CrowdStrike

Lift network containment from one or more hosts, restoring normal network access. Args: - ids: Array of device IDs to release from containment (max 100) Returns: Confirmation of containment lift action.

Query alerts from CrowdStrike Falcon with optional filtering. Alerts are unified security notifications that can come from various CrowdStrike products. Args: - filter: FQL filter expression (e.g., "severity:>=3", "status:'new'") - limit: Number of results (1-10000, default: 100) - offset: Pagination offset - sort: Sort field (e.g., "created_timestamp.desc") Returns: Array of alert IDs matching the query.

Get detailed information for specific alerts by their IDs. Args: - ids: Array of alert IDs (composite_ids) to retrieve Returns: Detailed alert information including severity, status, device info, and behaviors.

Update the status and assignment of one or more alerts. Args: - ids: Array of alert IDs to update - status: New status (optional) - assigned_to: User UUID to assign (optional) - comment: Comment to add (optional) Returns: Confirmation of update action.

Network contain one or more hosts. This isolates the host from the network while maintaining Falcon sensor connectivity. WARNING: This is a critical security action that will cut off network access to the specified hosts. Args: - ids: Array of device IDs to contain (max 100) Returns: Confirmation of containment action.

Query detections from CrowdStrike Falcon with optional filtering. Returns a list of detection IDs matching the filter criteria. Use crowdstrike_get_detections to get full details. Args: - filter: FQL filter expression (e.g., "status:'new'", "max_severity_displayname:'Critical'") - limit: Number of results (1-9999, default: 100) - offset: Pagination offset - sort: Sort field (e.g., "first_behavior.desc", "max_severity.desc") Returns: Array of detection IDs matching the query.

Get detailed information for specific detections by their IDs. Args: - ids: Array of detection IDs to retrieve (max 1000) Returns: Detailed detection information including behaviors, device info, severity, status, and more.

Update the status and assignment of one or more detections. Args: - ids: Array of detection IDs to update - status: New status (new, in_progress, true_positive, false_positive, ignored) - assigned_to_uuid: UUID of user to assign (optional) - comment: Comment to add (optional) Returns: Confirmation of update action.

Query host groups from CrowdStrike Falcon with optional filtering. Returns a list of host group IDs matching the filter criteria. Args: - filter: FQL filter expression (e.g., "name:'Production*'", "group_type:'dynamic'") - limit: Number of results (1-500, default: 100) - offset: Pagination offset - sort: Sort field (e.g., "name.asc", "created_timestamp.desc") Returns: Array of host group IDs matching the query.

Get detailed information for specific host groups by their IDs. Args: - ids: Array of host group IDs to retrieve Returns: Detailed host group information including name, type, description, and assignment rules.

Create a new host group in CrowdStrike Falcon. Args: - name: Name of the host group - group_type: Type of group (static, dynamic, staticByID) - static: Manually assigned hosts - dynamic: Hosts matching an FQL assignment rule - staticByID: Specific hosts by device ID - description: Description of the group (optional) - assignment_rule: FQL rule for dynamic groups (e.g., "platform_name:'Windows'+hostname:'prod-*'") Returns: The created host group.

Update an existing host group. Args: - id: ID of the host group to update - name: New name (optional) - description: New description (optional) - assignment_rule: New FQL assignment rule for dynamic groups (optional) Returns: The updated host group.

Delete one or more host groups. Args: - ids: Array of host group IDs to delete Returns: Confirmation of deletion.

Add hosts to a static host group. Note: Only works with static or staticByID group types. Args: - group_id: Host group ID - host_ids: Array of device IDs to add Returns: Confirmation of action.

Remove hosts from a static host group. Note: Only works with static or staticByID group types. Args: - group_id: Host group ID - host_ids: Array of device IDs to remove Returns: Confirmation of action.

Query hosts from CrowdStrike Falcon with optional filtering. Returns a list of host/device IDs matching the filter criteria. Use crowdstrike_get_hosts to get full details. Args: - filter: FQL filter expression (e.g., "platform_name:'Windows'", "hostname:'workstation*'") - limit: Number of results (1-5000, default: 100) - offset: Pagination offset - sort: Sort field (e.g., "hostname.asc", "last_seen.desc") Returns: Array of device IDs matching the query.

Get detailed information for specific hosts by their device IDs. Args: - ids: Array of device IDs to retrieve (max 100) Returns: Detailed host information including hostname, OS, IP addresses, agent version, policies, etc.

Hide one or more hosts from the Falcon console. Hidden hosts are not deleted but are removed from normal views. Args: - ids: Array of device IDs to hide (max 100) Returns: Confirmation of hide action.

Unhide one or more previously hidden hosts, making them visible in the Falcon console again. Args: - ids: Array of device IDs to unhide (max 100) Returns: Confirmation of unhide action.

Query incidents from CrowdStrike Falcon with optional filtering. Returns a list of incident IDs matching the filter criteria. Use crowdstrike_get_incidents to get full details. Args: - filter: FQL filter expression (e.g., "status:20", "fine_score:>=50") - limit: Number of results (1-500, default: 100) - offset: Pagination offset - sort: Sort field (e.g., "start.desc", "fine_score.desc") Incident Status Values: - 20: New - 25: Reopened - 30: In Progress - 40: Closed Returns: Array of incident IDs matching the query.

Get detailed information for specific incidents by their IDs. Args: - ids: Array of incident IDs to retrieve Returns: Detailed incident information including hosts, tactics, techniques, status, and score.

Update an incident by performing an action. Args: - ids: Array of incident IDs to update - action: Action to perform (update_status, update_assigned_to_v2, add_tag, delete_tag, add_comment) - value: Value for the action (status number, user UUID, tag name, or comment text) Status Values: - 20: New - 25: Reopened - 30: In Progress - 40: Closed Returns: Confirmation of update action.

Get detailed information about specific behaviors by their IDs. Behaviors are the individual suspicious activities that make up detections and incidents. Args: - ids: Array of behavior IDs to retrieve Returns: Detailed behavior information including command lines, file info, IOCs, and MITRE mappings.

Query custom IOCs from CrowdStrike Falcon with optional filtering. Returns a list of IOC IDs matching the filter criteria. Use crowdstrike_get_iocs to get full details. Args: - filter: FQL filter expression (e.g., "type:'sha256'", "action:'prevent'") - limit: Number of results (1-500, default: 100) - offset: Pagination offset - sort: Sort field (e.g., "created_on.desc") Returns: Array of IOC IDs matching the query.

Get detailed information for specific IOCs by their IDs. Args: - ids: Array of IOC IDs to retrieve Returns: Detailed IOC information including type, value, action, platforms, and metadata.

Create a new custom IOC in CrowdStrike Falcon. Args: - type: IOC type (sha256, md5, domain, ipv4, ipv6) - value: The indicator value (hash, domain name, or IP address) - action: Action to take (no_action, allow, detect, prevent, prevent_no_ui) - platforms: Target platforms (windows, mac, linux) - severity: Severity level (informational, low, medium, high, critical) - optional - description: Description of the IOC - optional - tags: Array of tags - optional - expiration: Expiration date in ISO format - optional - applied_globally: Apply to all hosts (default: true) - optional - host_groups: Specific host group IDs (if not applied globally) - optional Returns: The created IOC.

Delete one or more custom IOCs from CrowdStrike Falcon. Args: - ids: Array of IOC IDs to delete Returns: Confirmation of deletion.

Query prevention policies from CrowdStrike Falcon. Prevention policies control endpoint protection behaviors like blocking, quarantining, etc. Args: - filter: FQL filter expression (e.g., "platform_name:'Windows'", "enabled:true") - limit: Number of results (1-5000, default: 100) - offset: Pagination offset - sort: Sort field Returns: Array of prevention policy IDs.

Get detailed information for specific prevention policies. Args: - ids: Array of policy IDs to retrieve Returns: Detailed policy information including settings, enabled status, and assigned groups.

Query device control policies from CrowdStrike Falcon. Device control policies manage USB device access and other peripheral controls. Args: - filter: FQL filter expression (e.g., "platform_name:'Windows'") - limit: Number of results (1-5000, default: 100) - offset: Pagination offset - sort: Sort field Returns: Array of device control policy IDs.

Get detailed information for specific device control policies. Args: - ids: Array of policy IDs to retrieve Returns: Detailed policy information including USB/Bluetooth settings and enforcement mode.

Query sensor update policies from CrowdStrike Falcon. Sensor update policies control Falcon sensor version deployment and update scheduling. Args: - filter: FQL filter expression (e.g., "platform_name:'Windows'") - limit: Number of results (1-5000, default: 100) - offset: Pagination offset - sort: Sort field Returns: Array of sensor update policy IDs.

Get detailed information for specific sensor update policies. Args: - ids: Array of policy IDs to retrieve Returns: Detailed policy information including sensor version, build, schedule, and uninstall protection settings.

Initialize a Real-Time Response session with a host. RTR allows you to execute commands directly on endpoints for investigation and remediation. Args: - device_id: The device ID to connect to - queue_offline: If true, queue commands for offline hosts (default: false) Returns: Session information including session_id needed for subsequent commands.

Execute a read-only RTR command on an active session. Read-only commands allow investigation without modifying the endpoint. Available base commands include: - cat: Read file contents - cd: Change directory - env: Display environment variables - eventlog: Inspect event logs (Windows) - filehash: Calculate file hash - getsid: Get SID info (Windows) - history: Command history (Linux/Mac) - ifconfig: Network configuration (Linux/Mac) - ipconfig: Network configuration (Windows) - ls: List directory - mount: View mounts (Linux/Mac) - netstat: Network connections - ps: List processes - reg query: Query registry (Windows) - users: List logged in users Args: - session_id: Active RTR session ID - base_command: The RTR base command (e.g., "ls", "ps", "netstat") - command_string: Full command with arguments (e.g., "ls -la /tmp") Returns: Command output including stdout and stderr.

Execute an active responder RTR command that can modify the endpoint. WARNING: These commands can make changes to the endpoint. Use with caution. Active responder commands include: - cp: Copy files - encrypt: Encrypt files - kill: Terminate processes - map: Map network drive (Windows) - memdump: Memory dump - mkdir: Create directory - mv: Move/rename files - reg set/delete: Modify registry (Windows) - restart: Restart system - rm: Delete files - runscript: Execute a script - shutdown: Shutdown system - unmap: Unmap network drive (Windows) - update history/install/list: Manage updates (Linux) - xmemdump: Extended memory dump - zip: Compress files Args: - session_id: Active RTR session ID - base_command: The RTR base command (e.g., "kill", "rm", "runscript") - command_string: Full command with arguments Returns: Command output including stdout and stderr.

Close and delete an RTR session. Sessions should be closed when investigation is complete to free resources. Args: - session_id: RTR session ID to delete Returns: Confirmation of session deletion.

Query vulnerabilities from CrowdStrike Spotlight with filtering. Note: The filter parameter is REQUIRED for this endpoint. Args: - filter: FQL filter expression (REQUIRED). Examples: - "cve.severity:'CRITICAL'" - "status:'open'" - "cve.exploit_status:>=1" (has known exploits) - "host_info.hostname:'server*'" - limit: Number of results (1-400, default: 100) - after: Pagination cursor for next page - sort: Sort field (e.g., "cve.base_score.desc") Returns: Array of vulnerability IDs matching the query.

Get detailed information for specific vulnerabilities by their IDs. Args: - ids: Array of vulnerability IDs to retrieve (max 400) Returns: Detailed vulnerability information including CVE details, affected hosts, remediation info, and CVSS scores.