id: crowdstrike name: CrowdStrike Falcon version: 1.0.0 description: "CrowdStrike Falcon (OAuth2 API) — device search & enrichment, detections, Spotlight vulnerabilities, custom IOC management, host containment, and Real Time Response." changelog: "1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and RTR (run command/script, list/kill process)." category: endpoint # Per-instance configuration. Scripts obtain an OAuth2 bearer token from # {base_url}/oauth2/token using client_id/client_secret, then call the API. config_schema: properties: base_url: type: string description: "CrowdStrike API base URL (region-specific), e.g. https://api.crowdstrike.com or https://api.eu-1.crowdstrike.com" default: https://api.crowdstrike.com client_id: type: string description: "Falcon API client ID (Support → API Clients and Keys)" x-soar-sensitive: true client_secret: type: string description: "Falcon API client secret" x-soar-sensitive: true required: - client_id - client_secret # Documented for reference; the bundled scripts perform the OAuth2 client- # credentials exchange themselves and send Authorization: Bearer . auth: - id: oauth2 type: oauth2_client_credentials secret_field: client_secret commands: # ── Enrichment / read ───────────────────────────────────────────────────── - id: search_device name: crowdstrike-search-device description: "Search managed devices (hosts) by hostname, IP, platform, or status; returns full device details for matches." risk: read inputs_schema: properties: hostname: { type: string, description: "Hostname to match (exact)." } ip: { type: string, description: "Local IP address to match." } platform_name: { type: string, description: "Platform: Windows, Mac, or Linux." } status: { type: string, description: "Containment status: normal, containment_pending, contained, or lift_containment_pending." } limit: { type: number, description: "Max device IDs to resolve (default 50)." } required: [] outputs_schema: { properties: {} } - id: get_device_details name: crowdstrike-get-device-details description: "Retrieve full details for one or more devices by ID." risk: read inputs_schema: properties: ids: { type: string, description: "Comma-separated device IDs." } required: [ids] outputs_schema: { properties: {} } - id: device_online_state name: crowdstrike-device-online-state description: "Get the current online/offline state for one or more devices by ID." risk: read inputs_schema: properties: ids: { type: string, description: "Comma-separated device IDs." } required: [ids] outputs_schema: { properties: {} } - id: search_detections name: crowdstrike-search-detections description: "Search detections/alerts using an FQL filter; returns full alert entities for matches." risk: read inputs_schema: properties: filter: { type: string, description: "FQL filter (default \"product:'epp'+type:'ldt'\")." } limit: { type: number, description: "Max alerts to return (default 50)." } required: [] outputs_schema: { properties: {} } - id: list_host_groups name: crowdstrike-list-host-groups description: "List host groups, optionally filtered by an FQL expression." risk: read inputs_schema: properties: filter: { type: string, description: "Optional FQL filter, e.g. \"name:*'*prod*'\"." } limit: { type: number, description: "Max groups to return (default 50)." } required: [] outputs_schema: { properties: {} } - id: spotlight_search_vulnerability name: crowdstrike-spotlight-search-vulnerability description: "Search Falcon Spotlight vulnerabilities by FQL filter or CVE ID, with CVE facet detail." risk: read inputs_schema: properties: filter: { type: string, description: "FQL filter (defaults to \"status:'open'\")." } cve_id: { type: string, description: "Comma-separated CVE IDs; overrides filter when provided." } limit: { type: number, description: "Max vulnerabilities to return (default 50)." } required: [] outputs_schema: { properties: {} } - id: ioc_device_count name: crowdstrike-ioc-device-count description: "Count how many devices have observed a given indicator (IOC)." risk: read inputs_schema: properties: type: { type: string, description: "Indicator type: sha256, sha1, md5, domain, ipv4, or ipv6." } value: { type: string, description: "Indicator value." } required: [type, value] outputs_schema: { properties: {} } # ── Actions (containment, detection workflow, IOC management) ────────────── - id: contain_host name: crowdstrike-contain-host description: "Network-contain one or more hosts (isolate them while keeping Falcon connectivity)." risk: destructive inputs_schema: properties: ids: { type: string, description: "Comma-separated device IDs to contain." } required: [ids] outputs_schema: { properties: {} } - id: lift_containment name: crowdstrike-lift-containment description: "Lift network containment on one or more hosts (reconnect them)." risk: destructive inputs_schema: properties: ids: { type: string, description: "Comma-separated device IDs to release." } required: [ids] outputs_schema: { properties: {} } - id: resolve_detection name: crowdstrike-resolve-detection description: "Update detections/alerts: change status, append a comment, and/or assign to an analyst." risk: destructive inputs_schema: properties: ids: { type: string, description: "Comma-separated alert composite IDs." } status: { type: string, description: "New status: new, in_progress, closed, or reopened." } comment: { type: string, description: "Optional comment to append." } assign_to_uuid: { type: string, description: "Optional analyst UUID to assign the detection to." } required: [ids] outputs_schema: { properties: {} } - id: upload_custom_ioc name: crowdstrike-upload-custom-ioc description: "Create a custom IOC indicator (allow/prevent/detect) applied globally." risk: destructive inputs_schema: properties: type: { type: string, description: "Indicator type: sha256, md5, domain, ipv4, or ipv6." } value: { type: string, description: "Indicator value." } action: { type: string, description: "Action: no_action, allow, prevent_no_ui, prevent, or detect." } platforms: { type: string, description: "Comma-separated platforms: windows, mac, linux." } severity: { type: string, description: "Optional severity: informational, low, medium, high, or critical." } description: { type: string, description: "Optional description." } source: { type: string, description: "Optional source label." } required: [type, value, action, platforms] outputs_schema: { properties: {} } - id: delete_custom_ioc name: crowdstrike-delete-custom-ioc description: "Delete one or more custom IOC indicators by ID." risk: destructive inputs_schema: properties: ids: { type: string, description: "Comma-separated IOC indicator IDs." } required: [ids] outputs_schema: { properties: {} } # ── Real Time Response ──────────────────────────────────────────────────── - id: rtr_run_command name: crowdstrike-rtr-run-command description: "Open an RTR batch session and run a read-only command (e.g. ls, ps, cat) on the target hosts." risk: destructive inputs_schema: properties: host_ids: { type: string, description: "Comma-separated device IDs." } command_type: { type: string, description: "Base command, e.g. ls, ps, cat, reg." } full_command: { type: string, description: "Full command string, e.g. 'ls C:\\\\'." } queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." } timeout: { type: number, description: "Command timeout in seconds (default 30)." } required: [host_ids, command_type, full_command] outputs_schema: { properties: {} } - id: rtr_run_script name: crowdstrike-rtr-run-script description: "Open an RTR batch session and run a script via runscript (cloud-stored by name or inline raw PowerShell)." risk: destructive inputs_schema: properties: host_ids: { type: string, description: "Comma-separated device IDs." } script_name: { type: string, description: "Name of a cloud-stored RTR script (exactly one of script_name/raw)." } raw: { type: string, description: "Inline raw PowerShell script (exactly one of script_name/raw)." } queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." } timeout: { type: number, description: "Script timeout in seconds (default 30)." } required: [host_ids] outputs_schema: { properties: {} } - id: rtr_list_processes name: crowdstrike-rtr-list-processes description: "Open an RTR session on a single host and list running processes (ps)." risk: destructive inputs_schema: properties: host_id: { type: string, description: "A single device ID." } queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." } timeout: { type: number, description: "Command timeout in seconds (default 30)." } required: [host_id] outputs_schema: { properties: {} } - id: rtr_kill_process name: crowdstrike-rtr-kill-process description: "Open an RTR session on a single host and kill one or more processes by PID." risk: destructive inputs_schema: properties: host_id: { type: string, description: "A single device ID." } process_ids: { type: string, description: "Comma-separated process IDs (PIDs) to kill." } queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." } timeout: { type: number, description: "Command timeout in seconds (default 30)." } required: [host_id, process_ids] outputs_schema: { properties: {} }