CrowdStrike

Lift network containment from one or more hosts, restoring normal network access. Args: - ids: Array of device IDs to release from containment (max 100) Returns: Confirmation of containment lift action.

Query alerts from CrowdStrike Falcon with optional filtering. Alerts are unified security notifications that can come from various CrowdStrike products. Args: - filter: FQL filter expression (e.g., "severity:>=3", "status:'new'") - limit: Number of results (1-10000, default: 100) - offset: Pagination offset - sort: Sort field (e.g., "created_timestamp.desc") Returns: Array of alert IDs matching the query.

Get detailed information for specific alerts by their IDs. Args: - ids: Array of alert IDs (composite_ids) to retrieve Returns: Detailed alert information including severity, status, device info, and behaviors.

Update the status and assignment of one or more alerts. Args: - ids: Array of alert IDs to update - status: New status (optional) - assigned_to: User UUID to assign (optional) - comment: Comment to add (optional) Returns: Confirmation of update action.