CrowdStrike Falcon

169 tools found.

• Add case alert evidence

  Tool name: falcon_add_case_alert_evidence

  Attach alert evidence to an existing case.

• Add case event evidence

  Tool name: falcon_add_case_event_evidence

  Attach LogScale event evidence to an existing case.

• Add IOC

  Tool name: falcon_add_ioc

  Create one or more custom IOCs.

• Aggregate case access tags

  Tool name: falcon_aggregate_case_access_tags

  Count case access tags grouped by a field.

• Aggregate case file details

  Tool name: falcon_aggregate_case_file_details

  Report the files attached to cases, grouped and counted by a field.

• Aggregate case notification groups

  Tool name: falcon_aggregate_case_notification_groups

  Count case notification groups grouped by a field.

• Aggregate case slas

  Tool name: falcon_aggregate_case_slas

  Count case SLA definitions grouped by a field.

• Aggregate case templates

  Tool name: falcon_aggregate_case_templates

  Count case templates grouped by a field.

• Aggregate detections

  Tool name: falcon_aggregate_detections

  Count and summarize detections (also called alerts) without retrieving each record.

• Aggregate recon exposed data records

  Tool name: falcon_aggregate_recon_exposed_data_records

  Count and group Falcon Intelligence Recon exposed-data records into summary buckets.

• Aggregate recon notifications

  Tool name: falcon_aggregate_recon_notifications

  Count and group Falcon Intelligence Recon notifications into summary buckets.

• Aggregate rtr sessions

  Tool name: falcon_aggregate_rtr_sessions

  Summarize RTR session activity with Falcon aggregation buckets.

• Check connectivity

  Tool name: falcon_check_connectivity

  Check connectivity to the Falcon API.

• Check rtr command status

  Tool name: falcon_check_rtr_command_status

  Get the status and output for an RTR command execution.

• Count kubernetes containers

  Tool name: falcon_count_kubernetes_containers

  Count Kubernetes containers matching filter criteria.

• Create case

  Tool name: falcon_create_case

  Create a new case in CrowdStrike.

• Create correlation rule

  Tool name: falcon_create_correlation_rule

  Create a new NG-SIEM Correlation Rule.

• Create cspm suppression rule

  Tool name: falcon_create_cspm_suppression_rule

  Create a CSPM IOM suppression rule to hide matching findings.

• Create exclusion

  Tool name: falcon_create_exclusion

  Create an exclusion of the given type.

• Create firewall rule group

  Tool name: falcon_create_firewall_rule_group

  Create a firewall rule group.

• Create host group

  Tool name: falcon_create_host_group

  Create a host group.

• Create ioa rule

  Tool name: falcon_create_ioa_rule

  Create a new Custom IOA behavioral detection rule within a rule group.

• Create ioa rule group

  Tool name: falcon_create_ioa_rule_group

  Create a new Custom IOA rule group.

• Create policy

  Tool name: falcon_create_policy

  Create a host-based policy of the given type.

• Delete correlation rules

  Tool name: falcon_delete_correlation_rules

  Permanently delete NG-SIEM Correlation Rules by rule ID.

• Delete cspm suppression rules

  Tool name: falcon_delete_cspm_suppression_rules

  Delete CSPM IOM suppression rules by ID.

• Delete exclusions

  Tool name: falcon_delete_exclusions

  Delete one or more exclusions of the given type.

• Delete firewall rule groups

  Tool name: falcon_delete_firewall_rule_groups

  Delete firewall rule groups by ID.

• Delete host groups

  Tool name: falcon_delete_host_groups

  Delete one or more host groups.

• Delete ioa rule groups

  Tool name: falcon_delete_ioa_rule_groups

  Delete Custom IOA rule groups by ID.

• Delete ioa rules

  Tool name: falcon_delete_ioa_rules

  Delete Custom IOA behavioral detection rules from a rule group.

• Delete policies

  Tool name: falcon_delete_policies

  Delete one or more host-based policies of the given type.

• Delete quarantined files

  Tool name: falcon_delete_quarantined_files

  Delete quarantine records selected by IDs or filter.

• Delete rtr session

  Tool name: falcon_delete_rtr_session

  Close an RTR session and release the host connection.

• Dismiss shield check

  Tool name: falcon_dismiss_shield_check

  Dismiss a Falcon Shield (SaaS Security) posture check to suppress it from the failed checks list.

• Download report execution

  Tool name: falcon_download_report_execution

  Download the results of a completed report execution.

• Execute rtr read only command

  Tool name: falcon_execute_rtr_read_only_command

  Execute a read-only RTR command on a single host.

• Execute workflow

  Tool name: falcon_execute_workflow

  Start a Fusion SOAR workflow by definition ID.

• Generate guardian report

  Tool name: falcon_generate_guardian_report

  Generate a structured Guardian report.

• Get agentworks agent invocation

  Tool name: falcon_get_agentworks_agent_invocation

  Get the current state of an AgentWorks agent invocation by ID.

• Get cases

  Tool name: falcon_get_cases

  Retrieve details for case IDs you already have.

• Get certificate details

  Tool name: falcon_get_certificate_details

  Retrieve the code-signing certificate metadata for a file by SHA256.

• Get cloud asset insights

  Tool name: falcon_get_cloud_asset_insights

  Retrieve the full insight detail for one or more cloud ASSET IDs.

• Get cloud groups

  Tool name: falcon_get_cloud_groups

  Get detailed information for cloud groups by ID.

• Get detection details

  Tool name: falcon_get_detection_details

  Retrieve details for detection IDs you already have.

• Get guardian agent

  Tool name: falcon_get_guardian_agent

  Get a specific AI agent's record from the AIAgent entity store.

• Get guardian agent sessions

  Tool name: falcon_get_guardian_agent_sessions

  List AI agent sessions across the fleet, filtered by product.

• Get guardian classified file access

  Tool name: falcon_get_guardian_classified_file_access

  Get classified/sensitive file access for an AI agent process.

• Get guardian detection scores

  Tool name: falcon_get_guardian_detection_scores

  Get the Agentic Threat Score for each agent.

• Get guardian file events

  Tool name: falcon_get_guardian_file_events

  Get file activity for processes spawned from an AI session.

• Get guardian fleet skill inventory

  Tool name: falcon_get_guardian_fleet_skill_inventory

  Get a fleet-wide skill usage rollup by name (AISkill aggregate).

• Get guardian inventory

  Tool name: falcon_get_guardian_inventory

  Get a summary overview of AI activity in your environment.

• Get guardian network events

  Tool name: falcon_get_guardian_network_events

  Get outbound network connections from an AI session's processes.

• Get guardian process tree

  Tool name: falcon_get_guardian_process_tree

  Get the spawned process tree for an AI session.

• Get guardian session activity

  Tool name: falcon_get_guardian_session_activity

  Get activity for one or more AI sessions.

• Get guardian session detail

  Tool name: falcon_get_guardian_session_detail

  Get detailed information about a specific AI session.

• Get host details

  Tool name: falcon_get_host_details

  Retrieve detailed information for one or more host device IDs.

• Get ioa platforms

  Tool name: falcon_get_ioa_platforms

  Get all available platforms for Custom IOA rule groups.

• Get ioa rule types

  Tool name: falcon_get_ioa_rule_types

  Get all available Custom IOA rule types.

• Get mitre report

  Tool name: falcon_get_mitre_report

  Generate a MITRE ATT&CK report for a given threat actor.

• Get rtr session details

  Tool name: falcon_get_rtr_session_details

  Retrieve detailed metadata for one or more RTR sessions.

• Get shield activity monitor

  Tool name: falcon_get_shield_activity_monitor

  Get events from the Falcon Shield (SaaS Security) activity monitor; data is retained for 180 days.

• Get shield app users

  Tool name: falcon_get_shield_app_users

  Retrieve the users who have authorized or are associated with a specific third-party app in Falcon Shield.

• Get shield check affected entities

  Tool name: falcon_get_shield_check_affected_entities

  Retrieve the specific entities (users, apps, or devices) that are violating a given Falcon Shield posture check.

• Get shield check compliance

  Tool name: falcon_get_shield_check_compliance

  Retrieve the compliance framework mappings for a specific Falcon Shield posture check.

• Get shield integrations

  Tool name: falcon_get_shield_integrations

  List all SaaS integrations connected to Falcon Shield and their current connection status.

• Get shield posture metrics

  Tool name: falcon_get_shield_posture_metrics

  Get aggregated Falcon Shield (SaaS Security) posture metrics for a dashboard or summary view.

• Get shield supported saas

  Tool name: falcon_get_shield_supported_saas

  List SaaS platforms supported by Falcon Shield for integration.

• Get shield system logs

  Tool name: falcon_get_shield_system_logs

  Retrieve Falcon Shield (SaaS Security) system audit logs; data is retained for 90 days.

• Get shield system users

  Tool name: falcon_get_shield_system_users

  List Falcon Shield (SaaS Security) platform administrators.

• Get workflow execution results

  Tool name: falcon_get_workflow_execution_results

  Read what one or more Fusion SOAR workflow executions produced.

• Get zta assessments

  Tool name: falcon_get_zta_assessments

  Get Zero Trust Assessment details for specific hosts by agent ID (AID).

• Get zta audit

  Tool name: falcon_get_zta_audit

  Get the tenant-wide Zero Trust Assessment summary.

• Idp investigate entity

  Tool name: falcon_idp_investigate_entity

  Investigate one or more Identity Protection entities by ID, name, email, IP, or domain.

• Init rtr session

  Tool name: falcon_init_rtr_session

  Initialize or reuse an RTR session for a single host.

• Invoke agentworks agent

  Tool name: falcon_invoke_agentworks_agent

  Invoke an AgentWorks (Charlotte AI) agent and return its reply.

• Launch scheduled report

  Tool name: falcon_launch_scheduled_report

  Launch a scheduled report or search on demand.

• List case templates

  Tool name: falcon_list_case_templates

  List available case templates.

• List cloud insight definitions

  Tool name: falcon_list_cloud_insight_definitions

  Return all available cloud insight definitions, deduplicated by insight_id.

• List enabled modules

  Tool name: falcon_list_enabled_modules

  Lists enabled modules in the falcon-mcp server.

• List enabled tools

  Tool name: falcon_list_enabled_tools

  Lists the Falcon tools available on this server.

• List rtr session files

  Tool name: falcon_list_rtr_session_files

  List files extracted during an RTR session.

• Manage case tags

  Tool name: falcon_manage_case_tags

  Add or remove tags on a case.

• Manage host grouping tags

  Tool name: falcon_manage_host_grouping_tags

  Add or remove Falcon Grouping Tags on one or more hosts.

• Perform host group action

  Tool name: falcon_perform_host_group_action

  Add or remove hosts from one or more host groups.

• Perform policy action

  Tool name: falcon_perform_policy_action

  Perform an action on one or more policies of the given type.

• Pivot on guardian attribute

  Tool name: falcon_pivot_on_guardian_attribute

  Pivot from a known attribute value to the agents or activity carrying it.

• Preview quarantine actions

  Tool name: falcon_preview_quarantine_actions

  Estimate how many quarantine records each action would affect for a given filter.

• Preview recon rule

  Tool name: falcon_preview_recon_rule

  Estimate how many notifications a prospective Recon monitoring rule would generate.

• Pulse rtr session

  Tool name: falcon_pulse_rtr_session

  Refresh an RTR session timeout for a single host.

• Remove IOCS

  Tool name: falcon_remove_iocs

  Remove custom IOCs by IDs or FQL filter.

• Run rtr read only command and wait

  Tool name: falcon_run_rtr_read_only_command_and_wait

  Execute a read-only RTR command and poll until completion.

• Search actors

  Tool name: falcon_search_actors

  Research threat actors and adversary groups tracked by CrowdStrike intelligence.

• Search agentworks agent versions

  Tool name: falcon_search_agentworks_agent_versions

  Search for versions of AgentWorks agents.

• Search agentworks agents

  Tool name: falcon_search_agentworks_agents

  Search for AgentWorks (Charlotte AI) agents in your CrowdStrike environment.

• Search agentworks spans

  Tool name: falcon_search_agentworks_spans

  Search AgentWorks execution spans (traces) for observability.

• Search applications

  Tool name: falcon_search_applications

  Search for applications discovered in your CrowdStrike environment.

• Search cases

  Tool name: falcon_search_cases

  Find cases by criteria and return their complete details.

• Search cloud groups

  Tool name: falcon_search_cloud_groups

  List cloud groups in your CrowdStrike environment.

• Search cloud insights

  Tool name: falcon_search_cloud_insights

  Search for cloud security insights using FQL.

• Search cloud risks

  Tool name: falcon_search_cloud_risks

  Search for cloud risks in your CrowdStrike environment.

• Search correlation rules

  Tool name: falcon_search_correlation_rules

  Search NG-SIEM Correlation Rules and return full rule details.

• Search cspm assets

  Tool name: falcon_search_cspm_assets

  Search for cloud assets in your CrowdStrike CSPM inventory.

• Search cspm suppression rules

  Tool name: falcon_search_cspm_suppression_rules

  Search for CSPM IOM suppression rules.

• Search data protection classifications

  Tool name: falcon_search_data_protection_classifications

  Search for Data Protection classifications in your CrowdStrike environment.

• Search data protection content patterns

  Tool name: falcon_search_data_protection_content_patterns

  Search for Data Protection content patterns in your CrowdStrike environment.

• Search data protection policies

  Tool name: falcon_search_data_protection_policies

  Search for Data Protection policies in your CrowdStrike environment.

• Search detections

  Tool name: falcon_search_detections

  Find detections (also called alerts) by criteria and return their complete details.

• Search exclusions

  Tool name: falcon_search_exclusions

  Search exclusions of a given type and return full exclusion records.

• Search firewall policy rules

  Tool name: falcon_search_firewall_policy_rules

  Search firewall rules within a specific policy container.

• Search firewall rule groups

  Tool name: falcon_search_firewall_rule_groups

  Search firewall rule groups and return full rule group details.

• Search firewall rules

  Tool name: falcon_search_firewall_rules

  Search firewall rules and return full rule details.

• Search guardian agents

  Tool name: falcon_search_guardian_agents

  List AI agents from the AIAgent entity store.

• Search guardian detections

  Tool name: falcon_search_guardian_detections

  List detections involving AI agent processes.

• Search guardian executions

  Tool name: falcon_search_guardian_executions

  List AI agent process executions, with the model and token counts for each.

• Search guardian installs

  Tool name: falcon_search_guardian_installs

  List AI agent installations (AIAgentInstallationView entity).

• Search guardian MCP servers

  Tool name: falcon_search_guardian_mcp_servers

  List MCP server names observed across the fleet (MCPServerName entity).

• Search guardian models

  Tool name: falcon_search_guardian_models

  List AI model names (AIModelName entity).

• Search guardian os users

  Tool name: falcon_search_guardian_os_users

  List OS users that have run AI agents (AIAgentOSUser entity).

• Search guardian prompts

  Tool name: falcon_search_guardian_prompts

  Search for AI prompts within a session (LogScale AgenticUserPromptSubmit).

• Search guardian skill usage

  Tool name: falcon_search_guardian_skill_usage

  List per-invocation AI skill events (LogScale AgenticToolRequest).

• Search guardian skills

  Tool name: falcon_search_guardian_skills

  List AI skill frontmatters (AISkillFrontmatterView entity).

• Search guardian tool usage

  Tool name: falcon_search_guardian_tool_usage

  List AI tool usage from LogScale AgenticToolRequest events.

• Search guardian tools

  Tool name: falcon_search_guardian_tools

  List AI tools from the AITool entity store — the inventory of which tools exist.

• Search host group members

  Tool name: falcon_search_host_group_members

  Search for the host members of a specific host group.

• Search host groups

  Tool name: falcon_search_host_groups

  Search for host groups in your CrowdStrike environment.

• Search hosts

  Tool name: falcon_search_hosts

  Search hosts and their sensor state: filter by hostname, platform, IP, sensor version, containment (network-quarantine) status, assigned policies, or grouping tags.

• Search images vulnerabilities

  Tool name: falcon_search_images_vulnerabilities

  Search for container image vulnerabilities in CrowdStrike Image Assessments.

• Search indicators

  Tool name: falcon_search_indicators

  Search for threat indicators and IOCs from CrowdStrike intelligence.

• Search ioa rule groups

  Tool name: falcon_search_ioa_rule_groups

  Search Custom IOA rule groups and return full details including their rules.

• Search IOCS

  Tool name: falcon_search_iocs

  Search custom IOCs and return full IOC details.

• Search iom findings

  Tool name: falcon_search_iom_findings

  Search for CSPM Indicators of Misconfiguration (IOM) findings.

• Search kubernetes containers

  Tool name: falcon_search_kubernetes_containers

  Search for Kubernetes containers in your CrowdStrike container inventory.

• Search managed assets

  Tool name: falcon_search_managed_assets

  Search hosts by asset and configuration posture: drive encryption status, encrypted/unencrypted drives, OS security settings (Secure Boot, Credential Guard, IOMMU), disk/memory/CPU usage, asset…

• Search ngsiem

  Tool name: falcon_search_ngsiem

  Execute a CQL (CrowdStrike Query Language) query against CrowdStrike Next-Gen SIEM.

• Search policies

  Tool name: falcon_search_policies

  Search host-based policies of a given type and return full policy records.

• Search policy members

  Tool name: falcon_search_policy_members

  Search for the host members governed by a specific policy.

• Search quarantined files

  Tool name: falcon_search_quarantined_files

  Search quarantined files and return full quarantine metadata.

• Search recon exposed data records

  Tool name: falcon_search_recon_exposed_data_records

  Search Falcon Intelligence Recon exposed-data records and return their full details.

• Search recon notifications

  Tool name: falcon_search_recon_notifications

  Search Falcon Intelligence Recon notifications (also called recon alerts) and return their full details.

• Search recon rules

  Tool name: falcon_search_recon_rules

  Search Falcon Intelligence Recon monitoring rules and return their full details.

• Search report executions

  Tool name: falcon_search_report_executions

  Search for report/search execution history.

• Search reports

  Tool name: falcon_search_reports

  Search CrowdStrike intelligence publications and threat reports.

• Search rtr audit sessions

  Tool name: falcon_search_rtr_audit_sessions

  Search RTR audit sessions for accountability and timeline evidence.

• Search rtr sessions

  Tool name: falcon_search_rtr_sessions

  Search RTR sessions and return full session details.

• Search scheduled reports

  Tool name: falcon_search_scheduled_reports

  Search for scheduled reports and searches in your CrowdStrike environment.

• Search sensor usage

  Tool name: falcon_search_sensor_usage

  Search for weekly sensor usage data in your CrowdStrike environment.

• Search serverless vulnerabilities

  Tool name: falcon_search_serverless_vulnerabilities

  Search for vulnerabilities in serverless functions across all cloud providers.

• Search shield alerts

  Tool name: falcon_search_shield_alerts

  Search Falcon Shield (SaaS Security) alerts for monitored SaaS applications.

• Search shield apps

  Tool name: falcon_search_shield_apps

  List third-party applications (OAuth apps, API tokens, browser extensions, service principals) with access to Falcon Shield (SaaS Security) monitored platforms.

• Search shield checks

  Tool name: falcon_search_shield_checks

  Search individual Falcon Shield (SaaS Security) posture checks with filtering.

• Search shield data shares

  Tool name: falcon_search_shield_data_shares

  List files and resources shared externally across Falcon Shield (SaaS Security) monitored applications.

• Search shield devices

  Tool name: falcon_search_shield_devices

  List devices registered to users in Falcon Shield (SaaS Security) connected SaaS applications.

• Search shield users

  Tool name: falcon_search_shield_users

  List end-users discovered across Falcon Shield (SaaS Security) connected SaaS applications.

• Search unmanaged assets

  Tool name: falcon_search_unmanaged_assets

  Search for unmanaged assets (hosts without Falcon sensor) in your environment.

• Search vulnerabilities

  Tool name: falcon_search_vulnerabilities

  Search for vulnerabilities in your CrowdStrike environment.

• Search workflow definitions

  Tool name: falcon_search_workflow_definitions

  Search Fusion SOAR workflow definitions in your CrowdStrike environment.

• Search workflow executions

  Tool name: falcon_search_workflow_executions

  Search Fusion SOAR workflow execution history in your CrowdStrike environment.

• Search zta assessments

  Tool name: falcon_search_zta_assessments

  Search Zero Trust Assessment scores and return full assessment details.

• Set policy precedence

  Tool name: falcon_set_policy_precedence

  Set the precedence (evaluation order) of policies for a platform.

• Update case

  Tool name: falcon_update_case

  Update an existing case's fields.

• Update correlation rule

  Tool name: falcon_update_correlation_rule

  Update an existing NG-SIEM Correlation Rule.

• Update detections

  Tool name: falcon_update_detections

  Update the status, assignment, visibility, comments, and tags of one or more detections.

• Update exclusion

  Tool name: falcon_update_exclusion

  Update an existing exclusion of the given type.

• Update host group

  Tool name: falcon_update_host_group

  Update an existing host group.

• Update ioa rule

  Tool name: falcon_update_ioa_rule

  Update an existing Custom IOA behavioral detection rule.

• Update ioa rule group

  Tool name: falcon_update_ioa_rule_group

  Update an existing Custom IOA rule group.

• Update policy

  Tool name: falcon_update_policy

  Update an existing host-based policy of the given type.

• Update quarantined files

  Tool name: falcon_update_quarantined_files

  Apply a reversible quarantine action to records selected by IDs or filter.