CrowdStrike Falcon MCP server (falcon-mcp)

• Finds detections (alerts) by severity, host, time or status

  Finds detections (alerts) by severity, host, time or status. Part of the Detections module. It only reads data and cannot change anything.

  Try: “Show me new critical detections from the last 24 hours.”

  Read · falcon_search_detections

• Opens full details for detections you already have

  Opens full details for detections you already have. Part of the Detections module. It only reads data and cannot change anything.

  Try: “Give me the full details for those three detections.”

  Read · falcon_get_detection_details

• Counts and summarizes detections without listing each one

  Counts and summarizes detections without listing each one. Part of the Detections module. It only reads data and cannot change anything.

  Try: “How many detections did we get per severity this week?”

  Read · falcon_aggregate_detections

• Changes a detection's status, assignee, comments or tags

  Changes a detection's status, assignee, comments or tags. Part of the Detections module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Assign this detection to me and mark it in progress.”

  Write · falcon_update_detections

• Finds hosts by name, platform, IP, sensor version or containment status

  Finds hosts by name, platform, IP, sensor version or containment status. Part of the Hosts module. It only reads data and cannot change anything.

  Try: “Which Windows hosts are still on an old sensor version?”

  Read · falcon_search_hosts

• Shows full details for specific hosts

  Shows full details for specific hosts. Part of the Hosts module. It only reads data and cannot change anything.

  Try: “Show me everything about host FIN-LAPTOP-22.”

  Read · falcon_get_host_details

• Adds or removes grouping tags on hosts

  Adds or removes grouping tags on hosts. Part of the Hosts module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Tag these ten hosts as finance.”

  Write · falcon_manage_host_grouping_tags

• Researches threat actors and adversary groups

  Researches threat actors and adversary groups. Part of the Intel module. It only reads data and cannot change anything.

  Try: “What do we know about FANCY BEAR?”

  Network · falcon_search_actors

• Looks up threat indicators such as hashes, domains and IPs in CrowdStrike intel

  Looks up threat indicators such as hashes, domains and IPs in CrowdStrike intel. Part of the Intel module. It only reads data and cannot change anything.

  Try: “Is this domain a known bad indicator?”

  Network · falcon_search_indicators

• Searches CrowdStrike intelligence reports

  Searches CrowdStrike intelligence reports. Part of the Intel module. It only reads data and cannot change anything.

  Try: “Find recent intel reports about ransomware against healthcare.”

  Network · falcon_search_reports

• Builds a MITRE ATT&CK report for a threat actor

  Builds a MITRE ATT&CK report for a threat actor. Part of the Intel module. It only reads data and cannot change anything.

  Try: “Give me the MITRE ATT&CK techniques used by SCATTERED SPIDER.”

  Network · falcon_get_mitre_report

• Runs a search query against your Next-Gen SIEM logs

  Runs a search query against your Next-Gen SIEM logs. Part of the NGSIEM module. It only reads data and cannot change anything.

  Try: “Search for PowerShell started by Office apps in the last 7 days.”

  Read · falcon_search_ngsiem

• Finds vulnerabilities on your hosts

  Finds vulnerabilities on your hosts. Part of the Spotlight module. It only reads data and cannot change anything.

  Try: “Which hosts have critical vulnerabilities with known exploits?”

  Read · falcon_search_vulnerabilities

• Investigates a user, account, IP or domain in Identity Protection

  Investigates a user, account, IP or domain in Identity Protection. Part of the Identity Protection module. It only reads data and cannot change anything.

  Try: “Investigate the account jsmith for risky sign-ins.”

  Read · falcon_idp_investigate_entity

• Finds cases and shows their full details

  Finds cases and shows their full details. Part of the Case Management module. It only reads data and cannot change anything.

  Try: “Show me open cases assigned to my team.”

  Read · falcon_search_cases

• Opens cases you already have the IDs for

  Opens cases you already have the IDs for. Part of the Case Management module. It only reads data and cannot change anything.

  Try: “Open those two cases.”

  Read · falcon_get_cases

• Lists the templates available for new cases

  Lists the templates available for new cases. Part of the Case Management module. It only reads data and cannot change anything.

  Try: “What case templates do we have?”

  Read · falcon_list_case_templates

• Opens a new case

  Opens a new case. Part of the Case Management module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Open a case for the phishing detections on host HR-02.”

  Write · falcon_create_case

• Changes a case's fields, such as status or assignee

  Changes a case's fields, such as status or assignee. Part of the Case Management module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Close this case as resolved.”

  Write · falcon_update_case

• Attaches detections to a case as evidence

  Attaches detections to a case as evidence. Part of the Case Management module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Add these detections to the phishing case.”

  Write · falcon_add_case_alert_evidence

• Attaches log events to a case as evidence

  Attaches log events to a case as evidence. Part of the Case Management module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Attach the SIEM events from that search to the case.”

  Write · falcon_add_case_event_evidence

• Adds or removes tags on a case

  Adds or removes tags on a case. Part of the Case Management module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Tag the case as phishing.”

  Write · falcon_manage_case_tags

• Counts case SLA definitions by a field

  Counts case SLA definitions by a field. Part of the Case Management module. It only reads data and cannot change anything.

  Try: “How many SLA definitions do we have per priority?”

  Read · falcon_aggregate_case_slas

• Counts case templates by a field

  Counts case templates by a field. Part of the Case Management module. It only reads data and cannot change anything.

  Try: “How many case templates are there per type?”

  Read · falcon_aggregate_case_templates

• Counts case access tags by a field

  Counts case access tags by a field. Part of the Case Management module. It only reads data and cannot change anything.

  Try: “Summarize our case access tags.”

  Read · falcon_aggregate_case_access_tags

• Counts case notification groups by a field

  Counts case notification groups by a field. Part of the Case Management module. It only reads data and cannot change anything.

  Try: “How many notification groups do we have?”

  Read · falcon_aggregate_case_notification_groups

• Summarizes the files attached to cases

  Summarizes the files attached to cases. Part of the Case Management module. It only reads data and cannot change anything.

  Try: “What kinds of files are attached to our cases?”

  Read · falcon_aggregate_case_file_details

• Searches your cloud asset inventory

  Searches your cloud asset inventory. Part of the Cloud Security module. It only reads data and cannot change anything.

  Try: “List our public S3 buckets.”

  Read · falcon_search_cspm_assets

• Searches your Kubernetes containers

  Searches your Kubernetes containers. Part of the Cloud Security module. It only reads data and cannot change anything.

  Try: “Which containers are running as root?”

  Read · falcon_search_kubernetes_containers

• Counts Kubernetes containers that match a filter

  Counts Kubernetes containers that match a filter. Part of the Cloud Security module. It only reads data and cannot change anything.

  Try: “How many containers run in the prod cluster?”

  Read · falcon_count_kubernetes_containers

• Finds vulnerabilities in container images

  Finds vulnerabilities in container images. Part of the Cloud Security module. It only reads data and cannot change anything.

  Try: “Which container images have critical vulnerabilities?”

  Read · falcon_search_images_vulnerabilities

• Searches cloud security insights

  Searches cloud security insights. Part of the Cloud Security module. It only reads data and cannot change anything.

  Try: “Show cloud insights about exposed storage.”

  Read · falcon_search_cloud_insights

• Shows all insights for specific cloud assets

  Shows all insights for specific cloud assets. Part of the Cloud Security module. It only reads data and cannot change anything.

  Try: “What insights do we have for this EC2 instance?”

  Read · falcon_get_cloud_asset_insights

• Finds cloud misconfiguration findings

  Finds cloud misconfiguration findings. Part of the Cloud Security module. It only reads data and cannot change anything.

  Try: “List high-severity cloud misconfigurations in AWS.”

  Read · falcon_search_iom_findings

• Lists rules that hide cloud misconfiguration findings

  Lists rules that hide cloud misconfiguration findings. Part of the Cloud Security module. It only reads data and cannot change anything.

  Try: “Which suppression rules are hiding findings?”

  Read · falcon_search_cspm_suppression_rules

• Searches cloud risks in your environment

  Searches cloud risks in your environment. Part of the Cloud Security module. It only reads data and cannot change anything.

  Try: “What are our top cloud risks right now?”

  Read · falcon_search_cloud_risks

• Lists your cloud groups

  Lists your cloud groups. Part of the Cloud Security module. It only reads data and cannot change anything.

  Try: “What cloud groups do we have?”

  Read · falcon_search_cloud_groups

• Shows details for specific cloud groups

  Shows details for specific cloud groups. Part of the Cloud Security module. It only reads data and cannot change anything.

  Try: “Show the details of the prod cloud group.”

  Read · falcon_get_cloud_groups

• Finds vulnerabilities in serverless functions

  Finds vulnerabilities in serverless functions. Part of the Serverless module. It only reads data and cannot change anything.

  Try: “Do any of our Lambda functions have known vulnerabilities?”

  Read · falcon_search_serverless_vulnerabilities

• Lists applications installed across your hosts

  Lists applications installed across your hosts. Part of the Discover module. It only reads data and cannot change anything.

  Try: “Which hosts still run an old version of Chrome?”

  Read · falcon_search_applications

• Finds devices on your network without the Falcon sensor

  Finds devices on your network without the Falcon sensor. Part of the Discover module. It only reads data and cannot change anything.

  Try: “Which devices on our network have no Falcon sensor?”

  Read · falcon_search_unmanaged_assets

• Checks host posture such as disk encryption and Secure Boot

  Checks host posture such as disk encryption and Secure Boot. Part of the Discover module. It only reads data and cannot change anything.

  Try: “Which laptops do not have disk encryption turned on?”

  Read · falcon_search_managed_assets

• Searches Zero Trust Assessment scores for hosts

  Searches Zero Trust Assessment scores for hosts. Part of the Zero Trust Assessment module. It only reads data and cannot change anything.

  Try: “Which hosts have the lowest Zero Trust scores?”

  Read · falcon_search_zta_assessments

• Shows Zero Trust Assessment details for specific hosts

  Shows Zero Trust Assessment details for specific hosts. Part of the Zero Trust Assessment module. It only reads data and cannot change anything.

  Try: “Show the Zero Trust details for host FIN-LAPTOP-22.”

  Read · falcon_get_zta_assessments

• Shows your tenant-wide Zero Trust Assessment summary

  Shows your tenant-wide Zero Trust Assessment summary. Part of the Zero Trust Assessment module. It only reads data and cannot change anything.

  Try: “Give me our overall Zero Trust score.”

  Read · falcon_get_zta_audit

• Shows weekly Falcon sensor usage

  Shows weekly Falcon sensor usage. Part of the Sensor Usage module. It only reads data and cannot change anything.

  Try: “How has our sensor count changed over the last month?”

  Read · falcon_search_sensor_usage

• Lists quarantined files

  Lists quarantined files. Part of the Quarantine module. It only reads data and cannot change anything.

  Try: “What files were quarantined this week?”

  Read · falcon_search_quarantined_files

• Shows how many quarantined files an action would affect

  Shows how many quarantined files an action would affect. Part of the Quarantine module. It only reads data and cannot change anything.

  Try: “How many files would be released if I release all from host X?”

  Read · falcon_preview_quarantine_actions

• Releases or re-quarantines quarantined files

  Releases or re-quarantines quarantined files. Part of the Quarantine module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Release the false-positive file from quarantine on host X.”

  Write · falcon_update_quarantined_files

• Deletes quarantined files

  Deletes quarantined files. Part of the Quarantine module. It deletes data from your Falcon tenant, so it is removed in read-only mode.

  Try: “Delete the quarantined malware samples older than 30 days.”

  Delete · falcon_delete_quarantined_files

• Searches Recon alerts for leaked data, dark web mentions and typosquats

  Searches Recon alerts for leaked data, dark web mentions and typosquats. Part of the Recon module. It only reads data and cannot change anything.

  Try: “Any new leaked-credential alerts for our domain?”

  Read · falcon_search_recon_notifications

• Lists your Recon monitoring rules

  Lists your Recon monitoring rules. Part of the Recon module. It only reads data and cannot change anything.

  Try: “What Recon monitoring rules do we have?”

  Read · falcon_search_recon_rules

• Searches exposed-data records found by Recon

  Searches exposed-data records found by Recon. Part of the Recon module. It only reads data and cannot change anything.

  Try: “Show exposed employee credentials found this month.”

  Read · falcon_search_recon_exposed_data_records

• Counts and groups Recon alerts

  Counts and groups Recon alerts. Part of the Recon module. It only reads data and cannot change anything.

  Try: “How many Recon alerts per type this quarter?”

  Read · falcon_aggregate_recon_notifications

• Counts and groups exposed-data records

  Counts and groups exposed-data records. Part of the Recon module. It only reads data and cannot change anything.

  Try: “How many exposed records per source?”

  Read · falcon_aggregate_recon_exposed_data_records

• Estimates how many alerts a new Recon rule would create

  Estimates how many alerts a new Recon rule would create. Part of the Recon module. It only reads data and cannot change anything.

  Try: “How noisy would a rule for our brand name be?”

  Read · falcon_preview_recon_rule

• Lists Real Time Response sessions

  Lists Real Time Response sessions. Part of the Real Time Response module. It only reads data and cannot change anything.

  Try: “Show recent Live Response sessions on host X.”

  Read · falcon_search_rtr_sessions

• Searches the Real Time Response audit log

  Searches the Real Time Response audit log. Part of the Real Time Response module. It only reads data and cannot change anything.

  Try: “Who ran Live Response commands on host X last week?”

  Read · falcon_search_rtr_audit_sessions

• Summarizes Real Time Response session activity

  Summarizes Real Time Response session activity. Part of the Real Time Response module. It only reads data and cannot change anything.

  Try: “How many Live Response sessions did each analyst open?”

  Read · falcon_aggregate_rtr_sessions

• Shows details for Real Time Response sessions

  Shows details for Real Time Response sessions. Part of the Real Time Response module. It only reads data and cannot change anything.

  Try: “Show details for that Live Response session.”

  Read · falcon_get_rtr_session_details

• Lists files collected during a Real Time Response session

  Lists files collected during a Real Time Response session. Part of the Real Time Response module. It only reads data and cannot change anything.

  Try: “What files were pulled from host X in that session?”

  Read · falcon_list_rtr_session_files

• Runs a read-only triage command on a host and waits for the result

  Runs a read-only triage command on a host and waits for the result. It runs only read-only triage commands, but it does run them on the host, so it is removed in read-only mode. Part of the Real Time Response module.

  Try: “List running processes on host X.”

  Runs code · falcon_run_rtr_read_only_command_and_wait

• Starts a read-only triage command on a host

  Starts a read-only triage command on a host. It runs only read-only triage commands, but it does run them on the host, so it is removed in read-only mode. Part of the Real Time Response module.

  Try: “Get the network connections on host X.”

  Runs code · falcon_execute_rtr_read_only_command

• Closes a Real Time Response session

  Closes a Real Time Response session. Part of the Real Time Response module. It deletes data from your Falcon tenant, so it is removed in read-only mode.

  Try: “Close the Live Response session on host X.”

  Delete · falcon_delete_rtr_session

• Searches prevention, sensor update, firewall and other policies

  Searches prevention, sensor update, firewall and other policies. Part of the Policies module. It only reads data and cannot change anything.

  Try: “Show our Windows prevention policies.”

  Read · falcon_search_policies

• Lists the hosts a policy applies to

  Lists the hosts a policy applies to. Part of the Policies module. It only reads data and cannot change anything.

  Try: “Which hosts use the strict prevention policy?”

  Read · falcon_search_policy_members

• Creates a new host policy

  Creates a new host policy. Part of the Policies module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Create a sensor update policy for the pilot group.”

  Write · falcon_create_policy

• Changes an existing host policy

  Changes an existing host policy. Part of the Policies module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Turn on script-based execution monitoring in the Windows policy.”

  Write · falcon_update_policy

• Enables, disables or assigns policies to host groups

  Enables, disables or assigns policies to host groups. Part of the Policies module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Assign the strict policy to the finance host group.”

  Write · falcon_perform_policy_action

• Changes the order in which policies apply

  Changes the order in which policies apply. Part of the Policies module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Make the strict policy apply before the default one.”

  Write · falcon_set_policy_precedence

• Deletes host policies

  Deletes host policies. Part of the Policies module. It deletes data from your Falcon tenant, so it is removed in read-only mode.

  Try: “Delete the old test policy.”

  Delete · falcon_delete_policies

• Searches detection and visibility exclusions

  Searches detection and visibility exclusions. Part of the Exclusions module. It only reads data and cannot change anything.

  Try: “Which exclusions cover the backup software?”

  Read · falcon_search_exclusions

• Shows a file's code-signing certificate

  Shows a file's code-signing certificate. Part of the Exclusions module. It only reads data and cannot change anything.

  Try: “Who signed the file with this SHA256?”

  Read · falcon_get_certificate_details

• Creates an exclusion so certain activity is not flagged

  Creates an exclusion so certain activity is not flagged. Part of the Exclusions module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Exclude our backup agent's folder from machine learning detections.”

  Write · falcon_create_exclusion

• Changes an existing exclusion

  Changes an existing exclusion. Part of the Exclusions module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Narrow that exclusion to the finance host group.”

  Write · falcon_update_exclusion

• Deletes exclusions

  Deletes exclusions. Part of the Exclusions module. It deletes data from your Falcon tenant, so it is removed in read-only mode.

  Try: “Remove the temporary exclusion we added last week.”

  Delete · falcon_delete_exclusions

• Searches your custom indicators of compromise

  Searches your custom indicators of compromise. Part of the IOC module. It only reads data and cannot change anything.

  Try: “Which custom IOCs block hashes from last month's incident?”

  Read · falcon_search_iocs

• Adds custom indicators, such as hashes or domains to block

  Adds custom indicators, such as hashes or domains to block. Part of the IOC module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Block this hash on all hosts.”

  Write · falcon_add_ioc

• Removes custom indicators

  Removes custom indicators. Part of the IOC module. It deletes data from your Falcon tenant, so it is removed in read-only mode.

  Try: “Remove the IOCs we added for the test.”

  Delete · falcon_remove_iocs

• Searches firewall rules

  Searches firewall rules. Part of the Firewall Management module. It only reads data and cannot change anything.

  Try: “Which firewall rules block outbound SMB?”

  Read · falcon_search_firewall_rules

• Searches firewall rule groups

  Searches firewall rule groups. Part of the Firewall Management module. It only reads data and cannot change anything.

  Try: “List our firewall rule groups.”

  Read · falcon_search_firewall_rule_groups

• Lists the firewall rules in a specific policy

  Lists the firewall rules in a specific policy. Part of the Firewall Management module. It only reads data and cannot change anything.

  Try: “What rules are in the workstation firewall policy?”

  Read · falcon_search_firewall_policy_rules

• Creates a firewall rule group

  Creates a firewall rule group. Part of the Firewall Management module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Create a rule group for the lab hosts.”

  Write · falcon_create_firewall_rule_group

• Deletes firewall rule groups

  Deletes firewall rule groups. Part of the Firewall Management module. It deletes data from your Falcon tenant, so it is removed in read-only mode.

  Try: “Delete the unused test rule group.”

  Delete · falcon_delete_firewall_rule_groups

• Searches host groups

  Searches host groups. Part of the Host Groups module. It only reads data and cannot change anything.

  Try: “What host groups do we have?”

  Read · falcon_search_host_groups

• Lists the hosts in a host group

  Lists the hosts in a host group. Part of the Host Groups module. It only reads data and cannot change anything.

  Try: “Which hosts are in the finance group?”

  Read · falcon_search_host_group_members

• Creates a host group

  Creates a host group. Part of the Host Groups module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Create a host group for the pilot laptops.”

  Write · falcon_create_host_group

• Changes a host group

  Changes a host group. Part of the Host Groups module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Rename the pilot group to Wave 1.”

  Write · falcon_update_host_group

• Adds or removes hosts from host groups

  Adds or removes hosts from host groups. Part of the Host Groups module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Add these five hosts to the pilot group.”

  Write · falcon_perform_host_group_action

• Deletes host groups

  Deletes host groups. Part of the Host Groups module. It deletes data from your Falcon tenant, so it is removed in read-only mode.

  Try: “Delete the old pilot group.”

  Delete · falcon_delete_host_groups

• Searches custom behavior detection rule groups and their rules

  Searches custom behavior detection rule groups and their rules. Part of the Custom IOA module. It only reads data and cannot change anything.

  Try: “Show our custom IOA rule groups.”

  Read · falcon_search_ioa_rule_groups

• Creates a custom behavior detection rule group

  Creates a custom behavior detection rule group. Part of the Custom IOA module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Create a rule group for living-off-the-land detections.”

  Write · falcon_create_ioa_rule_group

• Changes a custom behavior detection rule group

  Changes a custom behavior detection rule group. Part of the Custom IOA module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Enable the LOLBin rule group.”

  Write · falcon_update_ioa_rule_group

• Creates a custom behavior detection rule

  Creates a custom behavior detection rule. Part of the Custom IOA module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Add a rule that flags certutil downloading files.”

  Write · falcon_create_ioa_rule

• Changes a custom behavior detection rule

  Changes a custom behavior detection rule. Part of the Custom IOA module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Change that rule to block instead of detect.”

  Write · falcon_update_ioa_rule

• Deletes custom behavior detection rules

  Deletes custom behavior detection rules. Part of the Custom IOA module. It deletes data from your Falcon tenant, so it is removed in read-only mode.

  Try: “Delete the noisy certutil rule.”

  Delete · falcon_delete_ioa_rules

• Deletes custom behavior detection rule groups

  Deletes custom behavior detection rule groups. Part of the Custom IOA module. It deletes data from your Falcon tenant, so it is removed in read-only mode.

  Try: “Delete the old test rule group.”

  Delete · falcon_delete_ioa_rule_groups

• Searches Next-Gen SIEM correlation rules

  Searches Next-Gen SIEM correlation rules. Part of the Correlation Rules module. It only reads data and cannot change anything.

  Try: “List our correlation rules for impossible travel.”

  Read · falcon_search_correlation_rules

• Creates a Next-Gen SIEM correlation rule

  Creates a Next-Gen SIEM correlation rule. Part of the Correlation Rules module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Create a rule that alerts on five failed logins then a success.”

  Write · falcon_create_correlation_rule

• Changes a correlation rule

  Changes a correlation rule. Part of the Correlation Rules module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Raise the threshold on the failed-login rule.”

  Write · falcon_update_correlation_rule

• Permanently deletes correlation rules

  Permanently deletes correlation rules. Part of the Correlation Rules module. It deletes data from your Falcon tenant, so it is removed in read-only mode.

  Try: “Delete the duplicate correlation rule.”

  Delete · falcon_delete_correlation_rules

• Searches data security (DLP) settings such as policies and classifications

  Searches data security (DLP) settings such as policies and classifications. Part of the Data Security module. It only reads data and cannot change anything.

  Try: “Show our data loss prevention policies.”

  Read · falcon_search_data_security_entities

• Shows full details of data security settings

  Shows full details of data security settings. Part of the Data Security module. It only reads data and cannot change anything.

  Try: “Show the details of the PII classification.”

  Read · falcon_get_data_security_entities

• Creates a data security setting such as a policy or content pattern

  Creates a data security setting such as a policy or content pattern. Part of the Data Security module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Create a content pattern for our internal project codes.”

  Write · falcon_create_data_security_entity

• Changes a data security setting

  Changes a data security setting. Part of the Data Security module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Add Google Drive to the blocked web locations.”

  Write · falcon_update_data_security_entity

• Lists your Fusion SOAR workflows

  Lists your Fusion SOAR workflows. Part of the Fusion SOAR module. It only reads data and cannot change anything.

  Try: “What SOAR workflows do we have for phishing?”

  Read · falcon_search_workflow_definitions

• Shows the run history of SOAR workflows

  Shows the run history of SOAR workflows. Part of the Fusion SOAR module. It only reads data and cannot change anything.

  Try: “Did the phishing workflow run successfully today?”

  Read · falcon_search_workflow_executions

• Reads what a SOAR workflow run produced

  Reads what a SOAR workflow run produced. Part of the Fusion SOAR module. It only reads data and cannot change anything.

  Try: “What did the last enrichment workflow return?”

  Read · falcon_get_workflow_execution_results

• Starts a Fusion SOAR workflow

  Starts a Fusion SOAR workflow. Part of the Fusion SOAR module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Run the host isolation approval workflow for host X.”

  Runs code · falcon_execute_workflow

• Lists scheduled reports and searches

  Lists scheduled reports and searches. Part of the Scheduled Reports module. It only reads data and cannot change anything.

  Try: “What scheduled reports do we have?”

  Read · falcon_search_scheduled_reports

• Shows past runs of scheduled reports

  Shows past runs of scheduled reports. Part of the Scheduled Reports module. It only reads data and cannot change anything.

  Try: “When did the weekly detections report last run?”

  Read · falcon_search_report_executions

• Downloads the results of a finished report

  Downloads the results of a finished report. Part of the Scheduled Reports module. It only reads data and cannot change anything.

  Try: “Download last week's detections report.”

  Network · falcon_download_report_execution

• Runs a scheduled report now

  Runs a scheduled report now. Part of the Scheduled Reports module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Run the weekly detections report now.”

  Runs code · falcon_launch_scheduled_report

• Searches SaaS security posture checks

  Searches SaaS security posture checks. Part of the Shield module. It only reads data and cannot change anything.

  Try: “Which Microsoft 365 posture checks are failing?”

  Read · falcon_search_shield_checks

• Shows which users, apps or devices fail a SaaS posture check

  Shows which users, apps or devices fail a SaaS posture check. Part of the Shield module. It only reads data and cannot change anything.

  Try: “Which users fail the MFA check?”

  Read · falcon_get_shield_check_affected_entities

• Shows a summary of your SaaS security posture

  Shows a summary of your SaaS security posture. Part of the Shield module. It only reads data and cannot change anything.

  Try: “Give me our SaaS security posture summary.”

  Read · falcon_get_shield_posture_metrics

• Shows which compliance frameworks a SaaS check maps to

  Shows which compliance frameworks a SaaS check maps to. Part of the Shield module. It only reads data and cannot change anything.

  Try: “Which frameworks does the MFA check map to?”

  Read · falcon_get_shield_check_compliance

• Searches SaaS security alerts

  Searches SaaS security alerts. Part of the Shield module. It only reads data and cannot change anything.

  Try: “Any new alerts for our Salesforce tenant?”

  Read · falcon_search_shield_alerts

• Shows activity events from your SaaS apps (last 180 days)

  Shows activity events from your SaaS apps (last 180 days). Part of the Shield module. It only reads data and cannot change anything.

  Try: “Show admin activity in Google Workspace this week.”

  Read · falcon_get_shield_activity_monitor

• Lists users found across your connected SaaS apps

  Lists users found across your connected SaaS apps. Part of the Shield module. It only reads data and cannot change anything.

  Try: “Which SaaS users have no MFA?”

  Read · falcon_search_shield_users

• Lists devices registered to users in your SaaS apps

  Lists devices registered to users in your SaaS apps. Part of the Shield module. It only reads data and cannot change anything.

  Try: “Which devices are registered to user jsmith?”

  Read · falcon_search_shield_devices

• Lists third-party apps and tokens with access to your SaaS apps

  Lists third-party apps and tokens with access to your SaaS apps. Part of the Shield module. It only reads data and cannot change anything.

  Try: “Which third-party apps can read our Google Drive?”

  Read · falcon_search_shield_apps

• Shows who authorized a third-party app

  Shows who authorized a third-party app. Part of the Shield module. It only reads data and cannot change anything.

  Try: “Who authorized that unknown Slack app?”

  Read · falcon_get_shield_app_users

• Lists files shared outside your company from SaaS apps

  Lists files shared outside your company from SaaS apps. Part of the Shield module. It only reads data and cannot change anything.

  Try: “Which files are shared publicly from OneDrive?”

  Read · falcon_search_shield_data_shares

• Lists connected SaaS apps and their connection status

  Lists connected SaaS apps and their connection status. Part of the Shield module. It only reads data and cannot change anything.

  Try: “Which SaaS integrations are disconnected?”

  Read · falcon_get_shield_integrations

• Lists Falcon Shield administrators

  Lists Falcon Shield administrators. Part of the Shield module. It only reads data and cannot change anything.

  Try: “Who are our Falcon Shield admins?”

  Read · falcon_get_shield_system_users

• Lists SaaS platforms Falcon Shield can connect to

  Lists SaaS platforms Falcon Shield can connect to. Part of the Shield module. It only reads data and cannot change anything.

  Try: “Does Falcon Shield support Zoom?”

  Read · falcon_get_shield_supported_saas

• Shows Falcon Shield audit logs (last 90 days)

  Shows Falcon Shield audit logs (last 90 days). Part of the Shield module. It only reads data and cannot change anything.

  Try: “Who changed Falcon Shield settings last week?”

  Read · falcon_get_shield_system_logs

• Dismisses a SaaS posture check so it no longer shows as failed

  Dismisses a SaaS posture check so it no longer shows as failed. Part of the Shield module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Dismiss the guest-access check for our sandbox tenant.”

  Write · falcon_dismiss_shield_check

• Lists AI agents seen across your hosts

  Lists AI agents seen across your hosts. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Which AI coding agents run on our laptops?”

  Read · falcon_search_guardian_agents

• Shows the record for one AI agent

  Shows the record for one AI agent. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Show details for the Claude Code agent on host X.”

  Read · falcon_get_guardian_agent

• Lists MCP servers seen across your fleet

  Lists MCP servers seen across your fleet. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Which MCP servers are our developers using?”

  Read · falcon_search_guardian_mcp_servers

• Lists AI agent sessions across your fleet

  Lists AI agent sessions across your fleet. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Show AI agent sessions from today.”

  Read · falcon_get_guardian_agent_sessions

• Shows details of one AI agent session

  Shows details of one AI agent session. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Show the details of that session.”

  Read · falcon_get_guardian_session_detail

• Shows what happened in AI agent sessions

  Shows what happened in AI agent sessions. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “What did that AI session do?”

  Read · falcon_get_guardian_session_activity

• Lists AI tools found in your environment

  Lists AI tools found in your environment. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Which AI tools are installed across the fleet?”

  Read · falcon_search_guardian_tools

• Shows how AI tools were used

  Shows how AI tools were used. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Which AI tools ran shell commands this week?”

  Read · falcon_search_guardian_tool_usage

• Lists AI agent process runs with model and token counts

  Lists AI agent process runs with model and token counts. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Which models did our agents use and how many tokens?”

  Read · falcon_search_guardian_executions

• Searches the prompts used in an AI session

  Searches the prompts used in an AI session. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “What prompts were used in that session?”

  Read · falcon_search_guardian_prompts

• Summarizes AI activity in your environment

  Summarizes AI activity in your environment. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Give me an overview of AI agent use in our company.”

  Read · falcon_get_guardian_inventory

• Lists AI agent skills found on your hosts

  Lists AI agent skills found on your hosts. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Which agent skills are installed?”

  Read · falcon_search_guardian_skills

• Shows each time an AI skill was used

  Shows each time an AI skill was used. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Which skills ran most this week?”

  Read · falcon_search_guardian_skill_usage

• Summarizes skill use across the fleet by name

  Summarizes skill use across the fleet by name. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Which skills are used most across the company?”

  Read · falcon_get_guardian_fleet_skill_inventory

• Lists computer users who have run AI agents

  Lists computer users who have run AI agents. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Which employees run AI agents?”

  Read · falcon_search_guardian_os_users

• Finds agents or activity linked to a known value

  Finds agents or activity linked to a known value. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Find all AI activity that touched this IP address.”

  Read · falcon_pivot_on_guardian_attribute

• Shows the processes an AI session started

  Shows the processes an AI session started. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “What processes did that AI session spawn?”

  Read · falcon_get_guardian_process_tree

• Shows outbound connections from an AI session

  Shows outbound connections from an AI session. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Where did that AI session connect to?”

  Read · falcon_get_guardian_network_events

• Shows file activity from an AI session

  Shows file activity from an AI session. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Which files did that AI session change?”

  Read · falcon_get_guardian_file_events

• Shows sensitive files an AI agent opened

  Shows sensitive files an AI agent opened. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Did any AI agent read classified files?”

  Read · falcon_get_guardian_classified_file_access

• Builds a structured report on AI agent activity

  Builds a structured report on AI agent activity. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Generate a report on AI agent activity this month.”

  Read · falcon_generate_guardian_report

• Lists detections involving AI agent processes

  Lists detections involving AI agent processes. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Any detections involving AI agents this week?”

  Read · falcon_search_guardian_detections

• Shows a threat score for each AI agent

  Shows a threat score for each AI agent. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Which AI agents have the highest threat score?”

  Read · falcon_get_guardian_detection_scores

• Lists AI agent installations

  Lists AI agent installations. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Where is Cursor installed?”

  Read · falcon_search_guardian_installs

• Lists AI model names seen in your environment

  Lists AI model names seen in your environment. Part of the Guardian module. It only reads data and cannot change anything.

  Try: “Which AI models are our agents using?”

  Read · falcon_search_guardian_models

• Lists your Charlotte AI agents

  Lists your Charlotte AI agents. Part of the AgentWorks module. It only reads data and cannot change anything.

  Try: “What Charlotte AI agents do we have?”

  Read · falcon_search_agentworks_agents

• Lists versions of Charlotte AI agents

  Lists versions of Charlotte AI agents. Part of the AgentWorks module. It only reads data and cannot change anything.

  Try: “Show the versions of the triage agent.”

  Read · falcon_search_agentworks_agent_versions

• Searches Charlotte AI agent run traces

  Searches Charlotte AI agent run traces. Part of the AgentWorks module. It only reads data and cannot change anything.

  Try: “Why did the triage agent fail yesterday?”

  Read · falcon_search_agentworks_spans

• Runs a Charlotte AI agent and returns its reply

  Runs a Charlotte AI agent and returns its reply. Part of the AgentWorks module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Ask the triage agent to review detection X.”

  Runs code · falcon_invoke_agentworks_agent

• Creates a rule that hides matching cloud misconfiguration findings

  Creates a rule that hides matching cloud misconfiguration findings. Part of the Cloud Security module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Suppress the S3 logging finding for the sandbox account.”

  Write · falcon_create_cspm_suppression_rule

• Deletes cloud finding suppression rules

  Deletes cloud finding suppression rules. Part of the Cloud Security module. It deletes data from your Falcon tenant, so it is removed in read-only mode.

  Try: “Delete the old sandbox suppression rule.”

  Delete · falcon_delete_cspm_suppression_rules

• Used by the assistant behind the scenes

  Checks on a Charlotte AI agent run

  Checks on a Charlotte AI agent run. Part of the AgentWorks module. It only reads data and cannot change anything.

  Try: “Is the triage agent run finished?”

  Read · falcon_get_agentworks_agent_invocation

• Lists the platforms custom behavior rules can target

  Lists the platforms custom behavior rules can target. Part of the Custom IOA module. It only reads data and cannot change anything.

  Try: “Which platforms can custom IOA rules target?”

  Read · falcon_get_ioa_platforms

• Lists the kinds of custom behavior rules available

  Lists the kinds of custom behavior rules available. Part of the Custom IOA module. It only reads data and cannot change anything.

  Try: “What types of custom IOA rules can I create?”

  Read · falcon_get_ioa_rule_types

• Lists every kind of cloud insight available

  Lists every kind of cloud insight available. Part of the Cloud Security module. It only reads data and cannot change anything.

  Try: “What cloud insight types exist?”

  Read · falcon_list_cloud_insight_definitions

• Opens a Real Time Response session on a host

  Opens a Real Time Response session on a host. Part of the Real Time Response module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Open a Live Response session on host X.”

  Write · falcon_init_rtr_session

• Keeps a Real Time Response session from timing out

  Keeps a Real Time Response session from timing out. Part of the Real Time Response module. It changes your Falcon tenant, so it is removed in read-only mode.

  Try: “Keep the session on host X open.”

  Write · falcon_pulse_rtr_session

• Checks the status and output of a running triage command

  Checks the status and output of a running triage command. Part of the Real Time Response module. It only reads data and cannot change anything.

  Try: “Is that command done yet?”

  Read · falcon_check_rtr_command_status

• Lists every Falcon tool this server offers

  Lists every Falcon tool this server offers. It is always available, even in read-only mode.

  Try: “What Falcon tools do you have?”

  Read · falcon_list_enabled_tools

• Checks that the server can reach your Falcon tenant

  Checks that the server can reach your Falcon tenant. It only reads data.

  Try: “Can you connect to Falcon?”

  Read · falcon_check_connectivity

• Lists the Falcon modules turned on

  Lists the Falcon modules turned on. It only reads data.

  Try: “Which Falcon modules are enabled?”

  Read · falcon_list_enabled_modules

• Finds the right Falcon tool by keyword in dynamic mode

  Finds the right Falcon tool by keyword in dynamic mode. Only offered in dynamic mode.

  Try: “Find a tool for searching detections.”

  Read · falcon_search_tools

• Runs a Falcon tool chosen in dynamic mode

  Runs a Falcon tool chosen in dynamic mode. Only offered in dynamic mode.

  Try: “Run that detection search.”

  Runs code · falcon_execute_tool

Watch out for

• It can change or delete your Falcon defences

  With all modules on, it can delete policies, exclusions, IOCs, firewall groups and quarantined files. Run it read-only unless you need changes. github.com

• HTTP mode has no password by default

  Anyone who can reach the port can use your CrowdStrike keys. Keep it on localhost or set an API key when you open it to the network. github.com

• Everyone shares one API key

  Actions run as the API client, not as each analyst. Give the key only the scopes your modules need. github.com

• Tool names can change before 1.0

  Pin a version and read the changelog before upgrading. github.com

• Docker image waits on a certificate update

  An open issue asks CrowdStrike to drop revoked eMudhra certificates from the image; CrowdStrike says the fix ships in the next release. github.com

Security advisories

In their words