id: crowdstrike name: CrowdStrike Falcon version: 1.5.0 description: "CrowdStrike Falcon (OAuth2 API) — full IR coverage: device/IOC/process enrichment, detections & cases, host groups, Real Time Response, ML/IOA exclusions, quarantine, Spotlight/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, and Fusion workflows." changelog: "1.5.0 — resolve_detection sets the verdict. Falcon has no verdict field on an alert: the console's Resolution column is read from the tags true_positive, false_positive and ignored, and the status only takes new, in_progress, reopened and closed — so no value of the old status box could record a verdict. The new verdict input adds the tag, after removing the other two so an alert never carries two resolutions, and status and verdict are now drop-downs. 1.4.0 — New device_count command: counts devices matching filters without listing them. The device query already answers with meta.pagination.total — the number of matches, independent of the page asked for — so device_count asks for a one-ID page and reads it, where search-device resolves every matching device in full through /devices/entities/devices/v2 to reach the same figure, and only filters on four properties. Filters cover sixteen device FQL properties (hostname, device id, local and external IP, platform, OS version, role, containment status, sensor version, AD domain/OU/site, serial, tags, host groups, RFM), add first_seen/last_seen bounds, and leave a raw FQL `filter` escape hatch for the rest. Several values on one property become an OR group, parenthesised so it binds before the AND that joins it to the others — the reference client omits those parentheses and leaves the precedence to the server. Values are quoted with the single quote escaped, so a hostname carrying an apostrophe cannot end the literal early and change what the query counts. The estate `total` comes back next to `count` so the figure reads as a proportion, and a filter too broad to mean anything shows as matching everything rather than passing for an answer. | 1.3.0 — search_detections takes a created_from timestamp, folded into the FQL as created_timestamp, and declares it as the ingestion watermark input. An alert rule can now fetch incrementally instead of re-reading the whole window every run: this API expresses its time bound inside the FQL, so the watermark used to have nowhere to go but the filter input, where it replaced the query rather than narrowing it. filter now carries the scoping only. 1.2.4 — Fixed two silent defects in the search_detections OCSF mapper: severity was a ternary that resolved to nothing, so every alert kept the alert rule's default severity instead of Falcon's — it is now a plain path to severity_name, whose words the engine reads natively; and no entry fed the OCSF `time` field, so detected_at was never stamped and MTTD measured the collection delay as zero. 1.2.3 — Documentation wording cleanup. 1.2.2 — Corrected the search_detections OCSF mapper against the Falcon Raptor alert schema: domain is device.hostinfo.domain, dropped non-existent fields, added scenario/alleged_filetype/cid. 1.2.1 — Marked search_detections as an ingestion source (ingest hints: results_path=resources, dedup_key=composite_id) so the alert-rule editor pre-fills it. 1.2.0 — Added a pre-built OCSF mapper for search_detections (Falcon unified alerts → OCSF: device, finding, MITRE, actor/parent process, file and IOC). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR." category: endpoint # Per-instance configuration. Scripts obtain an OAuth2 bearer token from # {base_url}/oauth2/token using client_id/client_secret, then call the API. config_schema: properties: base_url: type: string description: "CrowdStrike API base URL (region-specific), e.g. https://api.crowdstrike.com or https://api.eu-1.crowdstrike.com" default: https://api.crowdstrike.com client_id: type: string description: "Falcon API client ID (Support → API Clients and Keys)" x-soar-sensitive: true client_secret: type: string description: "Falcon API client secret" x-soar-sensitive: true required: - client_id - client_secret # Documented for reference; the bundled scripts perform the OAuth2 client- # credentials exchange themselves and send Authorization: Bearer . auth: - id: oauth2 type: oauth2_client_credentials secret_field: client_secret commands: # ── Enrichment / read ───────────────────────────────────────────────────── - id: search_device name: crowdstrike-search-device description: "Search managed devices (hosts) by hostname, IP, platform, or status; returns full device details for matches." risk: read inputs_schema: properties: hostname: { type: string, description: "Hostname to match (exact)." } ip: { type: string, description: "Local IP address to match." } platform_name: { type: string, description: "Platform: Windows, Mac, or Linux." } status: { type: string, description: "Containment status: normal, containment_pending, contained, or lift_containment_pending." } limit: { type: number, description: "Max device IDs to resolve (default 50)." } required: [] outputs_schema: { properties: {} } - id: device_count name: crowdstrike-device-count description: "Count managed devices (hosts) matching filters, without listing them. The device query answers with meta.pagination.total — the number of matches, independent of the page asked for — so one call with a single-ID page returns the figure, where crowdstrike-search-device would resolve every matching device in full to arrive at it. Returns {count, total, filter}: count is the number of matching devices, total the whole estate, and filter the FQL actually sent." risk: read inputs_schema: properties: hostname: { type: string, description: "Comma-separated hostnames (exact match; several values are ORed)." } device_id: { type: string, description: "Comma-separated device (AID) IDs." } local_ip: { type: string, description: "Comma-separated local IP addresses." } external_ip: { type: string, description: "Comma-separated external IP addresses." } platform_name: { type: string, description: "Comma-separated platforms: Windows, Mac, Linux." } os_version: { type: string, description: "Comma-separated OS versions, e.g. Windows Server 2019." } product_type_desc: { type: string, description: "Comma-separated device roles: Workstation, Server, Domain Controller." } status: { type: string, description: "Comma-separated containment statuses: normal, containment_pending, contained, lift_containment_pending." } agent_version: { type: string, description: "Comma-separated sensor versions." } machine_domain: { type: string, description: "Comma-separated Active Directory domains." } ou: { type: string, description: "Comma-separated Active Directory organizational units." } site_name: { type: string, description: "Comma-separated AD site names." } serial_number: { type: string, description: "Comma-separated hardware serial numbers." } tags: { type: string, description: "Comma-separated sensor or Falcon grouping tags." } groups: { type: string, description: "Comma-separated host group IDs (from crowdstrike-list-host-groups)." } reduced_functionality_mode: { type: string, description: "RFM state: yes or no. Counting the yes side is how you size a sensor fleet running degraded." } first_seen_after: { type: string, description: "Lower bound on first_seen, UTC (e.g. 2026-08-21T00:00:00Z) — devices enrolled since that instant." } first_seen_before: { type: string, description: "Upper bound on first_seen, UTC." } last_seen_after: { type: string, description: "Lower bound on last_seen, UTC — devices seen since that instant." } last_seen_before: { type: string, description: "Upper bound on last_seen, UTC — devices silent since that instant." } filter: { type: string, description: "Any other criterion, as raw FQL, ANDed with the rest (e.g. kernel_version:'5.15*')." } required: [] outputs_schema: { properties: {} } - id: get_device_details name: crowdstrike-get-device-details description: "Retrieve full details for one or more devices by ID." risk: read inputs_schema: properties: ids: { type: string, description: "Comma-separated device IDs." } required: [ids] outputs_schema: { properties: {} } - id: device_online_state name: crowdstrike-device-online-state description: "Get the current online/offline state for one or more devices by ID." risk: read inputs_schema: properties: ids: { type: string, description: "Comma-separated device IDs." } required: [ids] outputs_schema: { properties: {} } - id: search_detections name: crowdstrike-search-detections description: "Search detections/alerts using an FQL filter; returns full alert entities for matches. Use as an alert rule ingestion source (results path: resources)." risk: read inputs_schema: properties: filter: { type: string, description: "FQL scoping filter (default \"product:'epp'+type:'ldt'\"). Say WHAT to fetch; leave the time bound to created_from." } created_from: { type: string, description: "Return alerts created at or after this timestamp (ISO 8601). Folded into the FQL as created_timestamp. Receives the alert rule's incremental watermark." } limit: { type: number, description: "Max alerts to return (default 50). One page only — there is no pagination, so size it above the volume of one polling window." } required: [] outputs_schema: { properties: {} } ingest: results_path: resources dedup_key: composite_id incremental_field: created_from - id: list_host_groups name: crowdstrike-list-host-groups description: "List host groups, optionally filtered by an FQL expression." risk: read inputs_schema: properties: filter: { type: string, description: "Optional FQL filter, e.g. \"name:*'*prod*'\"." } limit: { type: number, description: "Max groups to return (default 50)." } required: [] outputs_schema: { properties: {} } - id: spotlight_search_vulnerability name: crowdstrike-spotlight-search-vulnerability description: "Search Falcon Spotlight vulnerabilities by FQL filter or CVE ID, with CVE facet detail." risk: read inputs_schema: properties: filter: { type: string, description: "FQL filter (defaults to \"status:'open'\")." } cve_id: { type: string, description: "Comma-separated CVE IDs; overrides filter when provided." } limit: { type: number, description: "Max vulnerabilities to return (default 50)." } required: [] outputs_schema: { properties: {} } - id: ioc_device_count name: crowdstrike-ioc-device-count description: "Count how many devices have observed a given indicator (IOC)." risk: read inputs_schema: properties: type: { type: string, description: "Indicator type: sha256, sha1, md5, domain, ipv4, or ipv6." } value: { type: string, description: "Indicator value." } required: [type, value] outputs_schema: { properties: {} } # ── Actions (containment, detection workflow, IOC management) ────────────── - id: contain_host name: crowdstrike-contain-host description: "Network-contain one or more hosts (isolate them while keeping Falcon connectivity)." risk: destructive inputs_schema: properties: ids: { type: string, description: "Comma-separated device IDs to contain." } required: [ids] outputs_schema: { properties: {} } - id: lift_containment name: crowdstrike-lift-containment description: "Lift network containment on one or more hosts (reconnect them)." risk: destructive inputs_schema: properties: ids: { type: string, description: "Comma-separated device IDs to release." } required: [ids] outputs_schema: { properties: {} } - id: resolve_detection name: crowdstrike-resolve-detection description: "Update detections/alerts: change status, set the verdict, append a comment, and/or assign to an analyst." risk: destructive inputs_schema: properties: ids: { type: string, description: "Comma-separated alert composite IDs." } status: type: string description: "New status. closed ends the triage; set verdict alongside it so the console shows a resolution." enum: [new, in_progress, reopened, closed] verdict: type: string description: "Resolution shown in the console's Resolution column. Falcon carries it as a tag on the alert, and tags add up: setting a verdict removes the other two first." enum: [true_positive, false_positive, ignored] comment: { type: string, description: "Optional comment to append." } assign_to_uuid: { type: string, description: "Optional analyst UUID to assign the detection to." } required: [ids] outputs_schema: { properties: {} } - id: upload_custom_ioc name: crowdstrike-upload-custom-ioc description: "Create a custom IOC indicator (allow/prevent/detect) applied globally." risk: destructive inputs_schema: properties: type: { type: string, description: "Indicator type: sha256, md5, domain, ipv4, or ipv6." } value: { type: string, description: "Indicator value." } action: { type: string, description: "Action: no_action, allow, prevent_no_ui, prevent, or detect." } platforms: { type: string, description: "Comma-separated platforms: windows, mac, linux." } severity: { type: string, description: "Optional severity: informational, low, medium, high, or critical." } description: { type: string, description: "Optional description." } source: { type: string, description: "Optional source label." } required: [type, value, action, platforms] outputs_schema: { properties: {} } - id: delete_custom_ioc name: crowdstrike-delete-custom-ioc description: "Delete one or more custom IOC indicators by ID." risk: destructive inputs_schema: properties: ids: { type: string, description: "Comma-separated IOC indicator IDs." } required: [ids] outputs_schema: { properties: {} } # ── Real Time Response ──────────────────────────────────────────────────── - id: rtr_run_command name: crowdstrike-rtr-run-command description: "Open an RTR batch session and run a read-only command (e.g. ls, ps, cat) on the target hosts." risk: destructive inputs_schema: properties: host_ids: { type: string, description: "Comma-separated device IDs." } command_type: { type: string, description: "Base command, e.g. ls, ps, cat, reg." } full_command: { type: string, description: "Full command string, e.g. 'ls C:\\\\'." } queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." } timeout: { type: number, description: "Command timeout in seconds (default 30)." } required: [host_ids, command_type, full_command] outputs_schema: { properties: {} } - id: rtr_run_script name: crowdstrike-rtr-run-script description: "Open an RTR batch session and run a script via runscript (cloud-stored by name or inline raw PowerShell)." risk: destructive inputs_schema: properties: host_ids: { type: string, description: "Comma-separated device IDs." } script_name: { type: string, description: "Name of a cloud-stored RTR script (exactly one of script_name/raw)." } raw: { type: string, description: "Inline raw PowerShell script (exactly one of script_name/raw)." } queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." } timeout: { type: number, description: "Script timeout in seconds (default 30)." } required: [host_ids] outputs_schema: { properties: {} } - id: rtr_list_processes name: crowdstrike-rtr-list-processes description: "Open an RTR session on a single host and list running processes (ps)." risk: destructive inputs_schema: properties: host_id: { type: string, description: "A single device ID." } queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." } timeout: { type: number, description: "Command timeout in seconds (default 30)." } required: [host_id] outputs_schema: { properties: {} } - id: rtr_kill_process name: crowdstrike-rtr-kill-process description: "Open an RTR session on a single host and kill one or more processes by PID." risk: destructive inputs_schema: properties: host_id: { type: string, description: "A single device ID." } process_ids: { type: string, description: "Comma-separated process IDs (PIDs) to kill." } queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." } timeout: { type: number, description: "Command timeout in seconds (default 30)." } required: [host_id, process_ids] outputs_schema: { properties: {} } - id: search_custom_iocs name: crowdstrike-search-custom-iocs description: "Search custom IOC indicators using optional FQL filter parts (type, value, source, expiration)." risk: read inputs_schema: properties: types: { type: string, description: "Indicator type filter value, e.g. domain or sha256." } values: { type: string, description: "Indicator value filter." } sources: { type: string, description: "Source label filter." } expiration: { type: string, description: "Expiration date filter (ISO 8601)." } limit: { type: string, description: "Max results to return (default 50)." } sort: { type: string, description: "Sort expression, e.g. created_on.desc." } offset: { type: string, description: "Pagination offset." } required: [] outputs_schema: { properties: {} } - id: get_custom_ioc name: crowdstrike-get-custom-ioc description: "Retrieve a custom IOC indicator by its ID." risk: read inputs_schema: properties: ioc_id: { type: string, description: "IOC indicator ID to retrieve." } required: [ioc_id] outputs_schema: { properties: {} } - id: update_custom_ioc name: crowdstrike-update-custom-ioc description: "Update an existing custom IOC indicator (action, platforms, severity, source, description, expiration)." risk: destructive inputs_schema: properties: ioc_id: { type: string, description: "IOC indicator ID to update." } action: { type: string, description: "Action: no_action, allow, prevent_no_ui, prevent, or detect." } platforms: { type: string, description: "Comma-separated platforms: windows, mac, linux." } severity: { type: string, description: "Severity: informational, low, medium, high, or critical." } source: { type: string, description: "Source label." } description: { type: string, description: "Description text." } expiration: { type: string, description: "Expiration date (ISO 8601)." } required: [ioc_id] outputs_schema: { properties: {} } - id: batch_upload_custom_ioc name: crowdstrike-batch-upload-custom-ioc description: "Create multiple custom IOC indicators in a single call by providing a JSON array of indicator objects." risk: destructive inputs_schema: properties: multiple_indicators_json: { type: string, description: "JSON array string of indicator objects to create." } required: [multiple_indicators_json] outputs_schema: { properties: {} } - id: processes_ran_on name: crowdstrike-processes-ran-on description: "List process IDs that ran a given indicator on a specific device." risk: read inputs_schema: properties: type: { type: string, description: "Indicator type: sha256, sha1, md5, domain, ipv4, or ipv6." } value: { type: string, description: "Indicator value." } device_id: { type: string, description: "Device ID to scope the query." } required: [type, value, device_id] outputs_schema: { properties: {} } - id: process_details name: crowdstrike-process-details description: "Retrieve full details for one or more processes by process ID." risk: read inputs_schema: properties: ids: { type: string, description: "Comma-separated process IDs." } required: [ids] outputs_schema: { properties: {} } - id: device_ran_on name: crowdstrike-device-ran-on description: "List device IDs on which a given indicator has been observed." risk: read inputs_schema: properties: type: { type: string, description: "Indicator type: sha256, sha1, md5, domain, ipv4, or ipv6." } value: { type: string, description: "Indicator value." } required: [type, value] outputs_schema: { properties: {} } - id: create_host_group name: crowdstrike-create-host-group description: "Create a new host group (static or dynamic) with an optional description and assignment rule." risk: safe_write inputs_schema: properties: name: { type: string, description: "Name for the new host group." } group_type: { type: string, description: "Group type: static or dynamic." } description: { type: string, description: "Optional description for the host group." } assignment_rule: { type: string, description: "Optional FQL assignment rule (required for dynamic groups)." } required: [name, group_type] outputs_schema: { properties: {} } - id: update_host_group name: crowdstrike-update-host-group description: "Update an existing host group's name, description, or assignment rule." risk: safe_write inputs_schema: properties: host_group_id: { type: string, description: "ID of the host group to update." } name: { type: string, description: "New name for the host group." } description: { type: string, description: "New description for the host group." } assignment_rule: { type: string, description: "New FQL assignment rule for dynamic groups." } required: [host_group_id] outputs_schema: { properties: {} } - id: delete_host_groups name: crowdstrike-delete-host-groups description: "Delete one or more host groups by ID." risk: destructive inputs_schema: properties: host_group_id: { type: string, description: "Comma-separated host group IDs to delete." } required: [host_group_id] outputs_schema: { properties: {} } - id: list_host_group_members name: crowdstrike-list-host-group-members description: "List devices that are members of a host group, with optional FQL filter and pagination." risk: read inputs_schema: properties: host_group_id: { type: string, description: "Host group ID to list members of." } filter: { type: string, description: "Optional FQL filter to narrow results." } limit: { type: string, description: "Max members to return (default 50)." } offset: { type: string, description: "Pagination offset." } sort: { type: string, description: "Sort expression, e.g. hostname.asc." } required: [] outputs_schema: { properties: {} } - id: add_host_group_members name: crowdstrike-add-host-group-members description: "Add one or more hosts to a host group by device ID." risk: safe_write inputs_schema: properties: host_group_id: { type: string, description: "ID of the host group to add hosts to." } host_ids: { type: string, description: "Comma-separated device IDs to add." } required: [host_group_id, host_ids] outputs_schema: { properties: {} } - id: remove_host_group_members name: crowdstrike-remove-host-group-members description: "Remove one or more hosts from a host group by device ID." risk: safe_write inputs_schema: properties: host_group_id: { type: string, description: "ID of the host group to remove hosts from." } host_ids: { type: string, description: "Comma-separated device IDs to remove." } required: [host_group_id, host_ids] outputs_schema: { properties: {} } # ── Cases ───────────────────────────────────────────────────────────────── - id: list_case_summaries name: crowdstrike-list-case-summaries description: "List case summaries. If ids are provided, fetches those specific cases; otherwise queries all cases sorted by creation date and returns their summaries." risk: read inputs_schema: properties: ids: { type: string, description: "Comma-separated case IDs (optional). If omitted, all cases are listed." } required: [] outputs_schema: { properties: {} } - id: get_evidence_for_case name: crowdstrike-get-evidence-for-case description: "Retrieve full case details including evidence for a single case by ID. Evidence is available at resources[0].evidence in the response." risk: read inputs_schema: properties: id: { type: string, description: "Case ID." } required: [id] outputs_schema: { properties: {} } - id: add_case_tag name: crowdstrike-add-case-tag description: "Add one or more tags to an existing case." risk: safe_write inputs_schema: properties: id: { type: string, description: "Case ID." } tags: { type: string, description: "Comma-separated tags to add." } required: [id, tags] outputs_schema: { properties: {} } - id: delete_case_tag name: crowdstrike-delete-case-tag description: "Remove a single tag from an existing case." risk: safe_write inputs_schema: properties: id: { type: string, description: "Case ID." } tag: { type: string, description: "Tag to remove." } required: [id, tag] outputs_schema: { properties: {} } - id: resolve_case name: crowdstrike-resolve-case description: "Update a case: change status, name, description, assigned analyst, or severity." risk: destructive inputs_schema: properties: id: { type: string, description: "Case ID." } status: { type: string, description: "New case status (optional)." } name: { type: string, description: "New case name (optional)." } assigned_to_uuid: { type: string, description: "UUID of the analyst to assign the case to (optional)." } description: { type: string, description: "Updated case description (optional)." } severity: { type: number, description: "Severity level as an integer (optional)." } required: [id] outputs_schema: { properties: {} } - id: list_detection_summaries name: crowdstrike-list-detection-summaries description: "List alert/detection summaries. Accepts explicit composite IDs or an FQL filter to query alerts first, then fetches full entities." risk: read inputs_schema: properties: fetch_query: { type: string, description: "FQL filter to query alerts (optional, used when ids are not provided)." } ids: { type: string, description: "Comma-separated alert composite IDs (optional). Takes priority over fetch_query." } required: [] outputs_schema: { properties: {} } - id: endpoint name: crowdstrike-endpoint description: "Look up a device/endpoint by device ID, local IP, or hostname; returns full device details for matches." risk: read inputs_schema: properties: id: { type: string, description: "Device ID to match (optional)." } ip: { type: string, description: "Local IP address to match (optional)." } hostname: { type: string, description: "Hostname to match (optional)." } required: [] outputs_schema: { properties: {} } # RTR script/file management and extended Real Time Response commands # Fragment — matches manifest.yaml command block format - id: upload_script name: crowdstrike-upload-script description: "Upload a PowerShell script to the RTR cloud script library." risk: safe_write inputs_schema: properties: name: { type: string, description: "Script name (unique identifier in the library)." } permission_type: { type: string, description: "Visibility: private, group, or public (default private)." } content: { type: string, description: "PowerShell script content." } required: [name, content] outputs_schema: { properties: {} } - id: get_script name: crowdstrike-get-script description: "Retrieve one or more RTR cloud scripts by ID." risk: read inputs_schema: properties: script_id: { type: string, description: "Comma-separated script IDs." } required: [script_id] outputs_schema: { properties: {} } - id: delete_script name: crowdstrike-delete-script description: "Delete an RTR cloud script by ID." risk: destructive inputs_schema: properties: script_id: { type: string, description: "Script ID to delete." } required: [script_id] outputs_schema: { properties: {} } - id: list_scripts name: crowdstrike-list-scripts description: "List all RTR cloud scripts available in the tenant." risk: read inputs_schema: properties: {} required: [] outputs_schema: { properties: {} } - id: list_files name: crowdstrike-list-files description: "List all RTR PUT files (files available for deployment to hosts)." risk: read inputs_schema: properties: {} required: [] outputs_schema: { properties: {} } - id: get_file name: crowdstrike-get-file description: "Retrieve one or more RTR PUT files by ID." risk: read inputs_schema: properties: file_id: { type: string, description: "Comma-separated PUT file IDs." } required: [file_id] outputs_schema: { properties: {} } - id: delete_file name: crowdstrike-delete-file description: "Delete an RTR PUT file by ID." risk: destructive inputs_schema: properties: file_id: { type: string, description: "PUT file ID to delete." } required: [file_id] outputs_schema: { properties: {} } - id: refresh_session name: crowdstrike-refresh-session description: "Refresh an existing RTR session for a host, extending its TTL." risk: safe_write inputs_schema: properties: host_id: { type: string, description: "Device ID of the host whose session to refresh." } required: [host_id] outputs_schema: { properties: {} } - id: list_host_files name: crowdstrike-list-host-files description: "List files extracted from an RTR session on a specific host. Opens a new session if no session_id is provided." risk: read inputs_schema: properties: host_id: { type: string, description: "Device ID of the target host." } session_id: { type: string, description: "Existing RTR session ID (optional; a new session is opened if omitted)." } required: [host_id] outputs_schema: { properties: {} } - id: rtr_remove_file name: crowdstrike-rtr-remove-file description: "Open an RTR batch session and remove a file from one or more hosts using the rm command." risk: destructive inputs_schema: properties: host_ids: { type: string, description: "Comma-separated device IDs." } file_path: { type: string, description: "Full path of the file to remove on the host." } os: { type: string, description: "Target OS: Windows, Linux, or Mac." } queue_offline: { type: string, description: "Queue command for offline hosts: true or false (default false)." } timeout: { type: string, description: "Command timeout in seconds (default 30)." } required: [host_ids, file_path, os] outputs_schema: { properties: {} } - id: rtr_list_network_stats name: crowdstrike-rtr-list-network-stats description: "Open an RTR batch session on a single host and run netstat to list active network connections." risk: read inputs_schema: properties: host_id: { type: string, description: "Device ID of the target host." } queue_offline: { type: string, description: "Queue command for offline hosts: true or false (default false)." } timeout: { type: string, description: "Command timeout in seconds (default 30)." } required: [host_id] outputs_schema: { properties: {} } - id: rtr_list_scheduled_tasks name: crowdstrike-rtr-list-scheduled-tasks description: "Open an RTR batch session and enumerate scheduled tasks on Windows hosts via schtasks." risk: read inputs_schema: properties: host_ids: { type: string, description: "Comma-separated device IDs." } queue_offline: { type: string, description: "Queue command for offline hosts: true or false (default false)." } timeout: { type: string, description: "Command timeout in seconds (default 30)." } required: [host_ids] outputs_schema: { properties: {} } # ── ML Exclusions ────────────────────────────────────────────────────────── - id: create_ml_exclusion name: crowdstrike-create-ml-exclusion description: "Create a new ML exclusion to prevent the machine learning engine from triggering on a specific value." risk: destructive inputs_schema: properties: value: { type: string, description: "The exclusion value (e.g. file path or hash)." } excluded_from: { type: string, description: "Comma-separated list of ML detection categories to exclude from (e.g. blocking,extraction)." } comment: { type: string, description: "Optional comment describing the reason for the exclusion." } groups: { type: string, description: "Comma-separated host group IDs to scope the exclusion. Defaults to all groups." } required: [value, excluded_from] outputs_schema: { properties: {} } - id: update_ml_exclusion name: crowdstrike-update-ml-exclusion description: "Update an existing ML exclusion by ID (value, comment, or groups)." risk: destructive inputs_schema: properties: id: { type: string, description: "ML exclusion ID to update." } value: { type: string, description: "New exclusion value (optional)." } comment: { type: string, description: "Updated comment (optional)." } groups: { type: string, description: "Comma-separated host group IDs to replace the current scoping (optional)." } required: [id] outputs_schema: { properties: {} } - id: delete_ml_exclusion name: crowdstrike-delete-ml-exclusion description: "Delete one or more ML exclusions by ID." risk: destructive inputs_schema: properties: ids: { type: string, description: "Comma-separated ML exclusion IDs to delete." } required: [ids] outputs_schema: { properties: {} } - id: search_ml_exclusion name: crowdstrike-search-ml-exclusion description: "Search ML exclusions by explicit IDs, a value substring match, or an FQL filter; returns full exclusion entities." risk: read inputs_schema: properties: ids: { type: string, description: "Comma-separated exclusion IDs (takes priority over value and filter)." } value: { type: string, description: "Value substring to search for (takes priority over filter when ids is absent)." } filter: { type: string, description: "FQL filter string (used when neither ids nor value is provided)." } limit: { type: string, description: "Max results to return." } offset: { type: string, description: "Pagination offset." } sort: { type: string, description: "Sort expression, e.g. value.asc." } required: [] outputs_schema: { properties: {} } # ── IOA Exclusions ───────────────────────────────────────────────────────── - id: create_ioa_exclusion name: crowdstrike-create-ioa-exclusion description: "Create a new IOA exclusion to suppress a specific Indicator of Attack pattern." risk: destructive inputs_schema: properties: exclusion_name: { type: string, description: "Display name for the IOA exclusion." } pattern_id: { type: string, description: "ID of the IOA pattern to exclude." } cl_regex: { type: string, description: "Command-line regular expression to match." } ifn_regex: { type: string, description: "Image filename regular expression to match." } pattern_name: { type: string, description: "Human-readable pattern name (optional)." } comment: { type: string, description: "Optional comment." } description: { type: string, description: "Optional description." } groups: { type: string, description: "Comma-separated host group IDs to scope the exclusion. Defaults to all groups." } detection_json: { type: string, description: "Optional detection JSON override." } required: [exclusion_name, pattern_id, cl_regex, ifn_regex] outputs_schema: { properties: {} } - id: update_ioa_exclusion name: crowdstrike-update-ioa-exclusion description: "Update an existing IOA exclusion by ID." risk: destructive inputs_schema: properties: id: { type: string, description: "IOA exclusion ID to update." } exclusion_name: { type: string, description: "New display name (optional)." } pattern_id: { type: string, description: "New pattern ID (optional)." } pattern_name: { type: string, description: "New pattern name (optional)." } cl_regex: { type: string, description: "New command-line regex (optional)." } ifn_regex: { type: string, description: "New image filename regex (optional)." } comment: { type: string, description: "Updated comment (optional)." } description: { type: string, description: "Updated description (optional)." } groups: { type: string, description: "Comma-separated host group IDs to replace current scoping (optional)." } detection_json: { type: string, description: "Updated detection JSON (optional)." } required: [id] outputs_schema: { properties: {} } - id: delete_ioa_exclusion name: crowdstrike-delete-ioa-exclusion description: "Delete one or more IOA exclusions by ID." risk: destructive inputs_schema: properties: ids: { type: string, description: "Comma-separated IOA exclusion IDs to delete." } required: [ids] outputs_schema: { properties: {} } - id: search_ioa_exclusion name: crowdstrike-search-ioa-exclusion description: "Search IOA exclusions by explicit IDs, a name substring match, or an FQL filter; returns full exclusion entities." risk: read inputs_schema: properties: ids: { type: string, description: "Comma-separated exclusion IDs (takes priority over name and filter)." } name: { type: string, description: "Name substring to search for (takes priority over filter when ids is absent)." } filter: { type: string, description: "FQL filter string (used when neither ids nor name is provided)." } limit: { type: string, description: "Max results to return." } offset: { type: string, description: "Pagination offset." } required: [] outputs_schema: { properties: {} } # ── Quarantine ───────────────────────────────────────────────────────────── - id: list_quarantined_file name: crowdstrike-list-quarantined-file description: "List quarantined files by explicit IDs or an FQL filter query." risk: read inputs_schema: properties: ids: { type: string, description: "Comma-separated quarantined file IDs (takes priority over filter)." } filter: { type: string, description: "FQL filter string (used when ids is absent)." } limit: { type: string, description: "Max results to return (default 50)." } offset: { type: string, description: "Pagination offset." } required: [] outputs_schema: { properties: {} } - id: apply_quarantine_file_action name: crowdstrike-apply-quarantine-file-action description: "Apply an action (delete, release, or unrelease) to one or more quarantined files." risk: destructive inputs_schema: properties: ids: { type: string, description: "Comma-separated quarantined file IDs." } action: { type: string, description: "Action to apply: delete, release, or unrelease." } comment: { type: string, description: "Comment explaining the reason for the action." } required: [ids, action, comment] outputs_schema: { properties: {} } # ── Spotlight CVE ────────────────────────────────────────────────────────── - id: cve name: crowdstrike-cve description: "Retrieve Falcon Spotlight vulnerability details for one or more CVE IDs, including CVE facet metadata." risk: read inputs_schema: properties: cve: { type: string, description: "Comma-separated CVE IDs to look up (e.g. CVE-2021-44228,CVE-2022-3786)." } required: [cve] outputs_schema: { properties: {} } - id: spotlight_list_host_by_vulnerability name: crowdstrike-spotlight-list-host-by-vulnerability description: "List hosts affected by one or more CVE IDs using Falcon Spotlight, with host_info facet details." risk: read inputs_schema: properties: cve_ids: { type: string, description: "Comma-separated CVE IDs to filter by (e.g. CVE-2021-44228)." } limit: { type: string, description: "Max results to return (default 50)." } required: [cve_ids] outputs_schema: { properties: {} } # ── ODS — On-Demand Scans ──────────────────────────────────────────────────── - id: ods_query_scan name: crowdstrike-ods-query-scan description: "Query ODS scans by ID or FQL filter. If ids provided, fetch those scans directly; otherwise query and resolve." risk: read inputs_schema: properties: ids: { type: string, description: "Comma-separated scan IDs to retrieve directly." } filter: { type: string, description: "FQL filter to narrow query results." } limit: { type: string, description: "Max results to return." } offset: { type: string, description: "Pagination offset." } required: [] outputs_schema: { properties: {} } - id: ods_query_scheduled_scan name: crowdstrike-ods-query-scheduled-scan description: "Query ODS scheduled scans by ID or FQL filter. If ids provided, fetch those scans directly; otherwise query and resolve." risk: read inputs_schema: properties: ids: { type: string, description: "Comma-separated scheduled scan IDs to retrieve directly." } filter: { type: string, description: "FQL filter to narrow query results." } limit: { type: string, description: "Max results to return." } offset: { type: string, description: "Pagination offset." } required: [] outputs_schema: { properties: {} } - id: ods_query_scan_host name: crowdstrike-ods-query-scan-host description: "Query ODS scan hosts by ID or FQL filter. If ids provided, fetch those scan-host records directly; otherwise query and resolve." risk: read inputs_schema: properties: ids: { type: string, description: "Comma-separated scan-host IDs to retrieve directly." } filter: { type: string, description: "FQL filter to narrow query results." } limit: { type: string, description: "Max results to return." } offset: { type: string, description: "Pagination offset." } required: [] outputs_schema: { properties: {} } - id: ods_query_malicious_files name: crowdstrike-ods-query-malicious-files description: "Query ODS malicious files by file_ids or FQL filter. If file_ids provided, fetch those records directly; otherwise query and resolve." risk: read inputs_schema: properties: file_ids: { type: string, description: "Comma-separated malicious file IDs to retrieve directly." } filter: { type: string, description: "FQL filter to narrow query results." } limit: { type: string, description: "Max results to return." } offset: { type: string, description: "Pagination offset." } required: [] outputs_schema: { properties: {} } - id: ods_create_scan name: crowdstrike-ods-create-scan description: "Create an ODS on-demand scan targeting specific hosts and/or host groups." risk: destructive inputs_schema: properties: hosts: { type: string, description: "Comma-separated device IDs to scan." } host_groups: { type: string, description: "Comma-separated host group IDs to scan." } file_paths: { type: string, description: "Comma-separated file paths to include in the scan." } scan_inclusions: { type: string, description: "Comma-separated scan inclusion patterns." } description: { type: string, description: "Optional description for the scan." } quarantine: { type: string, description: "Quarantine detected malicious files: true or false." } required: [] outputs_schema: { properties: {} } - id: ods_create_scheduled_scan name: crowdstrike-ods-create-scheduled-scan description: "Create a recurring ODS scheduled scan for one or more host groups." risk: destructive inputs_schema: properties: host_groups: { type: string, description: "Comma-separated host group IDs (required)." } file_paths: { type: string, description: "Comma-separated file paths to include." } scan_inclusions: { type: string, description: "Comma-separated scan inclusion patterns." } description: { type: string, description: "Optional description." } schedule_start_timestamp: { type: string, description: "ISO 8601 start timestamp (required)." } schedule_interval: { type: string, description: "Recurrence: Never, Daily, Weekly, Every other week, Every four weeks, or Monthly (required)." } required: [host_groups, schedule_start_timestamp, schedule_interval] outputs_schema: { properties: {} } - id: ods_delete_scheduled_scan name: crowdstrike-ods-delete-scheduled-scan description: "Delete one or more ODS scheduled scans by ID." risk: destructive inputs_schema: properties: ids: { type: string, description: "Comma-separated scheduled scan IDs to delete." } required: [ids] outputs_schema: { properties: {} } # ── CSPM — Cloud Security Posture Management ────────────────────────────────── - id: cspm_list_policy_details name: crowdstrike-cspm-list-policy-details description: "Retrieve CSPM policy details for one or more policy IDs." risk: read inputs_schema: properties: policy_ids: { type: string, description: "Comma-separated CSPM policy IDs." } required: [policy_ids] outputs_schema: { properties: {} } - id: cspm_list_service_policy_settings name: crowdstrike-cspm-list-service-policy-settings description: "List CSPM service policy settings for a given policy ID and cloud platform." risk: read inputs_schema: properties: policy_id: { type: string, description: "CSPM policy ID." } cloud_platform: { type: string, description: "Cloud platform: aws (default), azure, or gcp." } service: { type: string, description: "Optional cloud service name to filter." } limit: { type: string, description: "Max results to return." } required: [policy_id] outputs_schema: { properties: {} } - id: cspm_update_policy_settings name: crowdstrike-cspm-update-policy-settings description: "Update CSPM policy settings: enable/disable, change severity, scope to regions or account." risk: destructive inputs_schema: properties: policy_id: { type: string, description: "CSPM policy ID to update (required)." } account_id: { type: string, description: "Optional cloud account ID to scope the update." } enabled: { type: string, description: "Enable policy: true (default) or false." } regions: { type: string, description: "Comma-separated regions to scope the policy." } severity: { type: string, description: "Optional severity override." } tag_excluded: { type: string, description: "Exclude tagged resources: true or false." } required: [policy_id] outputs_schema: { properties: {} } # ── Users / Rules / Alerts ──────────────────────────────────────────────────── - id: list_users name: crowdstrike-list-users description: "List Falcon users. If id provided, fetch those users directly; otherwise query with optional filter." risk: read inputs_schema: properties: id: { type: string, description: "Comma-separated user UUIDs to retrieve directly." } filter: { type: string, description: "FQL filter to narrow query results." } offset: { type: string, description: "Pagination offset (default 0)." } limit: { type: string, description: "Max results to return (default 50)." } required: [] outputs_schema: { properties: {} } - id: get_ioarules name: crowdstrike-get-ioarules description: "Retrieve IOA (Indicator of Attack) custom rules by rule ID." risk: read inputs_schema: properties: rule_ids: { type: string, description: "Comma-separated IOA rule IDs." } required: [rule_ids] outputs_schema: { properties: {} } - id: list_cnapp_alerts name: crowdstrike-list-cnapp-alerts description: "List CNAPP container security alerts, optionally filtered by FQL expression." risk: read inputs_schema: properties: filter: { type: string, description: "Optional FQL filter to narrow results." } required: [] outputs_schema: { properties: {} } - id: resolve_identity_detection name: crowdstrike-resolve-identity-detection description: "Resolve or update Falcon Identity Detection alerts: change status, assign, comment, tag, or unassign." risk: destructive inputs_schema: properties: ids: { type: string, description: "Comma-separated composite alert IDs (required)." } update_status: { type: string, description: "New status, e.g. new, in_progress, closed, or reopened." } assign_to_uuid: { type: string, description: "Analyst UUID to assign the detection to." } append_comment: { type: string, description: "Comment text to append." } add_tag: { type: string, description: "Tag to add to the detection." } remove_tag: { type: string, description: "Tag to remove from the detection." } unassign: { type: string, description: "Unassign the detection: true or false." } show_in_ui: { type: string, description: "Show in UI: true or false." } required: [ids] outputs_schema: { properties: {} } - id: resolve_mobile_detection name: crowdstrike-resolve-mobile-detection description: "Resolve or update Falcon Mobile Detection alerts: change status, assign, comment, tag, or unassign." risk: destructive inputs_schema: properties: ids: { type: string, description: "Comma-separated composite alert IDs (required)." } update_status: { type: string, description: "New status, e.g. new, in_progress, closed, or reopened." } assign_to_uuid: { type: string, description: "Analyst UUID to assign the detection to." } append_comment: { type: string, description: "Comment text to append." } add_tag: { type: string, description: "Tag to add to the detection." } remove_tag: { type: string, description: "Tag to remove from the detection." } unassign: { type: string, description: "Unassign the detection: true or false." } show_in_ui: { type: string, description: "Show in UI: true or false." } required: [ids] outputs_schema: { properties: {} } - id: list_workflow_definitions name: crowdstrike-list-workflow-definitions description: "List Falcon Fusion workflow definitions using an optional FQL filter, pagination offset/limit, and sort expression." risk: read inputs_schema: properties: filter: { type: string, description: "FQL filter expression." } limit: { type: string, description: "Maximum number of results (default 50)." } offset: { type: string, description: "Pagination offset (default 0)." } sort: { type: string, description: "Sort expression, e.g. name.asc." } required: [] outputs_schema: { properties: {} } - id: workflow_execute name: crowdstrike-workflow-execute description: "Trigger execution of one or more Falcon Fusion workflow definitions." risk: destructive inputs_schema: properties: definition_id: { type: string, description: "Comma-separated workflow definition IDs to execute." } name: { type: string, description: "Optional workflow name filter." } key: { type: string, description: "Optional idempotency key for the execution." } source_event_url: { type: string, description: "Optional source event URL." } execution_cid: { type: string, description: "Comma-separated CIDs to target for execution." } body: { type: string, description: "JSON string body to pass as the execution payload (default {})." } required: [definition_id] outputs_schema: { properties: {} } - id: list_workflow_executions name: crowdstrike-list-workflow-executions description: "List Falcon Fusion workflow execution records using an optional FQL filter, pagination offset/limit, and sort expression." risk: read inputs_schema: properties: filter: { type: string, description: "FQL filter expression." } limit: { type: string, description: "Maximum number of results (default 50)." } offset: { type: string, description: "Pagination offset (default 0)." } sort: { type: string, description: "Sort expression, e.g. start_timestamp.desc." } required: [] outputs_schema: { properties: {} } - id: list_workflow_execution_results name: crowdstrike-list-workflow-execution-results description: "Retrieve detailed results for one or more workflow execution IDs." risk: read inputs_schema: properties: ids: { type: string, description: "Comma-separated workflow execution IDs." } required: [ids] outputs_schema: { properties: {} } - id: workflow_execution_action name: crowdstrike-workflow-execution-action description: "Perform an action (cancel or resume) on one or more workflow executions." risk: destructive inputs_schema: properties: ids: { type: string, description: "Comma-separated workflow execution IDs." } action_name: { type: string, description: "Action to perform: cancel or resume.", enum: [cancel, resume] } required: [ids, action_name] outputs_schema: { properties: {} } - id: list_identity_entities name: crowdstrike-list-identity-entities description: "Query Falcon Identity Protection entities (users or endpoints) via the GraphQL API, returning risk scores and factors." risk: read inputs_schema: properties: type: { type: string, description: "Entity type: USER or ENDPOINT.", enum: [USER, ENDPOINT] } limit: { type: string, description: "Maximum number of nodes to return (default 50)." } primary_display_name: { type: string, description: "Optional filter by primary display name (informational; include in query if supported)." } email: { type: string, description: "Optional filter by email address (informational; include in query if supported)." } required: [type] outputs_schema: { properties: {} } # ── Connectivity test ───────────────────────────────────────────────────── - id: test_connection name: crowdstrike-test-connection description: "Verify connectivity and credentials (used by the Test button)." risk: read inputs_schema: properties: {} required: [] outputs_schema: { properties: {} } ingestion: command: search_detections mapper: search_detections default_incident_type: "CrowdStrike Detection"