CrowdStrike

CrowdStrike Falcon MCP Server for Cloudflare Workers

Available Tools

39 tools available in the CrowdStrike MCP server. Each tool can be called by AI assistants to perform specific actions.

crowdstrike_lift_containment

Lift network containment from one or more hosts, restoring normal network access.

Args:

ids: Array of device IDs to release from containment (max 100)

Returns: Confirmation of containment lift action.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Device IDs to release"
    }
  }
}

crowdstrike_query_alerts

Query alerts from CrowdStrike Falcon with optional filtering.

Alerts are unified security notifications that can come from various CrowdStrike products.

Args:

filter: FQL filter expression (e.g., "severity:>=3", "status:'new'")
limit: Number of results (1-10000, default: 100)
offset: Pagination offset
sort: Sort field (e.g., "created_timestamp.desc")

Returns: Array of alert IDs matching the query.

{
  "type": "object",
  "properties": {
    "sort": {
      "type": "string",
      "description": "Sort field and direction"
    },
    "limit": {
      "type": "integer",
      "default": 100,
      "maximum": 10000,
      "minimum": 1,
      "description": "Number of results"
    },
    "filter": {
      "type": "string",
      "description": "FQL filter expression"
    },
    "offset": {
      "type": "integer",
      "minimum": 0,
      "description": "Pagination offset"
    }
  }
}

crowdstrike_get_alerts

Get detailed information for specific alerts by their IDs.

Args:

ids: Array of alert IDs (composite_ids) to retrieve

Returns: Detailed alert information including severity, status, device info, and behaviors.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Alert IDs to retrieve"
    }
  }
}

crowdstrike_update_alerts

Update the status and assignment of one or more alerts.

Args:

ids: Array of alert IDs to update
status: New status (optional)
assigned_to: User UUID to assign (optional)
comment: Comment to add (optional)

Returns: Confirmation of update action.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Alert IDs to update"
    },
    "status": {
      "type": "string",
      "description": "New status"
    },
    "comment": {
      "type": "string",
      "description": "Comment to add"
    },
    "assigned_to": {
      "type": "string",
      "description": "User UUID to assign"
    }
  }
}

crowdstrike_contain_host

Network contain one or more hosts. This isolates the host from the network while maintaining Falcon sensor connectivity.

WARNING: This is a critical security action that will cut off network access to the specified hosts.

Args:

ids: Array of device IDs to contain (max 100)

Returns: Confirmation of containment action.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Device IDs to contain"
    }
  }
}

crowdstrike_query_detections

Query detections from CrowdStrike Falcon with optional filtering.

Returns a list of detection IDs matching the filter criteria. Use crowdstrike_get_detections to get full details.

Args:

filter: FQL filter expression (e.g., "status:'new'", "max_severity_displayname:'Critical'")
limit: Number of results (1-9999, default: 100)
offset: Pagination offset
sort: Sort field (e.g., "first_behavior.desc", "max_severity.desc")

Returns: Array of detection IDs matching the query.

{
  "type": "object",
  "properties": {
    "sort": {
      "type": "string",
      "description": "Sort field and direction"
    },
    "limit": {
      "type": "integer",
      "default": 100,
      "maximum": 9999,
      "minimum": 1,
      "description": "Number of results"
    },
    "filter": {
      "type": "string",
      "description": "FQL filter expression"
    },
    "offset": {
      "type": "integer",
      "minimum": 0,
      "description": "Pagination offset"
    }
  }
}

crowdstrike_get_detections

Get detailed information for specific detections by their IDs.

Args:

ids: Array of detection IDs to retrieve (max 1000)

Returns: Detailed detection information including behaviors, device info, severity, status, and more.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Detection IDs to retrieve"
    }
  }
}

crowdstrike_update_detection

Update the status and assignment of one or more detections.

Args:

ids: Array of detection IDs to update
status: New status (new, in_progress, true_positive, false_positive, ignored)
assigned_to_uuid: UUID of user to assign (optional)
comment: Comment to add (optional)

Returns: Confirmation of update action.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Detection IDs to update"
    },
    "comment": {
      "type": "string",
      "description": "Comment to add"
    },
    "assigned_to_uuid": {
      "type": "string",
      "description": "User UUID to assign"
    }
  }
}

crowdstrike_query_host_groups

Query host groups from CrowdStrike Falcon with optional filtering.

Returns a list of host group IDs matching the filter criteria.

Args:

filter: FQL filter expression (e.g., "name:'Production*'", "group_type:'dynamic'")
limit: Number of results (1-500, default: 100)
offset: Pagination offset
sort: Sort field (e.g., "name.asc", "created_timestamp.desc")

Returns: Array of host group IDs matching the query.

{
  "type": "object",
  "properties": {
    "sort": {
      "type": "string",
      "description": "Sort field and direction"
    },
    "limit": {
      "type": "integer",
      "default": 100,
      "maximum": 500,
      "minimum": 1,
      "description": "Number of results"
    },
    "filter": {
      "type": "string",
      "description": "FQL filter expression"
    },
    "offset": {
      "type": "integer",
      "minimum": 0,
      "description": "Pagination offset"
    }
  }
}

crowdstrike_get_host_groups

Get detailed information for specific host groups by their IDs.

Args:

ids: Array of host group IDs to retrieve

Returns: Detailed host group information including name, type, description, and assignment rules.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Host group IDs to retrieve"
    }
  }
}

crowdstrike_create_host_group

Create a new host group in CrowdStrike Falcon.

Args:

name: Name of the host group
group_type: Type of group (static, dynamic, staticByID)
- static: Manually assigned hosts
- dynamic: Hosts matching an FQL assignment rule
- staticByID: Specific hosts by device ID
description: Description of the group (optional)
assignment_rule: FQL rule for dynamic groups (e.g., "platform_name:'Windows'+hostname:'prod-*'")

Returns: The created host group.

{
  "type": "object",
  "required": [
    "name",
    "group_type"
  ],
  "properties": {
    "name": {
      "type": "string",
      "description": "Group name"
    },
    "group_type": {
      "enum": [
        "static",
        "dynamic",
        "staticByID"
      ],
      "type": "string",
      "description": "Group type"
    },
    "description": {
      "type": "string",
      "description": "Description"
    },
    "assignment_rule": {
      "type": "string",
      "description": "FQL assignment rule for dynamic groups"
    }
  }
}

crowdstrike_update_host_group

Update an existing host group.

Args:

id: ID of the host group to update
name: New name (optional)
description: New description (optional)
assignment_rule: New FQL assignment rule for dynamic groups (optional)

Returns: The updated host group.

{
  "type": "object",
  "required": [
    "id"
  ],
  "properties": {
    "id": {
      "type": "string",
      "description": "Host group ID"
    },
    "name": {
      "type": "string",
      "description": "New name"
    },
    "description": {
      "type": "string",
      "description": "New description"
    },
    "assignment_rule": {
      "type": "string",
      "description": "New assignment rule"
    }
  }
}

crowdstrike_delete_host_groups

Delete one or more host groups.

Args:

ids: Array of host group IDs to delete

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Host group IDs to delete"
    }
  }
}

crowdstrike_add_hosts_to_group

Add hosts to a static host group.

Note: Only works with static or staticByID group types.

Args:

group_id: Host group ID
host_ids: Array of device IDs to add

Returns: Confirmation of action.

{
  "type": "object",
  "required": [
    "group_id",
    "host_ids"
  ],
  "properties": {
    "group_id": {
      "type": "string",
      "description": "Host group ID"
    },
    "host_ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Device IDs to add"
    }
  }
}

crowdstrike_remove_hosts_from_group

Remove hosts from a static host group.

Note: Only works with static or staticByID group types.

Args:

group_id: Host group ID
host_ids: Array of device IDs to remove

Returns: Confirmation of action.

{
  "type": "object",
  "required": [
    "group_id",
    "host_ids"
  ],
  "properties": {
    "group_id": {
      "type": "string",
      "description": "Host group ID"
    },
    "host_ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Device IDs to remove"
    }
  }
}

crowdstrike_query_hosts

Query hosts from CrowdStrike Falcon with optional filtering.

Returns a list of host/device IDs matching the filter criteria. Use crowdstrike_get_hosts to get full details.

Args:

filter: FQL filter expression (e.g., "platform_name:'Windows'", "hostname:'workstation*'")
limit: Number of results (1-5000, default: 100)
offset: Pagination offset
sort: Sort field (e.g., "hostname.asc", "last_seen.desc")

Returns: Array of device IDs matching the query.

{
  "type": "object",
  "properties": {
    "sort": {
      "type": "string",
      "description": "Sort field and direction"
    },
    "limit": {
      "type": "integer",
      "default": 100,
      "maximum": 5000,
      "minimum": 1,
      "description": "Number of results"
    },
    "filter": {
      "type": "string",
      "description": "FQL filter expression"
    },
    "offset": {
      "type": "integer",
      "minimum": 0,
      "description": "Pagination offset"
    }
  }
}

crowdstrike_get_hosts

Get detailed information for specific hosts by their device IDs.

Args:

ids: Array of device IDs to retrieve (max 100)

Returns: Detailed host information including hostname, OS, IP addresses, agent version, policies, etc.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Device IDs to retrieve"
    }
  }
}

crowdstrike_hide_host

Hide one or more hosts from the Falcon console. Hidden hosts are not deleted but are removed from normal views.

Args:

ids: Array of device IDs to hide (max 100)

Returns: Confirmation of hide action.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Device IDs to hide"
    }
  }
}

crowdstrike_unhide_host

Unhide one or more previously hidden hosts, making them visible in the Falcon console again.

Args:

ids: Array of device IDs to unhide (max 100)

Returns: Confirmation of unhide action.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Device IDs to unhide"
    }
  }
}

crowdstrike_query_incidents

Query incidents from CrowdStrike Falcon with optional filtering.

Returns a list of incident IDs matching the filter criteria. Use crowdstrike_get_incidents to get full details.

Args:

filter: FQL filter expression (e.g., "status:20", "fine_score:>=50")
limit: Number of results (1-500, default: 100)
offset: Pagination offset
sort: Sort field (e.g., "start.desc", "fine_score.desc")

Incident Status Values:

20: New
25: Reopened
30: In Progress
40: Closed

Returns: Array of incident IDs matching the query.

{
  "type": "object",
  "properties": {
    "sort": {
      "type": "string",
      "description": "Sort field and direction"
    },
    "limit": {
      "type": "integer",
      "default": 100,
      "maximum": 500,
      "minimum": 1,
      "description": "Number of results"
    },
    "filter": {
      "type": "string",
      "description": "FQL filter expression"
    },
    "offset": {
      "type": "integer",
      "minimum": 0,
      "description": "Pagination offset"
    }
  }
}

crowdstrike_get_incidents

Get detailed information for specific incidents by their IDs.

Args:

ids: Array of incident IDs to retrieve

Returns: Detailed incident information including hosts, tactics, techniques, status, and score.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Incident IDs to retrieve"
    }
  }
}

crowdstrike_update_incident

Update an incident by performing an action.

Args:

ids: Array of incident IDs to update
action: Action to perform (update_status, update_assigned_to_v2, add_tag, delete_tag, add_comment)
value: Value for the action (status number, user UUID, tag name, or comment text)

Status Values:

20: New
25: Reopened
30: In Progress
40: Closed

Returns: Confirmation of update action.

{
  "type": "object",
  "required": [
    "ids",
    "value"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Incident IDs to update"
    },
    "value": {
      "type": "string",
      "description": "Value for the action"
    }
  }
}

crowdstrike_get_behaviors

Get detailed information about specific behaviors by their IDs.

Behaviors are the individual suspicious activities that make up detections and incidents.

Args:

ids: Array of behavior IDs to retrieve

Returns: Detailed behavior information including command lines, file info, IOCs, and MITRE mappings.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Behavior IDs to retrieve"
    }
  }
}

crowdstrike_query_iocs

Query custom IOCs from CrowdStrike Falcon with optional filtering.

Returns a list of IOC IDs matching the filter criteria. Use crowdstrike_get_iocs to get full details.

Args:

filter: FQL filter expression (e.g., "type:'sha256'", "action:'prevent'")
limit: Number of results (1-500, default: 100)
offset: Pagination offset
sort: Sort field (e.g., "created_on.desc")

Returns: Array of IOC IDs matching the query.

{
  "type": "object",
  "properties": {
    "sort": {
      "type": "string",
      "description": "Sort field and direction"
    },
    "limit": {
      "type": "integer",
      "default": 100,
      "maximum": 500,
      "minimum": 1,
      "description": "Number of results"
    },
    "filter": {
      "type": "string",
      "description": "FQL filter expression"
    },
    "offset": {
      "type": "integer",
      "minimum": 0,
      "description": "Pagination offset"
    }
  }
}

crowdstrike_get_iocs

Get detailed information for specific IOCs by their IDs.

Args:

ids: Array of IOC IDs to retrieve

Returns: Detailed IOC information including type, value, action, platforms, and metadata.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "IOC IDs to retrieve"
    }
  }
}

crowdstrike_create_ioc

Create a new custom IOC in CrowdStrike Falcon.

Args:

type: IOC type (sha256, md5, domain, ipv4, ipv6)
value: The indicator value (hash, domain name, or IP address)
action: Action to take (no_action, allow, detect, prevent, prevent_no_ui)
platforms: Target platforms (windows, mac, linux)
severity: Severity level (informational, low, medium, high, critical) - optional
description: Description of the IOC - optional
tags: Array of tags - optional
expiration: Expiration date in ISO format - optional
applied_globally: Apply to all hosts (default: true) - optional
host_groups: Specific host group IDs (if not applied globally) - optional

Returns: The created IOC.

{
  "type": "object",
  "required": [
    "type"
  ],
  "properties": {
    "tags": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Tags"
    },
    "type": {
      "enum": [
        "sha256",
        "md5",
        "domain",
        "ipv4",
        "ipv6"
      ],
      "type": "string",
      "description": "IOC type"
    },
    "value": {
      "type": "string",
      "description": "Indicator value"
    },
    "expiration": {
      "type": "string",
      "description": "Expiration date (ISO format)"
    },
    "description": {
      "type": "string",
      "description": "Description"
    },
    "host_groups": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Host group IDs"
    },
    "applied_globally": {
      "type": "boolean",
      "default": true,
      "description": "Apply globally"
    }
  }
}

crowdstrike_delete_iocs

Delete one or more custom IOCs from CrowdStrike Falcon.

Args:

ids: Array of IOC IDs to delete

Returns: Confirmation of deletion.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "IOC IDs to delete"
    }
  }
}

crowdstrike_query_prevention_policies

Query prevention policies from CrowdStrike Falcon.

Prevention policies control endpoint protection behaviors like blocking, quarantining, etc.

Args:

filter: FQL filter expression (e.g., "platform_name:'Windows'", "enabled:true")
limit: Number of results (1-5000, default: 100)
offset: Pagination offset
sort: Sort field

Returns: Array of prevention policy IDs.

{
  "type": "object",
  "properties": {
    "sort": {
      "type": "string",
      "description": "Sort field"
    },
    "limit": {
      "type": "integer",
      "default": 100,
      "maximum": 5000,
      "minimum": 1,
      "description": "Number of results"
    },
    "filter": {
      "type": "string",
      "description": "FQL filter expression"
    },
    "offset": {
      "type": "integer",
      "minimum": 0,
      "description": "Pagination offset"
    }
  }
}

crowdstrike_get_prevention_policies

Get detailed information for specific prevention policies.

Args:

ids: Array of policy IDs to retrieve

Returns: Detailed policy information including settings, enabled status, and assigned groups.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Policy IDs to retrieve"
    }
  }
}

crowdstrike_query_device_control_policies

Query device control policies from CrowdStrike Falcon.

Device control policies manage USB device access and other peripheral controls.

Args:

filter: FQL filter expression (e.g., "platform_name:'Windows'")
limit: Number of results (1-5000, default: 100)
offset: Pagination offset
sort: Sort field

Returns: Array of device control policy IDs.

{
  "type": "object",
  "properties": {
    "sort": {
      "type": "string",
      "description": "Sort field"
    },
    "limit": {
      "type": "integer",
      "default": 100,
      "maximum": 5000,
      "minimum": 1,
      "description": "Number of results"
    },
    "filter": {
      "type": "string",
      "description": "FQL filter expression"
    },
    "offset": {
      "type": "integer",
      "minimum": 0,
      "description": "Pagination offset"
    }
  }
}

crowdstrike_get_device_control_policies

Get detailed information for specific device control policies.

Args:

ids: Array of policy IDs to retrieve

Returns: Detailed policy information including USB/Bluetooth settings and enforcement mode.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Policy IDs to retrieve"
    }
  }
}

crowdstrike_query_sensor_update_policies

Query sensor update policies from CrowdStrike Falcon.

Sensor update policies control Falcon sensor version deployment and update scheduling.

Args:

filter: FQL filter expression (e.g., "platform_name:'Windows'")
limit: Number of results (1-5000, default: 100)
offset: Pagination offset
sort: Sort field

Returns: Array of sensor update policy IDs.

{
  "type": "object",
  "properties": {
    "sort": {
      "type": "string",
      "description": "Sort field"
    },
    "limit": {
      "type": "integer",
      "default": 100,
      "maximum": 5000,
      "minimum": 1,
      "description": "Number of results"
    },
    "filter": {
      "type": "string",
      "description": "FQL filter expression"
    },
    "offset": {
      "type": "integer",
      "minimum": 0,
      "description": "Pagination offset"
    }
  }
}

crowdstrike_get_sensor_update_policies

Get detailed information for specific sensor update policies.

Args:

ids: Array of policy IDs to retrieve

Returns: Detailed policy information including sensor version, build, schedule, and uninstall protection settings.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Policy IDs to retrieve"
    }
  }
}

crowdstrike_init_rtr_session

Initialize a Real-Time Response session with a host.

RTR allows you to execute commands directly on endpoints for investigation and remediation.

Args:

device_id: The device ID to connect to
queue_offline: If true, queue commands for offline hosts (default: false)

Returns: Session information including session_id needed for subsequent commands.

{
  "type": "object",
  "required": [
    "device_id"
  ],
  "properties": {
    "device_id": {
      "type": "string",
      "description": "Device ID to connect to"
    },
    "queue_offline": {
      "type": "boolean",
      "default": false,
      "description": "Queue for offline hosts"
    }
  }
}

crowdstrike_rtr_command

Execute a read-only RTR command on an active session.

Read-only commands allow investigation without modifying the endpoint.

Available base commands include:

cat: Read file contents
cd: Change directory
env: Display environment variables
eventlog: Inspect event logs (Windows)
filehash: Calculate file hash
getsid: Get SID info (Windows)
history: Command history (Linux/Mac)
ifconfig: Network configuration (Linux/Mac)
ipconfig: Network configuration (Windows)
ls: List directory
mount: View mounts (Linux/Mac)
netstat: Network connections
ps: List processes
reg query: Query registry (Windows)
users: List logged in users

Args:

session_id: Active RTR session ID
base_command: The RTR base command (e.g., "ls", "ps", "netstat")
command_string: Full command with arguments (e.g., "ls -la /tmp")

Returns: Command output including stdout and stderr.

{
  "type": "object",
  "required": [
    "session_id",
    "base_command",
    "command_string"
  ],
  "properties": {
    "session_id": {
      "type": "string",
      "description": "RTR session ID"
    },
    "base_command": {
      "type": "string",
      "description": "Base RTR command"
    },
    "command_string": {
      "type": "string",
      "description": "Full command with arguments"
    }
  }
}

crowdstrike_rtr_active_responder_command

Execute an active responder RTR command that can modify the endpoint.

WARNING: These commands can make changes to the endpoint. Use with caution.

Active responder commands include:

cp: Copy files
encrypt: Encrypt files
kill: Terminate processes
map: Map network drive (Windows)
memdump: Memory dump
mkdir: Create directory
mv: Move/rename files
reg set/delete: Modify registry (Windows)
restart: Restart system
rm: Delete files
runscript: Execute a script
shutdown: Shutdown system
unmap: Unmap network drive (Windows)
update history/install/list: Manage updates (Linux)
xmemdump: Extended memory dump
zip: Compress files

Args:

session_id: Active RTR session ID
base_command: The RTR base command (e.g., "kill", "rm", "runscript")
command_string: Full command with arguments

Returns: Command output including stdout and stderr.

{
  "type": "object",
  "required": [
    "session_id",
    "base_command",
    "command_string"
  ],
  "properties": {
    "session_id": {
      "type": "string",
      "description": "RTR session ID"
    },
    "base_command": {
      "type": "string",
      "description": "Base RTR command"
    },
    "command_string": {
      "type": "string",
      "description": "Full command with arguments"
    }
  }
}

crowdstrike_delete_rtr_session

Close and delete an RTR session.

Sessions should be closed when investigation is complete to free resources.

Args:

session_id: RTR session ID to delete

Returns: Confirmation of session deletion.

{
  "type": "object",
  "required": [
    "session_id"
  ],
  "properties": {
    "session_id": {
      "type": "string",
      "description": "RTR session ID to delete"
    }
  }
}

crowdstrike_query_vulnerabilities

Query vulnerabilities from CrowdStrike Spotlight with filtering.

Note: The filter parameter is REQUIRED for this endpoint.

Args:

filter: FQL filter expression (REQUIRED). Examples:
- "cve.severity:'CRITICAL'"
- "status:'open'"
- "cve.exploit_status:>=1" (has known exploits)
- "host_info.hostname:'server*'"
limit: Number of results (1-400, default: 100)
after: Pagination cursor for next page
sort: Sort field (e.g., "cve.base_score.desc")

Returns: Array of vulnerability IDs matching the query.

{
  "type": "object",
  "required": [
    "filter"
  ],
  "properties": {
    "sort": {
      "type": "string",
      "description": "Sort field and direction"
    },
    "after": {
      "type": "string",
      "description": "Pagination cursor"
    },
    "limit": {
      "type": "integer",
      "default": 100,
      "maximum": 400,
      "minimum": 1,
      "description": "Number of results"
    },
    "filter": {
      "type": "string",
      "description": "FQL filter expression (required)"
    }
  }
}

crowdstrike_get_vulnerabilities

Get detailed information for specific vulnerabilities by their IDs.

Args:

ids: Array of vulnerability IDs to retrieve (max 400)

Returns: Detailed vulnerability information including CVE details, affected hosts, remediation info, and CVSS scores.

{
  "type": "object",
  "required": [
    "ids"
  ],
  "properties": {
    "ids": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Vulnerability IDs to retrieve"
    }
  }
}