CrowdStrike Falcon

Source: https://runstack.engineer/docs/toolkits/crowdstrike

Falcon hosts, alerts, incidents, containment, and online state via the CrowdStrike API.

Tools (12):

Tool	Description
`crowdstrikeQueryDevices`	Search host IDs using FQL filter (GET /devices/queries/devices/v1). Returns resource IDs to pass to GetDeviceDetails.
`crowdstrikeGetDevices`	Get host details for one or more device IDs (POST /devices/entities/devices/v2).
`crowdstrikeCombinedDevices`	Search hosts with combined device details in one call (GET /devices/combined/devices/v1).
`crowdstrikeGetDeviceOnlineState`	Get online state for device IDs (POST /devices/entities/online-state/v1).
`crowdstrikeContainDevices`	Network-contain hosts by device ID (POST /devices/entities/devices-actions/v2?action_name=contain). Requires Hosts: WRITE.
`crowdstrikeLiftContainment`	Lift network containment for hosts (POST .../devices-actions/v2?action_name=lift_containment).
`crowdstrikeQueryIncidents`	Query incident IDs (GET /incidents/queries/incidents/v1) with optional FQL filter.
`crowdstrikeGetIncidents`	Get incident details by IDs (POST /incidents/entities/incidents/GET/v1).
`crowdstrikePerformIncidentAction`	Perform an incident action such as close or update (POST /incidents/entities/incident-actions/v1).
`crowdstrikeQueryAlerts`	Query alert composite IDs (GET /alerts/queries/alerts/v2) with FQL filter.
`crowdstrikeGetAlerts`	Get alert details (POST /alerts/entities/alerts/v2) by composite IDs.
`crowdstrikeUpdateAlerts`	Update alert status or assignment (PATCH /alerts/entities/alerts/v3) for composite IDs.