riposte-marketplace/integrations/crowdstrike/manifest.yaml

id: crowdstrike
name: CrowdStrike Falcon
version: 1.0.0
description: "CrowdStrike Falcon (OAuth2 API) — device search & enrichment, detections, Spotlight vulnerabilities, custom IOC management, host containment, and Real Time Response."
changelog: "1.0.0 — Initial release: device/detection enrichment, Spotlight, IOC management, contain/lift, and RTR (run command/script, list/kill process)."
category: endpoint

# Per-instance configuration. Scripts obtain an OAuth2 bearer token from
# {base_url}/oauth2/token using client_id/client_secret, then call the API.
config_schema:
  properties:
    base_url:
      type: string
      description: "CrowdStrike API base URL (region-specific), e.g. https://api.crowdstrike.com or https://api.eu-1.crowdstrike.com"
      default: https://api.crowdstrike.com
    client_id:
      type: string
      description: "Falcon API client ID (Support → API Clients and Keys)"
      x-soar-sensitive: true
    client_secret:
      type: string
      description: "Falcon API client secret"
      x-soar-sensitive: true
  required:
    - client_id
    - client_secret

# Documented for reference; the bundled scripts perform the OAuth2 client-
# credentials exchange themselves and send Authorization: Bearer <token>.
auth:
  - id: oauth2
    type: oauth2_client_credentials
    secret_field: client_secret

commands:
  # ── Enrichment / read ─────────────────────────────────────────────────────
  - id: search_device
    name: crowdstrike-search-device
    description: "Search managed devices (hosts) by hostname, IP, platform, or status; returns full device details for matches."
    risk: read
    inputs_schema:
      properties:
        hostname: { type: string, description: "Hostname to match (exact)." }
        ip: { type: string, description: "Local IP address to match." }
        platform_name: { type: string, description: "Platform: Windows, Mac, or Linux." }
        status: { type: string, description: "Containment status: normal, containment_pending, contained, or lift_containment_pending." }
        limit: { type: number, description: "Max device IDs to resolve (default 50)." }
      required: []
    outputs_schema: { properties: {} }

  - id: get_device_details
    name: crowdstrike-get-device-details
    description: "Retrieve full details for one or more devices by ID."
    risk: read
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated device IDs." }
      required: [ids]
    outputs_schema: { properties: {} }

  - id: device_online_state
    name: crowdstrike-device-online-state
    description: "Get the current online/offline state for one or more devices by ID."
    risk: read
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated device IDs." }
      required: [ids]
    outputs_schema: { properties: {} }

  - id: search_detections
    name: crowdstrike-search-detections
    description: "Search detections/alerts using an FQL filter; returns full alert entities for matches."
    risk: read
    inputs_schema:
      properties:
        filter: { type: string, description: "FQL filter (default \"product:'epp'+type:'ldt'\")." }
        limit: { type: number, description: "Max alerts to return (default 50)." }
      required: []
    outputs_schema: { properties: {} }

  - id: list_host_groups
    name: crowdstrike-list-host-groups
    description: "List host groups, optionally filtered by an FQL expression."
    risk: read
    inputs_schema:
      properties:
        filter: { type: string, description: "Optional FQL filter, e.g. \"name:*'*prod*'\"." }
        limit: { type: number, description: "Max groups to return (default 50)." }
      required: []
    outputs_schema: { properties: {} }

  - id: spotlight_search_vulnerability
    name: crowdstrike-spotlight-search-vulnerability
    description: "Search Falcon Spotlight vulnerabilities by FQL filter or CVE ID, with CVE facet detail."
    risk: read
    inputs_schema:
      properties:
        filter: { type: string, description: "FQL filter (defaults to \"status:'open'\")." }
        cve_id: { type: string, description: "Comma-separated CVE IDs; overrides filter when provided." }
        limit: { type: number, description: "Max vulnerabilities to return (default 50)." }
      required: []
    outputs_schema: { properties: {} }

  - id: ioc_device_count
    name: crowdstrike-ioc-device-count
    description: "Count how many devices have observed a given indicator (IOC)."
    risk: read
    inputs_schema:
      properties:
        type: { type: string, description: "Indicator type: sha256, sha1, md5, domain, ipv4, or ipv6." }
        value: { type: string, description: "Indicator value." }
      required: [type, value]
    outputs_schema: { properties: {} }

  # ── Actions (containment, detection workflow, IOC management) ──────────────
  - id: contain_host
    name: crowdstrike-contain-host
    description: "Network-contain one or more hosts (isolate them while keeping Falcon connectivity)."
    risk: destructive
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated device IDs to contain." }
      required: [ids]
    outputs_schema: { properties: {} }

  - id: lift_containment
    name: crowdstrike-lift-containment
    description: "Lift network containment on one or more hosts (reconnect them)."
    risk: destructive
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated device IDs to release." }
      required: [ids]
    outputs_schema: { properties: {} }

  - id: resolve_detection
    name: crowdstrike-resolve-detection
    description: "Update detections/alerts: change status, append a comment, and/or assign to an analyst."
    risk: destructive
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated alert composite IDs." }
        status: { type: string, description: "New status: new, in_progress, closed, or reopened." }
        comment: { type: string, description: "Optional comment to append." }
        assign_to_uuid: { type: string, description: "Optional analyst UUID to assign the detection to." }
      required: [ids]
    outputs_schema: { properties: {} }

  - id: upload_custom_ioc
    name: crowdstrike-upload-custom-ioc
    description: "Create a custom IOC indicator (allow/prevent/detect) applied globally."
    risk: destructive
    inputs_schema:
      properties:
        type: { type: string, description: "Indicator type: sha256, md5, domain, ipv4, or ipv6." }
        value: { type: string, description: "Indicator value." }
        action: { type: string, description: "Action: no_action, allow, prevent_no_ui, prevent, or detect." }
        platforms: { type: string, description: "Comma-separated platforms: windows, mac, linux." }
        severity: { type: string, description: "Optional severity: informational, low, medium, high, or critical." }
        description: { type: string, description: "Optional description." }
        source: { type: string, description: "Optional source label." }
      required: [type, value, action, platforms]
    outputs_schema: { properties: {} }

  - id: delete_custom_ioc
    name: crowdstrike-delete-custom-ioc
    description: "Delete one or more custom IOC indicators by ID."
    risk: destructive
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated IOC indicator IDs." }
      required: [ids]
    outputs_schema: { properties: {} }

  # ── Real Time Response ────────────────────────────────────────────────────
  - id: rtr_run_command
    name: crowdstrike-rtr-run-command
    description: "Open an RTR batch session and run a read-only command (e.g. ls, ps, cat) on the target hosts."
    risk: destructive
    inputs_schema:
      properties:
        host_ids: { type: string, description: "Comma-separated device IDs." }
        command_type: { type: string, description: "Base command, e.g. ls, ps, cat, reg." }
        full_command: { type: string, description: "Full command string, e.g. 'ls C:\\\\'." }
        queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." }
        timeout: { type: number, description: "Command timeout in seconds (default 30)." }
      required: [host_ids, command_type, full_command]
    outputs_schema: { properties: {} }

  - id: rtr_run_script
    name: crowdstrike-rtr-run-script
    description: "Open an RTR batch session and run a script via runscript (cloud-stored by name or inline raw PowerShell)."
    risk: destructive
    inputs_schema:
      properties:
        host_ids: { type: string, description: "Comma-separated device IDs." }
        script_name: { type: string, description: "Name of a cloud-stored RTR script (exactly one of script_name/raw)." }
        raw: { type: string, description: "Inline raw PowerShell script (exactly one of script_name/raw)." }
        queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." }
        timeout: { type: number, description: "Script timeout in seconds (default 30)." }
      required: [host_ids]
    outputs_schema: { properties: {} }

  - id: rtr_list_processes
    name: crowdstrike-rtr-list-processes
    description: "Open an RTR session on a single host and list running processes (ps)."
    risk: destructive
    inputs_schema:
      properties:
        host_id: { type: string, description: "A single device ID." }
        queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." }
        timeout: { type: number, description: "Command timeout in seconds (default 30)." }
      required: [host_id]
    outputs_schema: { properties: {} }

  - id: rtr_kill_process
    name: crowdstrike-rtr-kill-process
    description: "Open an RTR session on a single host and kill one or more processes by PID."
    risk: destructive
    inputs_schema:
      properties:
        host_id: { type: string, description: "A single device ID." }
        process_ids: { type: string, description: "Comma-separated process IDs (PIDs) to kill." }
        queue_offline: { type: string, description: "Queue for offline hosts: true or false (default false)." }
        timeout: { type: number, description: "Command timeout in seconds (default 30)." }
      required: [host_id, process_ids]
    outputs_schema: { properties: {} }