndicator source
↳ appliedGloballybooleanWhether the indicator applies to all hosts
↳ platformsarrayPlatforms the indicator applies to
↳ hostGroupsarrayHost group IDs the indicator is scoped to
↳ tagsarrayTags applied to the indicator
↳ expirationstringIndicator expiration timestamp
↳ expiredbooleanWhether the indicator has expired
↳ deletedbooleanWhether the indicator is deleted
↳ fromParentbooleanWhether the indicator was inherited from a parent CID
↳ parentCidNamestringParent CID name
↳ createdBystringUser who created the indicator
↳ createdOnstringIndicator creation timestamp
↳ modifiedBystringUser who last modified the indicator
↳ modifiedOnstringIndicator modification timestamp
↳ metadatajsonFile metadata CrowdStrike resolved for the indicator
↳ avHitsnumberAntivirus hit count
↳ companyNamestringCompany name
↳ fileDescriptionstringFile description
↳ fileVersionstringFile version
↳ filenamestringFile name
↳ originalFilenamestringOriginal file name
↳ productNamestringProduct name
↳ productVersionstringProduct version
↳ signedbooleanWhether the file is signed
countnumberNumber of indicators updated
errorsarrayErrors CrowdStrike returned alongside a partially successful response
↳ codenumberCrowdStrike error code
↳ idstringIdentifier the error applies to
↳ messagestringError message
Was this helpful?
Suggest an edit