f3nris
8eed7ed9fb
On a real tenant the Unified Detections raised from ingested FortiGate logs are product 'thirdparty'; 'ngsiem' matched nothing. The command now reads thirdparty and ngsiem by default (products input), and its mapper is rewritten from real payloads: source product/vendor, matched host, connection endpoints and ports, vendor signature id, Falcon priority, console link, and a description built from what fired on which connection. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VBnLYwQbUCaf5vpv77N14Q
1110 lines
60 KiB
YAML
1110 lines
60 KiB
YAML
id: crowdstrike
|
|
name: CrowdStrike Falcon
|
|
version: 1.6.2
|
|
description: "CrowdStrike Falcon (OAuth2 API) — full IR coverage: device/IOC/process enrichment, detections & cases, host groups, Real Time Response, ML/IOA exclusions, quarantine, Spotlight/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, and Fusion workflows."
|
|
changelog: "1.6.2 — search_ngsiem_detections reads products thirdparty and ngsiem by default, set by a new products input. On a real tenant the NG-SIEM detections of the Unified Detections page — here FortiGate IPS hits — are filed under product thirdparty, and product ngsiem matched nothing, so 1.6.0 returned an empty list. Its mapper is rewritten from those payloads: source product and vendor, the host Falcon matched the detection to, source and target IPs and ports, protocol, the vendor signature id as the analytic uid, the Falcon priority as risk score, the console link, and the source event time as OCSF time. Third-party detections carry no description, so the incident's is built from the source product, the signature and the connection. | 1.6.1 — search_detections and search_ngsiem_detections return a query block next to resources: the FQL actually sent, the total Falcon counts for it and any errors the query carried. A search that matched nothing used to come back as a bare empty list, which could not be told apart from a wrong region, a filter Falcon read differently or an API client that sees no alerts. | 1.6.0 — New search_ngsiem_detections command for Next-Gen SIEM detections. Falcon files the detections of NG-SIEM correlation rules in the same unified Alerts API as the EDR, under product 'ngsiem', so search_detections' default epp/ldt scope never returned them, and its mapper reads device, process and file blocks an NG-SIEM detection does not carry. The new command always keeps the product:'ngsiem' clause and ANDs any filter to it, takes the same created_from watermark, and ships its own mapper and a CrowdStrike NG-SIEM Detection incident type. The mapper is a first cut on the fields every unified alert carries (identity, name, description, severity, status, timestamps, MITRE); hosts, users and the source log will follow from a real payload. | 1.5.0 — resolve_detection sets the verdict. Falcon has no verdict field on an alert: the console's Resolution column is read from the tags true_positive, false_positive and ignored, and the status only takes new, in_progress, reopened and closed — so no value of the old status box could record a verdict. The new verdict input adds the tag, after removing the other two so an alert never carries two resolutions, and status and verdict are now drop-downs. 1.4.0 — New device_count command: counts devices matching filters without listing them. The device query already answers with meta.pagination.total — the number of matches, independent of the page asked for — so device_count asks for a one-ID page and reads it, where search-device resolves every matching device in full through /devices/entities/devices/v2 to reach the same figure, and only filters on four properties. Filters cover sixteen device FQL properties (hostname, device id, local and external IP, platform, OS version, role, containment status, sensor version, AD domain/OU/site, serial, tags, host groups, RFM), add first_seen/last_seen bounds, and leave a raw FQL `filter` escape hatch for the rest. Several values on one property become an OR group, parenthesised so it binds before the AND that joins it to the others — the reference client omits those parentheses and leaves the precedence to the server. Values are quoted with the single quote escaped, so a hostname carrying an apostrophe cannot end the literal early and change what the query counts. The estate `total` comes back next to `count` so the figure reads as a proportion, and a filter too broad to mean anything shows as matching everything rather than passing for an answer. | 1.3.0 — search_detections takes a created_from timestamp, folded into the FQL as created_timestamp, and declares it as the ingestion watermark input. An alert rule can now fetch incrementally instead of re-reading the whole window every run: this API expresses its time bound inside the FQL, so the watermark used to have nowhere to go but the filter input, where it replaced the query rather than narrowing it. filter now carries the scoping only. 1.2.4 — Fixed two silent defects in the search_detections OCSF mapper: severity was a ternary that resolved to nothing, so every alert kept the alert rule's default severity instead of Falcon's — it is now a plain path to severity_name, whose words the engine reads natively; and no entry fed the OCSF `time` field, so detected_at was never stamped and MTTD measured the collection delay as zero. 1.2.3 — Documentation wording cleanup. 1.2.2 — Corrected the search_detections OCSF mapper against the Falcon Raptor alert schema: domain is device.hostinfo.domain, dropped non-existent fields, added scenario/alleged_filetype/cid. 1.2.1 — Marked search_detections as an ingestion source (ingest hints: results_path=resources, dedup_key=composite_id) so the alert-rule editor pre-fills it. 1.2.0 — Added a pre-built OCSF mapper for search_detections (Falcon unified alerts → OCSF: device, finding, MITRE, actor/parent process, file and IOC). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Expanded to 81 commands (host groups, cases, RTR files/scripts/responders, ML/IOA exclusions, quarantine, Spotlight host-by-vuln/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, identity/mobile detection resolve, and workflows). 1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and core RTR."
|
|
category: endpoint
|
|
|
|
# Per-instance configuration. Scripts obtain an OAuth2 bearer token from
|
|
# {base_url}/oauth2/token using client_id/client_secret, then call the API.
|
|
config_schema:
|
|
properties:
|
|
base_url:
|
|
type: string
|
|
description: "CrowdStrike API base URL (region-specific), e.g. https://api.crowdstrike.com or https://api.eu-1.crowdstrike.com"
|
|
default: https://api.crowdstrike.com
|
|
client_id:
|
|
type: string
|
|
description: "Falcon API client ID (Support → API Clients and Keys)"
|
|
x-soar-sensitive: true
|
|
client_secret:
|
|
type: string
|
|
description: "Falcon API client secret"
|
|
x-soar-sensitive: true
|
|
required:
|
|
- client_id
|
|
- client_secret
|
|
|
|
# Documented for reference; the bundled scripts perform the OAuth2 client-
|
|
# credentials exchange themselves and send Authorization: Bearer <token>.
|
|
auth:
|
|
- id: oauth2
|
|
type: oauth2_client_credentials
|
|
secret_field: client_secret
|
|
|
|
commands:
|
|
# ── Enrichment / read ─────────────────────────────────────────────────────
|
|
- id: search_device
|
|
name: crowdstrike-search-device
|
|
description: "Search managed devices (hosts) by hostname, IP, platform, or status; returns full device details for matches."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Hostname to match (exact)." }
|
|
ip: { type: string, description: "Local IP address to match." }
|
|
platform_name: { type: string, description: "Platform: Windows, Mac, or Linux." }
|
|
status: { type: string, description: "Containment status: normal, containment_pending, contained, or lift_containment_pending." }
|
|
limit: { type: number, description: "Max device IDs to resolve (default 50)." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: device_count
|
|
name: crowdstrike-device-count
|
|
description: "Count managed devices (hosts) matching filters, without listing them. The device query answers with meta.pagination.total — the number of matches, independent of the page asked for — so one call with a single-ID page returns the figure, where crowdstrike-search-device would resolve every matching device in full to arrive at it. Returns {count, total, filter}: count is the number of matching devices, total the whole estate, and filter the FQL actually sent."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Comma-separated hostnames (exact match; several values are ORed)." }
|
|
device_id: { type: string, description: "Comma-separated device (AID) IDs." }
|
|
local_ip: { type: string, description: "Comma-separated local IP addresses." }
|
|
external_ip: { type: string, description: "Comma-separated external IP addresses." }
|
|
platform_name: { type: string, description: "Comma-separated platforms: Windows, Mac, Linux." }
|
|
os_version: { type: string, description: "Comma-separated OS versions, e.g. Windows Server 2019." }
|
|
product_type_desc: { type: string, description: "Comma-separated device roles: Workstation, Server, Domain Controller." }
|
|
status: { type: string, description: "Comma-separated containment statuses: normal, containment_pending, contained, lift_containment_pending." }
|
|
agent_version: { type: string, description: "Comma-separated sensor versions." }
|
|
machine_domain: { type: string, description: "Comma-separated Active Directory domains." }
|
|
ou: { type: string, description: "Comma-separated Active Directory organizational units." }
|
|
site_name: { type: string, description: "Comma-separated AD site names." }
|
|
serial_number: { type: string, description: "Comma-separated hardware serial numbers." }
|
|
tags: { type: string, description: "Comma-separated sensor or Falcon grouping tags." }
|
|
groups: { type: string, description: "Comma-separated host group IDs (from crowdstrike-list-host-groups)." }
|
|
reduced_functionality_mode: { type: string, description: "RFM state: yes or no. Counting the yes side is how you size a sensor fleet running degraded." }
|
|
first_seen_after: { type: string, description: "Lower bound on first_seen, UTC (e.g. 2026-08-21T00:00:00Z) — devices enrolled since that instant." }
|
|
first_seen_before: { type: string, description: "Upper bound on first_seen, UTC." }
|
|
last_seen_after: { type: string, description: "Lower bound on last_seen, UTC — devices seen since that instant." }
|
|
last_seen_before: { type: string, description: "Upper bound on last_seen, UTC — devices silent since that instant." }
|
|
filter: { type: string, description: "Any other criterion, as raw FQL, ANDed with the rest (e.g. kernel_version:'5.15*')." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: get_device_details
|
|
name: crowdstrike-get-device-details
|
|
description: "Retrieve full details for one or more devices by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated device IDs." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: device_online_state
|
|
name: crowdstrike-device-online-state
|
|
description: "Get the current online/offline state for one or more devices by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated device IDs." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: search_detections
|
|
name: crowdstrike-search-detections
|
|
description: "Search detections/alerts using an FQL filter; returns full alert entities for matches. Use as an alert rule ingestion source (results path: resources)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
filter: { type: string, description: "FQL scoping filter (default \"product:'epp'+type:'ldt'\"). Say WHAT to fetch; leave the time bound to created_from." }
|
|
created_from: { type: string, description: "Return alerts created at or after this timestamp (ISO 8601). Folded into the FQL as created_timestamp. Receives the alert rule's incremental watermark." }
|
|
limit: { type: number, description: "Max alerts to return (default 50). One page only — there is no pagination, so size it above the volume of one polling window." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
ingest:
|
|
results_path: resources
|
|
dedup_key: composite_id
|
|
incremental_field: created_from
|
|
|
|
- id: search_ngsiem_detections
|
|
name: crowdstrike-search-ngsiem-detections
|
|
description: "Search Next-Gen SIEM detections — what NG-SIEM raises from ingested third-party logs (product 'thirdparty', e.g. a FortiGate IPS hit) and from the tenant's correlation rules (product 'ngsiem'). Falcon files them in the unified Alerts API next to, not among, the EDR detections. Returns full alert entities. Use as an alert rule ingestion source (results path: resources)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
products: { type: string, description: "Comma-separated Alerts API products to read (default \"thirdparty,ngsiem\"). Add xdr for NG-SIEM incidents or automated-lead for automated leads." }
|
|
filter: { type: string, description: "Optional FQL narrowing the detections, e.g. \"severity:>=40\" to drop Informational and Low. Always ANDed with the product clause. Leave the time bound to created_from." }
|
|
created_from: { type: string, description: "Return detections created at or after this timestamp (ISO 8601). Folded into the FQL as created_timestamp. Receives the alert rule's incremental watermark." }
|
|
limit: { type: number, description: "Max detections to return (default 50). One page only — there is no pagination, so size it above the volume of one polling window." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
ingest:
|
|
results_path: resources
|
|
dedup_key: composite_id
|
|
incremental_field: created_from
|
|
|
|
- id: list_host_groups
|
|
name: crowdstrike-list-host-groups
|
|
description: "List host groups, optionally filtered by an FQL expression."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
filter: { type: string, description: "Optional FQL filter, e.g. \"name:*'*prod*'\"." }
|
|
limit: { type: number, description: "Max groups to return (default 50)." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: spotlight_search_vulnerability
|
|
name: crowdstrike-spotlight-search-vulnerability
|
|
description: "Search Falcon Spotlight vulnerabilities by FQL filter or CVE ID, with CVE facet detail."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
filter: { type: string, description: "FQL filter (defaults to \"status:'open'\")." }
|
|
cve_id: { type: string, description: "Comma-separated CVE IDs; overrides filter when provided." }
|
|
limit: { type: number, description: "Max vulnerabilities to return (default 50)." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: ioc_device_count
|
|
name: crowdstrike-ioc-device-count
|
|
description: "Count how many devices have observed a given indicator (IOC)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
type: { type: string, description: "Indicator type: sha256, sha1, md5, domain, ipv4, or ipv6." }
|
|
value: { type: string, description: "Indicator value." }
|
|
required: [type, value]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Actions (containment, detection workflow, IOC management) ──────────────
|
|
- id: contain_host
|
|
name: crowdstrike-contain-host
|
|
description: "Network-contain one or more hosts (isolate them while keeping Falcon connectivity)."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated device IDs to contain." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: lift_containment
|
|
name: crowdstrike-lift-containment
|
|
description: "Lift network containment on one or more hosts (reconnect them)."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated device IDs to release." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: resolve_detection
|
|
name: crowdstrike-resolve-detection
|
|
description: "Update detections/alerts: change status, set the verdict, append a comment, and/or assign to an analyst."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated alert composite IDs." }
|
|
status:
|
|
type: string
|
|
description: "New status. closed ends the triage; set verdict alongside it so the console shows a resolution."
|
|
enum: [new, in_progress, reopened, closed]
|
|
verdict:
|
|
type: string
|
|
description: "Resolution shown in the console's Resolution column. Falcon carries it as a tag on the alert, and tags add up: setting a verdict removes the other two first."
|
|
enum: [true_positive, false_positive, ignored]
|
|
comment: { type: string, description: "Optional comment to append." }
|
|
assign_to_uuid: { type: string, description: "Optional analyst UUID to assign the detection to." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: upload_custom_ioc
|
|
name: crowdstrike-upload-custom-ioc
|
|
description: "Create a custom IOC indicator (allow/prevent/detect) applied globally."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
type: { type: string, description: "Indicator type: sha256, md5, domain, ipv4, or ipv6." }
|
|
value: { type: string, description: "Indicator value." }
|
|
action: { type: string, description: "Action: no_action, allow, prevent_no_ui, prevent, or detect." }
|
|
platforms: { type: string, description: "Comma-separated platforms: windows, mac, linux." }
|
|
severity: { type: string, description: "Optional severity: informational, low, medium, high, or critical." }
|
|
description: { type: string, description: "Optional description." }
|
|
source: { type: string, description: "Optional source label." }
|
|
required: [type, value, action, platforms]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: delete_custom_ioc
|
|
name: crowdstrike-delete-custom-ioc
|
|
description: "Delete one or more custom IOC indicators by ID."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated IOC indicator IDs." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Real Time Response ────────────────────────────────────────────────────
|
|
- id: rtr_run_command
|
|
name: crowdstrike-rtr-run-command
|
|
description: "Open an RTR batch session and run a read-only command (e.g. ls, ps, cat) on the target hosts."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
host_ids: { type: string, description: "Comma-separated device IDs." }
|
|
command_type: { type: string, description: "Base command, e.g. ls, ps, cat, reg." }
|
|
full_command: { type: string, description: "Full command string, e.g. 'ls C:\\\\'." }
|
|
queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." }
|
|
timeout: { type: number, description: "Command timeout in seconds (default 30)." }
|
|
required: [host_ids, command_type, full_command]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: rtr_run_script
|
|
name: crowdstrike-rtr-run-script
|
|
description: "Open an RTR batch session and run a script via runscript (cloud-stored by name or inline raw PowerShell)."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
host_ids: { type: string, description: "Comma-separated device IDs." }
|
|
script_name: { type: string, description: "Name of a cloud-stored RTR script (exactly one of script_name/raw)." }
|
|
raw: { type: string, description: "Inline raw PowerShell script (exactly one of script_name/raw)." }
|
|
queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." }
|
|
timeout: { type: number, description: "Script timeout in seconds (default 30)." }
|
|
required: [host_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: rtr_list_processes
|
|
name: crowdstrike-rtr-list-processes
|
|
description: "Open an RTR session on a single host and list running processes (ps)."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
host_id: { type: string, description: "A single device ID." }
|
|
queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." }
|
|
timeout: { type: number, description: "Command timeout in seconds (default 30)." }
|
|
required: [host_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: rtr_kill_process
|
|
name: crowdstrike-rtr-kill-process
|
|
description: "Open an RTR session on a single host and kill one or more processes by PID."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
host_id: { type: string, description: "A single device ID." }
|
|
process_ids: { type: string, description: "Comma-separated process IDs (PIDs) to kill." }
|
|
queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." }
|
|
timeout: { type: number, description: "Command timeout in seconds (default 30)." }
|
|
required: [host_id, process_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: search_custom_iocs
|
|
name: crowdstrike-search-custom-iocs
|
|
description: "Search custom IOC indicators using optional FQL filter parts (type, value, source, expiration)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
types: { type: string, description: "Indicator type filter value, e.g. domain or sha256." }
|
|
values: { type: string, description: "Indicator value filter." }
|
|
sources: { type: string, description: "Source label filter." }
|
|
expiration: { type: string, description: "Expiration date filter (ISO 8601)." }
|
|
limit: { type: string, description: "Max results to return (default 50)." }
|
|
sort: { type: string, description: "Sort expression, e.g. created_on.desc." }
|
|
offset: { type: string, description: "Pagination offset." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: get_custom_ioc
|
|
name: crowdstrike-get-custom-ioc
|
|
description: "Retrieve a custom IOC indicator by its ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ioc_id: { type: string, description: "IOC indicator ID to retrieve." }
|
|
required: [ioc_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: update_custom_ioc
|
|
name: crowdstrike-update-custom-ioc
|
|
description: "Update an existing custom IOC indicator (action, platforms, severity, source, description, expiration)."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ioc_id: { type: string, description: "IOC indicator ID to update." }
|
|
action: { type: string, description: "Action: no_action, allow, prevent_no_ui, prevent, or detect." }
|
|
platforms: { type: string, description: "Comma-separated platforms: windows, mac, linux." }
|
|
severity: { type: string, description: "Severity: informational, low, medium, high, or critical." }
|
|
source: { type: string, description: "Source label." }
|
|
description: { type: string, description: "Description text." }
|
|
expiration: { type: string, description: "Expiration date (ISO 8601)." }
|
|
required: [ioc_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: batch_upload_custom_ioc
|
|
name: crowdstrike-batch-upload-custom-ioc
|
|
description: "Create multiple custom IOC indicators in a single call by providing a JSON array of indicator objects."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
multiple_indicators_json: { type: string, description: "JSON array string of indicator objects to create." }
|
|
required: [multiple_indicators_json]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: processes_ran_on
|
|
name: crowdstrike-processes-ran-on
|
|
description: "List process IDs that ran a given indicator on a specific device."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
type: { type: string, description: "Indicator type: sha256, sha1, md5, domain, ipv4, or ipv6." }
|
|
value: { type: string, description: "Indicator value." }
|
|
device_id: { type: string, description: "Device ID to scope the query." }
|
|
required: [type, value, device_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: process_details
|
|
name: crowdstrike-process-details
|
|
description: "Retrieve full details for one or more processes by process ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated process IDs." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: device_ran_on
|
|
name: crowdstrike-device-ran-on
|
|
description: "List device IDs on which a given indicator has been observed."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
type: { type: string, description: "Indicator type: sha256, sha1, md5, domain, ipv4, or ipv6." }
|
|
value: { type: string, description: "Indicator value." }
|
|
required: [type, value]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: create_host_group
|
|
name: crowdstrike-create-host-group
|
|
description: "Create a new host group (static or dynamic) with an optional description and assignment rule."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
name: { type: string, description: "Name for the new host group." }
|
|
group_type: { type: string, description: "Group type: static or dynamic." }
|
|
description: { type: string, description: "Optional description for the host group." }
|
|
assignment_rule: { type: string, description: "Optional FQL assignment rule (required for dynamic groups)." }
|
|
required: [name, group_type]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: update_host_group
|
|
name: crowdstrike-update-host-group
|
|
description: "Update an existing host group's name, description, or assignment rule."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
host_group_id: { type: string, description: "ID of the host group to update." }
|
|
name: { type: string, description: "New name for the host group." }
|
|
description: { type: string, description: "New description for the host group." }
|
|
assignment_rule: { type: string, description: "New FQL assignment rule for dynamic groups." }
|
|
required: [host_group_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: delete_host_groups
|
|
name: crowdstrike-delete-host-groups
|
|
description: "Delete one or more host groups by ID."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
host_group_id: { type: string, description: "Comma-separated host group IDs to delete." }
|
|
required: [host_group_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_host_group_members
|
|
name: crowdstrike-list-host-group-members
|
|
description: "List devices that are members of a host group, with optional FQL filter and pagination."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
host_group_id: { type: string, description: "Host group ID to list members of." }
|
|
filter: { type: string, description: "Optional FQL filter to narrow results." }
|
|
limit: { type: string, description: "Max members to return (default 50)." }
|
|
offset: { type: string, description: "Pagination offset." }
|
|
sort: { type: string, description: "Sort expression, e.g. hostname.asc." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: add_host_group_members
|
|
name: crowdstrike-add-host-group-members
|
|
description: "Add one or more hosts to a host group by device ID."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
host_group_id: { type: string, description: "ID of the host group to add hosts to." }
|
|
host_ids: { type: string, description: "Comma-separated device IDs to add." }
|
|
required: [host_group_id, host_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: remove_host_group_members
|
|
name: crowdstrike-remove-host-group-members
|
|
description: "Remove one or more hosts from a host group by device ID."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
host_group_id: { type: string, description: "ID of the host group to remove hosts from." }
|
|
host_ids: { type: string, description: "Comma-separated device IDs to remove." }
|
|
required: [host_group_id, host_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Cases ─────────────────────────────────────────────────────────────────
|
|
- id: list_case_summaries
|
|
name: crowdstrike-list-case-summaries
|
|
description: "List case summaries. If ids are provided, fetches those specific cases; otherwise queries all cases sorted by creation date and returns their summaries."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated case IDs (optional). If omitted, all cases are listed." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: get_evidence_for_case
|
|
name: crowdstrike-get-evidence-for-case
|
|
description: "Retrieve full case details including evidence for a single case by ID. Evidence is available at resources[0].evidence in the response."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "Case ID." }
|
|
required: [id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: add_case_tag
|
|
name: crowdstrike-add-case-tag
|
|
description: "Add one or more tags to an existing case."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "Case ID." }
|
|
tags: { type: string, description: "Comma-separated tags to add." }
|
|
required: [id, tags]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: delete_case_tag
|
|
name: crowdstrike-delete-case-tag
|
|
description: "Remove a single tag from an existing case."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "Case ID." }
|
|
tag: { type: string, description: "Tag to remove." }
|
|
required: [id, tag]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: resolve_case
|
|
name: crowdstrike-resolve-case
|
|
description: "Update a case: change status, name, description, assigned analyst, or severity."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "Case ID." }
|
|
status: { type: string, description: "New case status (optional)." }
|
|
name: { type: string, description: "New case name (optional)." }
|
|
assigned_to_uuid: { type: string, description: "UUID of the analyst to assign the case to (optional)." }
|
|
description: { type: string, description: "Updated case description (optional)." }
|
|
severity: { type: number, description: "Severity level as an integer (optional)." }
|
|
required: [id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_detection_summaries
|
|
name: crowdstrike-list-detection-summaries
|
|
description: "List alert/detection summaries. Accepts explicit composite IDs or an FQL filter to query alerts first, then fetches full entities."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
fetch_query: { type: string, description: "FQL filter to query alerts (optional, used when ids are not provided)." }
|
|
ids: { type: string, description: "Comma-separated alert composite IDs (optional). Takes priority over fetch_query." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: endpoint
|
|
name: crowdstrike-endpoint
|
|
description: "Look up a device/endpoint by device ID, local IP, or hostname; returns full device details for matches."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "Device ID to match (optional)." }
|
|
ip: { type: string, description: "Local IP address to match (optional)." }
|
|
hostname: { type: string, description: "Hostname to match (optional)." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
# RTR script/file management and extended Real Time Response commands
|
|
# Fragment — matches manifest.yaml command block format
|
|
|
|
- id: upload_script
|
|
name: crowdstrike-upload-script
|
|
description: "Upload a PowerShell script to the RTR cloud script library."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
name: { type: string, description: "Script name (unique identifier in the library)." }
|
|
permission_type: { type: string, description: "Visibility: private, group, or public (default private)." }
|
|
content: { type: string, description: "PowerShell script content." }
|
|
required: [name, content]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: get_script
|
|
name: crowdstrike-get-script
|
|
description: "Retrieve one or more RTR cloud scripts by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
script_id: { type: string, description: "Comma-separated script IDs." }
|
|
required: [script_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: delete_script
|
|
name: crowdstrike-delete-script
|
|
description: "Delete an RTR cloud script by ID."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
script_id: { type: string, description: "Script ID to delete." }
|
|
required: [script_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_scripts
|
|
name: crowdstrike-list-scripts
|
|
description: "List all RTR cloud scripts available in the tenant."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_files
|
|
name: crowdstrike-list-files
|
|
description: "List all RTR PUT files (files available for deployment to hosts)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: get_file
|
|
name: crowdstrike-get-file
|
|
description: "Retrieve one or more RTR PUT files by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
file_id: { type: string, description: "Comma-separated PUT file IDs." }
|
|
required: [file_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: delete_file
|
|
name: crowdstrike-delete-file
|
|
description: "Delete an RTR PUT file by ID."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
file_id: { type: string, description: "PUT file ID to delete." }
|
|
required: [file_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: refresh_session
|
|
name: crowdstrike-refresh-session
|
|
description: "Refresh an existing RTR session for a host, extending its TTL."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
host_id: { type: string, description: "Device ID of the host whose session to refresh." }
|
|
required: [host_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_host_files
|
|
name: crowdstrike-list-host-files
|
|
description: "List files extracted from an RTR session on a specific host. Opens a new session if no session_id is provided."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
host_id: { type: string, description: "Device ID of the target host." }
|
|
session_id: { type: string, description: "Existing RTR session ID (optional; a new session is opened if omitted)." }
|
|
required: [host_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: rtr_remove_file
|
|
name: crowdstrike-rtr-remove-file
|
|
description: "Open an RTR batch session and remove a file from one or more hosts using the rm command."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
host_ids: { type: string, description: "Comma-separated device IDs." }
|
|
file_path: { type: string, description: "Full path of the file to remove on the host." }
|
|
os: { type: string, description: "Target OS: Windows, Linux, or Mac." }
|
|
queue_offline: { type: string, description: "Queue command for offline hosts: true or false (default false)." }
|
|
timeout: { type: string, description: "Command timeout in seconds (default 30)." }
|
|
required: [host_ids, file_path, os]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: rtr_list_network_stats
|
|
name: crowdstrike-rtr-list-network-stats
|
|
description: "Open an RTR batch session on a single host and run netstat to list active network connections."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
host_id: { type: string, description: "Device ID of the target host." }
|
|
queue_offline: { type: string, description: "Queue command for offline hosts: true or false (default false)." }
|
|
timeout: { type: string, description: "Command timeout in seconds (default 30)." }
|
|
required: [host_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: rtr_list_scheduled_tasks
|
|
name: crowdstrike-rtr-list-scheduled-tasks
|
|
description: "Open an RTR batch session and enumerate scheduled tasks on Windows hosts via schtasks."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
host_ids: { type: string, description: "Comma-separated device IDs." }
|
|
queue_offline: { type: string, description: "Queue command for offline hosts: true or false (default false)." }
|
|
timeout: { type: string, description: "Command timeout in seconds (default 30)." }
|
|
required: [host_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── ML Exclusions ──────────────────────────────────────────────────────────
|
|
- id: create_ml_exclusion
|
|
name: crowdstrike-create-ml-exclusion
|
|
description: "Create a new ML exclusion to prevent the machine learning engine from triggering on a specific value."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
value: { type: string, description: "The exclusion value (e.g. file path or hash)." }
|
|
excluded_from: { type: string, description: "Comma-separated list of ML detection categories to exclude from (e.g. blocking,extraction)." }
|
|
comment: { type: string, description: "Optional comment describing the reason for the exclusion." }
|
|
groups: { type: string, description: "Comma-separated host group IDs to scope the exclusion. Defaults to all groups." }
|
|
required: [value, excluded_from]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: update_ml_exclusion
|
|
name: crowdstrike-update-ml-exclusion
|
|
description: "Update an existing ML exclusion by ID (value, comment, or groups)."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "ML exclusion ID to update." }
|
|
value: { type: string, description: "New exclusion value (optional)." }
|
|
comment: { type: string, description: "Updated comment (optional)." }
|
|
groups: { type: string, description: "Comma-separated host group IDs to replace the current scoping (optional)." }
|
|
required: [id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: delete_ml_exclusion
|
|
name: crowdstrike-delete-ml-exclusion
|
|
description: "Delete one or more ML exclusions by ID."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated ML exclusion IDs to delete." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: search_ml_exclusion
|
|
name: crowdstrike-search-ml-exclusion
|
|
description: "Search ML exclusions by explicit IDs, a value substring match, or an FQL filter; returns full exclusion entities."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated exclusion IDs (takes priority over value and filter)." }
|
|
value: { type: string, description: "Value substring to search for (takes priority over filter when ids is absent)." }
|
|
filter: { type: string, description: "FQL filter string (used when neither ids nor value is provided)." }
|
|
limit: { type: string, description: "Max results to return." }
|
|
offset: { type: string, description: "Pagination offset." }
|
|
sort: { type: string, description: "Sort expression, e.g. value.asc." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── IOA Exclusions ─────────────────────────────────────────────────────────
|
|
- id: create_ioa_exclusion
|
|
name: crowdstrike-create-ioa-exclusion
|
|
description: "Create a new IOA exclusion to suppress a specific Indicator of Attack pattern."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
exclusion_name: { type: string, description: "Display name for the IOA exclusion." }
|
|
pattern_id: { type: string, description: "ID of the IOA pattern to exclude." }
|
|
cl_regex: { type: string, description: "Command-line regular expression to match." }
|
|
ifn_regex: { type: string, description: "Image filename regular expression to match." }
|
|
pattern_name: { type: string, description: "Human-readable pattern name (optional)." }
|
|
comment: { type: string, description: "Optional comment." }
|
|
description: { type: string, description: "Optional description." }
|
|
groups: { type: string, description: "Comma-separated host group IDs to scope the exclusion. Defaults to all groups." }
|
|
detection_json: { type: string, description: "Optional detection JSON override." }
|
|
required: [exclusion_name, pattern_id, cl_regex, ifn_regex]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: update_ioa_exclusion
|
|
name: crowdstrike-update-ioa-exclusion
|
|
description: "Update an existing IOA exclusion by ID."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "IOA exclusion ID to update." }
|
|
exclusion_name: { type: string, description: "New display name (optional)." }
|
|
pattern_id: { type: string, description: "New pattern ID (optional)." }
|
|
pattern_name: { type: string, description: "New pattern name (optional)." }
|
|
cl_regex: { type: string, description: "New command-line regex (optional)." }
|
|
ifn_regex: { type: string, description: "New image filename regex (optional)." }
|
|
comment: { type: string, description: "Updated comment (optional)." }
|
|
description: { type: string, description: "Updated description (optional)." }
|
|
groups: { type: string, description: "Comma-separated host group IDs to replace current scoping (optional)." }
|
|
detection_json: { type: string, description: "Updated detection JSON (optional)." }
|
|
required: [id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: delete_ioa_exclusion
|
|
name: crowdstrike-delete-ioa-exclusion
|
|
description: "Delete one or more IOA exclusions by ID."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated IOA exclusion IDs to delete." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: search_ioa_exclusion
|
|
name: crowdstrike-search-ioa-exclusion
|
|
description: "Search IOA exclusions by explicit IDs, a name substring match, or an FQL filter; returns full exclusion entities."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated exclusion IDs (takes priority over name and filter)." }
|
|
name: { type: string, description: "Name substring to search for (takes priority over filter when ids is absent)." }
|
|
filter: { type: string, description: "FQL filter string (used when neither ids nor name is provided)." }
|
|
limit: { type: string, description: "Max results to return." }
|
|
offset: { type: string, description: "Pagination offset." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Quarantine ─────────────────────────────────────────────────────────────
|
|
- id: list_quarantined_file
|
|
name: crowdstrike-list-quarantined-file
|
|
description: "List quarantined files by explicit IDs or an FQL filter query."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated quarantined file IDs (takes priority over filter)." }
|
|
filter: { type: string, description: "FQL filter string (used when ids is absent)." }
|
|
limit: { type: string, description: "Max results to return (default 50)." }
|
|
offset: { type: string, description: "Pagination offset." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: apply_quarantine_file_action
|
|
name: crowdstrike-apply-quarantine-file-action
|
|
description: "Apply an action (delete, release, or unrelease) to one or more quarantined files."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated quarantined file IDs." }
|
|
action: { type: string, description: "Action to apply: delete, release, or unrelease." }
|
|
comment: { type: string, description: "Comment explaining the reason for the action." }
|
|
required: [ids, action, comment]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Spotlight CVE ──────────────────────────────────────────────────────────
|
|
- id: cve
|
|
name: crowdstrike-cve
|
|
description: "Retrieve Falcon Spotlight vulnerability details for one or more CVE IDs, including CVE facet metadata."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
cve: { type: string, description: "Comma-separated CVE IDs to look up (e.g. CVE-2021-44228,CVE-2022-3786)." }
|
|
required: [cve]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: spotlight_list_host_by_vulnerability
|
|
name: crowdstrike-spotlight-list-host-by-vulnerability
|
|
description: "List hosts affected by one or more CVE IDs using Falcon Spotlight, with host_info facet details."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
cve_ids: { type: string, description: "Comma-separated CVE IDs to filter by (e.g. CVE-2021-44228)." }
|
|
limit: { type: string, description: "Max results to return (default 50)." }
|
|
required: [cve_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── ODS — On-Demand Scans ────────────────────────────────────────────────────
|
|
- id: ods_query_scan
|
|
name: crowdstrike-ods-query-scan
|
|
description: "Query ODS scans by ID or FQL filter. If ids provided, fetch those scans directly; otherwise query and resolve."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated scan IDs to retrieve directly." }
|
|
filter: { type: string, description: "FQL filter to narrow query results." }
|
|
limit: { type: string, description: "Max results to return." }
|
|
offset: { type: string, description: "Pagination offset." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: ods_query_scheduled_scan
|
|
name: crowdstrike-ods-query-scheduled-scan
|
|
description: "Query ODS scheduled scans by ID or FQL filter. If ids provided, fetch those scans directly; otherwise query and resolve."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated scheduled scan IDs to retrieve directly." }
|
|
filter: { type: string, description: "FQL filter to narrow query results." }
|
|
limit: { type: string, description: "Max results to return." }
|
|
offset: { type: string, description: "Pagination offset." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: ods_query_scan_host
|
|
name: crowdstrike-ods-query-scan-host
|
|
description: "Query ODS scan hosts by ID or FQL filter. If ids provided, fetch those scan-host records directly; otherwise query and resolve."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated scan-host IDs to retrieve directly." }
|
|
filter: { type: string, description: "FQL filter to narrow query results." }
|
|
limit: { type: string, description: "Max results to return." }
|
|
offset: { type: string, description: "Pagination offset." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: ods_query_malicious_files
|
|
name: crowdstrike-ods-query-malicious-files
|
|
description: "Query ODS malicious files by file_ids or FQL filter. If file_ids provided, fetch those records directly; otherwise query and resolve."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
file_ids: { type: string, description: "Comma-separated malicious file IDs to retrieve directly." }
|
|
filter: { type: string, description: "FQL filter to narrow query results." }
|
|
limit: { type: string, description: "Max results to return." }
|
|
offset: { type: string, description: "Pagination offset." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: ods_create_scan
|
|
name: crowdstrike-ods-create-scan
|
|
description: "Create an ODS on-demand scan targeting specific hosts and/or host groups."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
hosts: { type: string, description: "Comma-separated device IDs to scan." }
|
|
host_groups: { type: string, description: "Comma-separated host group IDs to scan." }
|
|
file_paths: { type: string, description: "Comma-separated file paths to include in the scan." }
|
|
scan_inclusions: { type: string, description: "Comma-separated scan inclusion patterns." }
|
|
description: { type: string, description: "Optional description for the scan." }
|
|
quarantine: { type: string, description: "Quarantine detected malicious files: true or false." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: ods_create_scheduled_scan
|
|
name: crowdstrike-ods-create-scheduled-scan
|
|
description: "Create a recurring ODS scheduled scan for one or more host groups."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
host_groups: { type: string, description: "Comma-separated host group IDs (required)." }
|
|
file_paths: { type: string, description: "Comma-separated file paths to include." }
|
|
scan_inclusions: { type: string, description: "Comma-separated scan inclusion patterns." }
|
|
description: { type: string, description: "Optional description." }
|
|
schedule_start_timestamp: { type: string, description: "ISO 8601 start timestamp (required)." }
|
|
schedule_interval: { type: string, description: "Recurrence: Never, Daily, Weekly, Every other week, Every four weeks, or Monthly (required)." }
|
|
required: [host_groups, schedule_start_timestamp, schedule_interval]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: ods_delete_scheduled_scan
|
|
name: crowdstrike-ods-delete-scheduled-scan
|
|
description: "Delete one or more ODS scheduled scans by ID."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated scheduled scan IDs to delete." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── CSPM — Cloud Security Posture Management ──────────────────────────────────
|
|
- id: cspm_list_policy_details
|
|
name: crowdstrike-cspm-list-policy-details
|
|
description: "Retrieve CSPM policy details for one or more policy IDs."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
policy_ids: { type: string, description: "Comma-separated CSPM policy IDs." }
|
|
required: [policy_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: cspm_list_service_policy_settings
|
|
name: crowdstrike-cspm-list-service-policy-settings
|
|
description: "List CSPM service policy settings for a given policy ID and cloud platform."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
policy_id: { type: string, description: "CSPM policy ID." }
|
|
cloud_platform: { type: string, description: "Cloud platform: aws (default), azure, or gcp." }
|
|
service: { type: string, description: "Optional cloud service name to filter." }
|
|
limit: { type: string, description: "Max results to return." }
|
|
required: [policy_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: cspm_update_policy_settings
|
|
name: crowdstrike-cspm-update-policy-settings
|
|
description: "Update CSPM policy settings: enable/disable, change severity, scope to regions or account."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
policy_id: { type: string, description: "CSPM policy ID to update (required)." }
|
|
account_id: { type: string, description: "Optional cloud account ID to scope the update." }
|
|
enabled: { type: string, description: "Enable policy: true (default) or false." }
|
|
regions: { type: string, description: "Comma-separated regions to scope the policy." }
|
|
severity: { type: string, description: "Optional severity override." }
|
|
tag_excluded: { type: string, description: "Exclude tagged resources: true or false." }
|
|
required: [policy_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Users / Rules / Alerts ────────────────────────────────────────────────────
|
|
- id: list_users
|
|
name: crowdstrike-list-users
|
|
description: "List Falcon users. If id provided, fetch those users directly; otherwise query with optional filter."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "Comma-separated user UUIDs to retrieve directly." }
|
|
filter: { type: string, description: "FQL filter to narrow query results." }
|
|
offset: { type: string, description: "Pagination offset (default 0)." }
|
|
limit: { type: string, description: "Max results to return (default 50)." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: get_ioarules
|
|
name: crowdstrike-get-ioarules
|
|
description: "Retrieve IOA (Indicator of Attack) custom rules by rule ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
rule_ids: { type: string, description: "Comma-separated IOA rule IDs." }
|
|
required: [rule_ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_cnapp_alerts
|
|
name: crowdstrike-list-cnapp-alerts
|
|
description: "List CNAPP container security alerts, optionally filtered by FQL expression."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
filter: { type: string, description: "Optional FQL filter to narrow results." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: resolve_identity_detection
|
|
name: crowdstrike-resolve-identity-detection
|
|
description: "Resolve or update Falcon Identity Detection alerts: change status, assign, comment, tag, or unassign."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated composite alert IDs (required)." }
|
|
update_status: { type: string, description: "New status, e.g. new, in_progress, closed, or reopened." }
|
|
assign_to_uuid: { type: string, description: "Analyst UUID to assign the detection to." }
|
|
append_comment: { type: string, description: "Comment text to append." }
|
|
add_tag: { type: string, description: "Tag to add to the detection." }
|
|
remove_tag: { type: string, description: "Tag to remove from the detection." }
|
|
unassign: { type: string, description: "Unassign the detection: true or false." }
|
|
show_in_ui: { type: string, description: "Show in UI: true or false." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: resolve_mobile_detection
|
|
name: crowdstrike-resolve-mobile-detection
|
|
description: "Resolve or update Falcon Mobile Detection alerts: change status, assign, comment, tag, or unassign."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated composite alert IDs (required)." }
|
|
update_status: { type: string, description: "New status, e.g. new, in_progress, closed, or reopened." }
|
|
assign_to_uuid: { type: string, description: "Analyst UUID to assign the detection to." }
|
|
append_comment: { type: string, description: "Comment text to append." }
|
|
add_tag: { type: string, description: "Tag to add to the detection." }
|
|
remove_tag: { type: string, description: "Tag to remove from the detection." }
|
|
unassign: { type: string, description: "Unassign the detection: true or false." }
|
|
show_in_ui: { type: string, description: "Show in UI: true or false." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_workflow_definitions
|
|
name: crowdstrike-list-workflow-definitions
|
|
description: "List Falcon Fusion workflow definitions using an optional FQL filter, pagination offset/limit, and sort expression."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
filter: { type: string, description: "FQL filter expression." }
|
|
limit: { type: string, description: "Maximum number of results (default 50)." }
|
|
offset: { type: string, description: "Pagination offset (default 0)." }
|
|
sort: { type: string, description: "Sort expression, e.g. name.asc." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: workflow_execute
|
|
name: crowdstrike-workflow-execute
|
|
description: "Trigger execution of one or more Falcon Fusion workflow definitions."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
definition_id: { type: string, description: "Comma-separated workflow definition IDs to execute." }
|
|
name: { type: string, description: "Optional workflow name filter." }
|
|
key: { type: string, description: "Optional idempotency key for the execution." }
|
|
source_event_url: { type: string, description: "Optional source event URL." }
|
|
execution_cid: { type: string, description: "Comma-separated CIDs to target for execution." }
|
|
body: { type: string, description: "JSON string body to pass as the execution payload (default {})." }
|
|
required: [definition_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_workflow_executions
|
|
name: crowdstrike-list-workflow-executions
|
|
description: "List Falcon Fusion workflow execution records using an optional FQL filter, pagination offset/limit, and sort expression."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
filter: { type: string, description: "FQL filter expression." }
|
|
limit: { type: string, description: "Maximum number of results (default 50)." }
|
|
offset: { type: string, description: "Pagination offset (default 0)." }
|
|
sort: { type: string, description: "Sort expression, e.g. start_timestamp.desc." }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_workflow_execution_results
|
|
name: crowdstrike-list-workflow-execution-results
|
|
description: "Retrieve detailed results for one or more workflow execution IDs."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated workflow execution IDs." }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: workflow_execution_action
|
|
name: crowdstrike-workflow-execution-action
|
|
description: "Perform an action (cancel or resume) on one or more workflow executions."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated workflow execution IDs." }
|
|
action_name: { type: string, description: "Action to perform: cancel or resume.", enum: [cancel, resume] }
|
|
required: [ids, action_name]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: list_identity_entities
|
|
name: crowdstrike-list-identity-entities
|
|
description: "Query Falcon Identity Protection entities (users or endpoints) via the GraphQL API, returning risk scores and factors."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
type: { type: string, description: "Entity type: USER or ENDPOINT.", enum: [USER, ENDPOINT] }
|
|
limit: { type: string, description: "Maximum number of nodes to return (default 50)." }
|
|
primary_display_name: { type: string, description: "Optional filter by primary display name (informational; include in query if supported)." }
|
|
email: { type: string, description: "Optional filter by email address (informational; include in query if supported)." }
|
|
required: [type]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Connectivity test ─────────────────────────────────────────────────────
|
|
- id: test_connection
|
|
name: crowdstrike-test-connection
|
|
description: "Verify connectivity and credentials (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
ingestion:
|
|
command: search_detections
|
|
mapper: search_detections
|
|
default_incident_type: "CrowdStrike Detection"
|