CrowdStrike Falcon

CrowdStrike Falcon is a cloud-native endpoint protection platform designed to detect, prevent, and respond to cyber threats.

CrowdStrike Falcon is a leading endpoint protection platform that provides comprehensive threat intelligence and real-time response capabilities. This connector enables seamless integration with Swimlane Turbine, allowing users to automate threat detection, response, and management tasks. By leveraging the capabilities of CrowdStrike Falcon, Swimlane Turbine users can enhance their security operations with automated incident response, real-time threat intelligence, and efficient management of security incidents and vulnerabilities.

Prerequisites

Before you can use the CrowdStrike Falcon connector for Turbine, you'll need access to the CrowdStrike Falcon API. This requires the following:

OAuth 2.0 Client Credentials authentication using the following parameters:

URL: The base URL for accessing the CrowdStrike Falcon API.

Client ID: A unique identifier for your application to authenticate with the API.

Client Secret: A secret key used in conjunction with the Client ID to authenticate your application.

Asset Configuration

Each CrowdStrike cloud has a different base URL. When making requests to the CrowdStrike API, use the base URL that corresponds to the cloud where your integration is hosted.

US-1: https://api.crowdstrike.com

US-2: https://api.us-2.crowdstrike.com

EU-1: https://api.eu-1.crowdstrike.com

US-GOV-1: https://api.laggar.gcw.crowdstrike.com

US-GOV-2: https://api.us-gov-2.crowdstrike.mil

Capabilities

This connector has the following capabilities:

Detections

Get Detections

Get Detections Summary

Update Detections

Host

Get Host Info

Get Host ID

Manage Host

Search Hosts

Incidents

Get Incidents

Perform Incident Action

Query Behaviors

Users

Get user IDs by email

Indicators

Create Indicator

Get Indicator

Query Host for Indicator

Query Indicator

Update Indicator

Reports

Search Reports

Real Time Response (RTR)

CMD Result

Admin CMD Run

Get Script

Get Uploaded File Info

Upload Script

Get Script IDs

Extracted File Content

Delete Session File ID

Session File Download

List Files

Get Session IDs

Upload File

Refresh, Delete, and Initialize Session

Falcon Sandbox

Get File Analysis

Get Reports

Query Reports

Upload File Analysis

Submit File Analysis

Scan

Delete Quarantine File

Manage Scans

Retrieve Scan by ID

Scheduled Reports

Get Scheduled Reports

Launch Scheduled Reports

Query Scheduled Reports

ThreatGraph

Vertex Summary

Custom Action

Get Results From Vulnerability Keyword Search Link

Filter the vulnerabilities, Refer the below example

filter: status:'open'+cve.exploit_status:['90']+cve.exprt_rating:['CRITICAL']

Notes

Manage Scans Action : File path exclusions can be formatted in glob syntax. For more info, see Glob Syntax.

You must have an account in order to view the documentation.

CrowdStrike Falcon documentation

Falconpy Docs

Additional Documentation

CrowdStrike Falcon Connector Documentation

CrowdStrike Falcon API Documentation

CrowdStrike Falcon Authentication Guide

Configurations

Oauth 2.0 Client Credentials

Authenticates using oauth 2.0 client credentials

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
client_id	The client ID	string	Required
client_secret	The client secret.	string	Required
member_cid	Member CID for MSSP environment.	string	Optional
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Delete Quarantine File

Remove quarantined files from endpoints in CrowdStrike Falcon using specified file IDs, action types, and comments.

Endpoint

URL: /quarantine/entities/quarantined-files/v1

Method: PATCH

Input

Argument Name	Type	Required	Description
comment	string	Optional	Comment to list along with action taken.
ids	array	Optional	List of Quarantine IDs to update.
action	string	Optional	Action to perform against the quarantined file.

Input Example

{"json_body":{"comment":"string","ids":["id1","id2"],"action":"delete"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 02 Nov 2023 16:43:41 GMT","Content-Type":"application/json","Content-Length":"231","Connection":"keep-alive","X-Content-Type-Options":"nosniff","X-Cs-Traceid":"c346f1ac-873b-4794-b85f-f35b9a6b7884","X-Ratelimit-Limit":"15","X-Ratelimit-Remaining":"14","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"reason":"OK","json_body":{}}

Delete RTR Session

Terminate an existing Real Time Response session in CrowdStrike Falcon using the specified session ID.

Endpoint

URL: real-time-response/entities/sessions/v1

Method: DELETE

Input

Argument Name	Type	Required	Description
parameters.session_id	string	Required	Parameters for the Delete RTR Session action

Input Example

{"parameters":{"session_id":"5366aad8-86a6-4fa0-948e-010cc525e6bd"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
response_text	string	Output field: response_text

Output Example

{"status_code":204,"response_headers":{"Server":"nginx","Date":"Fri, 21 Oct 2022 18:04:36 GMT","Content-Type":"application/json","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"6fa00735-ec3f-4ce5-be30-5ba5e94ec8e6","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5995","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"reason":"No Content","response_text":""}

Delete RTR Session File

Remove a specified Real Time Response session file from CrowdStrike Falcon using provided session and file IDs.

Endpoint

URL: real-time-response/entities/file/v2

Method: DELETE

Input

Argument Name	Type	Required	Description
parameters.session_id	string	Required	Parameters for the Delete RTR Session File action
parameters.ids	string	Required	Parameters for the Delete RTR Session File action

Input Example

{"parameters":{"session_id":"123qwe","ids":"rtrsessionfileid"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
data	object	Response data
data.errors	array	Response data
data.errors.code	number	Response data
data.errors.id	string	Response data
data.errors.message	string	Response data
data.meta	object	Response data
data.meta.pagination	object	Response data
data.meta.pagination.limit	number	Response data
data.meta.pagination.offset	number	Response data
data.meta.pagination.total	number	Response data
data.meta.powered_by	string	Response data
data.meta.query_time	number	Response data
data.meta.trace_id	string	Response data
data.meta.writes	object	Response data
data.meta.writes.resources_affected	number	Response data
response_text	string	Output field: response_text
reason	string	Response reason phrase

Output Example

{"status_code":204,"response_headers":{"Server":"nginx","Date":"Fri, 09 Sep 2022 14:47:19 GMT","Content-Type":"application/json","Content-Length":"215","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"b353da90-67d7-49f1-8805-21d76bc45c72","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"data":{"errors":[{}],"meta":{"pagination":{},"powered_by":"string","query_time":0,"trace_id":"s...

Get Detections

Retrieve a list of detection IDs from CrowdStrike Falcon based on specified parameters.

Endpoint

URL: detects/queries/detects/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Parameters for the Get Detections action
parameters.offset	number	Optional	Parameters for the Get Detections action
parameters.limit	number	Optional	Parameters for the Get Detections action
parameters.sort	string	Optional	Parameters for the Get Detections action
parameters.q	string	Optional	Parameters for the Get Detections action

Input Example

{"parameters":{"filter":"status:'new'","offset":0,"limit":1,"sort":"first_behavior","q":"query"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.pagination	object	Output field: meta.pagination
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
errors	array	Error message if any
errors.file_name	string	Name of the resource
errors.file	string	Error message if any

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 18 Oct 2022 20:46:37 GMT","Content-Type":"application/json","Content-Length":"477","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"3279d3e5-f9fc-4f43-833b-eab293fa9bbe","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5995"},"reason":"OK","json_body":{"meta":{"query_time":0.00738949,...

Get Detection Summaries

Retrieve summaries for specific detections in CrowdStrike Falcon by providing their unique IDs.

Endpoint

URL: detects/entities/summaries/GET/v1

Method: POST

Input

Argument Name	Type	Required	Description
ids	array	Optional	Unique identifier

Input Example

{"json_body":{"ids":["ldt:20c5964f60d649439068d19e3be19c2e:4295481339","ldt:4e400866e4d8462a9d1824eb52ca2516:8592791965","ldt:4e400866e4d8462a9d1824eb52ca2516:8591241167","ldt:4e400866e4d8462a9d1824eb52ca2516:8590422710","ldt:4e400866e4d8462a9d1824eb52ca2516:4298085720","ldt:4e400866e4d8462a9d1824eb52ca2516:4296113139","ldt:4e400866e4d8462a9d1824eb52ca2516:4295965514","ldt:766a3015cdcc41b39d24cdf9a1c8afd3:25796649270"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
resources.cid	string	Unique identifier
resources.created_timestamp	string	Output field: resources.created_timestamp
resources.detection_id	string	Unique identifier
resources.device	object	Output field: resources.device
resources.device.device_id	string	Unique identifier
resources.device.cid	string	Unique identifier
resources.device.agent_load_flags	string	Output field: resources.device.agent_load_flags
resources.device.agent_local_time	string	Time value
resources.device.agent_version	string	Output field: resources.device.agent_version
resources.device.bios_manufacturer	string	Output field: resources.device.bios_manufacturer
resources.device.bios_version	string	Output field: resources.device.bios_version
resources.device.config_id_base	string	Unique identifier
resources.device.config_id_build	string	Unique identifier
resources.device.config_id_platform	string	Unique identifier
resources.device.external_ip	string	Output field: resources.device.external_ip
resources.device.hostname	string	Name of the resource
resources.device.first_seen	string	Output field: resources.device.first_seen
resources.device.last_seen	string	Output field: resources.device.last_seen

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 18 Oct 2022 21:17:15 GMT","Content-Type":"application/json","Content-Length":"1919","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"bbd58ec5-9822-4ed0-bbce-5f5c5b1da5c1","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5995"},"reason":"OK","json_body":{"meta":{"query_time":0.00223369...

Execute RTR Command

Execute a Real Time Response admin command on a host in CrowdStrike Falcon using a specified command string, device ID, and session ID.

Endpoint

URL: real-time-response/entities/admin-command/v1

Method: POST

Input

Argument Name	Type	Required	Description
base_command	string	Optional	Parameter for Execute RTR Command
command_string	string	Optional	Parameter for Execute RTR Command
device_id	string	Optional	Unique identifier
id	number	Optional	Unique identifier
persist	boolean	Optional	Parameter for Execute RTR Command
session_id	string	Optional	Unique identifier

Input Example

{"json_body":{"base_command":"ls","command_string":"-la","device_id":"string","id":0,"persist":true,"session_id":"a8f685e0-117a-4707-867c-51b48f767392"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
resources.session_id	string	Unique identifier
resources.cloud_request_id	string	Unique identifier
resources.queued_command_offline	boolean	Output field: resources.queued_command_offline
errors	object	Error message if any

Output Example

{"status_code":201,"response_headers":{"Server":"nginx","Date":"Thu, 20 Oct 2022 18:15:48 GMT","Content-Type":"application/json","Content-Length":"264","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"2c4d5303-a9b9-4dc7-8b17-122bddca8374","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5994","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"reason":"Created","json_body":{"meta":{"query_time":0.059549469,"powered_by":"empower-api","tra...

Get File Analysis

Retrieve the status of a sandbox file analysis in CrowdStrike Falcon by specifying the 'ids' parameter.

Endpoint

URL: /falconx/entities/submissions/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.ids	array	Required	Parameters for the Get File Analysis action

Input Example

{"parameters":{"ids":["inc:4e400866e4d8462a9d1824eb52ca2516:c8a3075e582a46dd86da7a35ab1e73e3"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Get Incidents IDs

Retrieve a list of incident IDs from CrowdStrike Falcon based on specified search parameters.

Endpoint

URL: incidents/queries/incidents/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.sort	string	Optional	Parameters for the Get Incidents IDs action
parameters.filter	string	Optional	Parameters for the Get Incidents IDs action
parameters.offset	string	Optional	Parameters for the Get Incidents IDs action
parameters.limit	number	Optional	Parameters for the Get Incidents IDs action

Input Example

{"parameters":{"sort":"assigned_to.asc","filter":"start:>='2020-06-02T22:15:57Z'","offset":"0","limit":500}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.pagination	object	Output field: meta.pagination
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
errors	array	Error message if any
errors.file_name	string	Name of the resource
errors.file	string	Error message if any

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Fri, 21 Oct 2022 17:34:49 GMT","Content-Type":"application/json","Content-Length":"273","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"e832d840-8e96-4ed3-aafd-33f5613f3c0b","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.00960287,...

Get Reports by IDs

Obtain detailed sandbox analysis reports from CrowdStrike Falcon using specific report IDs provided in parameters.

Endpoint

URL: falconx/entities/reports/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.ids	array	Required	Parameters for the Get Reports by IDs action

Input Example

{"parameters":{"ids":["123qweawdkjslkfjadjio1rjfieawfnisd"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Query Reports

Finds sandbox reports in CrowdStrike Falcon using an FQL filter and paging, requiring specific parameters for execution.

Endpoint

URL: falconx/queries/reports/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.offset	string	Optional	Parameters for the Query Reports action
parameters.limit	number	Optional	Parameters for the Query Reports action
parameters.sort	string	Optional	Parameters for the Query Reports action
parameters.filter	string	Optional	Parameters for the Query Reports action

Input Example

{"parameters":{"offset":"0","limit":100,"sort":"created_at|asc","filter":"name:'report123'"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Get Results From Vulnerability Keyword Search

Retrieve IDs, AIDs, and CVEs related to a specified vulnerability keyword in CrowdStrike Falcon, applying custom filters. Requires keyword and filter in the JSON body.

Endpoint

Method: POST

Input

Argument Name	Type	Required	Description
keyword	string	Optional	Keyword for filtering vulnerabilities.
filter	string	Optional	Filter the vulnerabilities based on status, exploit status, expert rating etc.
test_mode	boolean	Optional	Toggle to run a quick test.

Input Example

{"json_body":{"keyword":"chrome","test_mode":true}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
ids	array	Unique identifier
aids	array	Unique identifier
cves	array	Output field: cves
host_info	object	Output field: host_info
host_info.f06292f397d5438e9cb61faf97aa0726	object	Output field: host_info.f06292f397d5438e9cb61faf97aa0726
host_info.f06292f397d5438e9cb61faf97aa0726.hostname	string	Name of the resource
host_info.f06292f397d5438e9cb61faf97aa0726.local_ip	string	Output field: host_info.f06292f397d5438e9cb61faf97aa0726.local_ip
host_info.fd3655157efd4d96977cbfd20dfba071	object	Output field: host_info.fd3655157efd4d96977cbfd20dfba071
host_info.fd3655157efd4d96977cbfd20dfba071.hostname	string	Name of the resource
host_info.fd3655157efd4d96977cbfd20dfba071.local_ip	string	Output field: host_info.fd3655157efd4d96977cbfd20dfba071.local_ip
host_info.2aba60819e344f939811b55a9af52d3f	object	Output field: host_info.2aba60819e344f939811b55a9af52d3f
host_info.2aba60819e344f939811b55a9af52d3f.hostname	string	Name of the resource
host_info.2aba60819e344f939811b55a9af52d3f.local_ip	string	Output field: host_info.2aba60819e344f939811b55a9af52d3f.local_ip
host_info.6ec71e642bac41c790fe263043604c97	object	Output field: host_info.6ec71e642bac41c790fe263043604c97
host_info.6ec71e642bac41c790fe263043604c97.hostname	string	Name of the resource
host_info.6ec71e642bac41c790fe263043604c97.local_ip	string	Output field: host_info.6ec71e642bac41c790fe263043604c97.local_ip
host_info.35ee5ec29c734a54add3470bb290837b	object	Output field: host_info.35ee5ec29c734a54add3470bb290837b
host_info.35ee5ec29c734a54add3470bb290837b.hostname	string	Name of the resource
host_info.35ee5ec29c734a54add3470bb290837b.local_ip	string	Output field: host_info.35ee5ec29c734a54add3470bb290837b.local_ip

Output Example

{"status_code":200,"json_body":{"ids":["7c5ab944bddb43cd8614686d5d5a2dd1_b144007d1bcb36a68bea0f9b1158a3d1","e2b1964cea2b49bea5f6a44cc61da9ac_b144007d1bcb36a68bea0f9b1158a3d1","8615632cb69a43ce9432ebbaf5ff7f16_01bbf023d3e53b27be58cf5158448733"],"aids":["a3b12addd4d14b959596d4e7c0cdd716","5f7b99fcde0a42cca5d0c4be8c061a80","3d30d861ee0d40f5b7f620b8d0b90c2f"],"cves":["CVE-2023-4863","CVE-2024-7965","CVE-2024-7971"],"host_info":{"f06292f397d5438e9cb61faf97aa0726":{},"fd3655157efd4d96977cbfd20dfba071"...

Get RTR Extracted File Contents

Retrieve the contents of a file extracted in a CrowdStrike Falcon RTR session using a specific session ID and SHA256.

Endpoint

URL: real-time-response/entities/extracted-file-contents/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.session_id	string	Required	Parameters for the Get RTR Extracted File Contents action
parameters.sha256	string	Required	Parameters for the Get RTR Extracted File Contents action
parameters.filename	string	Optional	Parameters for the Get RTR Extracted File Contents action

Input Example

{"parameters":{"session_id":"asd123","sha256":"efa256a96af3b556cd3fc9d8b1cf587d72807d7805ced441e8149fc279db422b","filename":"myfile"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
file	array	Output field: file
file.file	string	Output field: file.file
file.file_name	string	Name of the resource

Output Example

{"file":[]}

Get RTR Put Files

Retrieve files for CrowdStrike Falcon's Real Time Response 'put' command using specified IDs.

Endpoint

URL: /real-time-response/entities/put-files/v2

Method: GET

Input

Argument Name	Type	Required	Description
parameters.ids	array	Required	Parameters for the Get RTR Put Files action

Input Example

{"parameters":{"ids":["qwe123"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
data	object	Response data
data.errors	array	Response data
data.errors.code	number	Response data
data.errors.id	string	Response data
data.errors.message	string	Response data
data.meta	object	Response data
data.meta.pagination	object	Response data
data.meta.pagination.limit	number	Response data
data.meta.pagination.offset	number	Response data
data.meta.pagination.total	number	Response data
data.meta.powered_by	string	Response data
data.meta.query_time	number	Response data
data.meta.trace_id	string	Response data
data.meta.writes	object	Response data
data.meta.writes.resources_affected	number	Response data
data.resources	array	Response data
data.resources.bucket	string	Response data
data.resources.cid	string	Response data
data.resources.comments_for_audit_log	string	Response data
data.resources.content	string	Response data
data.resources.created_by	string	Response data
data.resources.created_by_uuid	string	Response data
data.resources.created_timestamp	string	Response data
data.resources.description	string	Response data

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Fri, 09 Sep 2022 12:21:15 GMT","Content-Type":"application/json","Content-Length":"149","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"ae976111-9d15-4e08-8fd2-944e29b0a651","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5998","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"data":{"errors":[{}],"meta":{"pagination":{},"powered_by":"string","query_time":0,"trace_id":"s...

Get RTR Session Files

Retrieve a list of files from a specific CrowdStrike Falcon RTR session using the provided session_id.

Endpoint

URL: /real-time-response/entities/file/v2

Method: GET

Input

Argument Name	Type	Required	Description
parameters.session_id	string	Required	Parameters for the Get RTR Session Files action

Input Example

{"parameters":{"session_id":"44a70ac4-1482-4cdb-a49f-78eb170ebac4"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
resources.id	string	Unique identifier
resources.cloud_request_id	string	Unique identifier
resources.created_at	string	Output field: resources.created_at
resources.updated_at	string	Output field: resources.updated_at
resources.deleted_at	string	Output field: resources.deleted_at
resources.error_message	string	Response message
resources.name	string	Name of the resource
resources.progress	number	Output field: resources.progress
resources.session_id	string	Unique identifier
resources.sha256	string	Output field: resources.sha256
resources.size	number	Output field: resources.size
resources.stage	string	Output field: resources.stage
resources.status	string	Status value
resources.complete	boolean	Output field: resources.complete
errors	array	Error message if any
errors.file_name	string	Name of the resource
errors.file	string	Error message if any

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 20 Oct 2022 17:23:05 GMT","Content-Type":"application/json","Content-Length":"160","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"423cc665-1ac3-4b26-a2ba-5fb778ad0ae7","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"reason":"OK","json_body":{"meta":{"query_time":0.019349868,"powered_by":"empower-api","trace_id...

Get RTR Session IDs

Retrieve a list of Real Time Response session IDs from CrowdStrike Falcon to aid in incident investigation and response.

Endpoint

URL: real-time-response/queries/sessions/v1

Method: GET

Input

Argument Name	Type	Required	Description

Input Example

{"parameters":{}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.pagination	object	Output field: meta.pagination
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
errors	array	Error message if any
errors.file_name	string	Name of the resource
errors.file	string	Error message if any

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 20 Oct 2022 17:18:21 GMT","Content-Type":"application/json","Content-Length":"323","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"73e24c31-821c-44a0-8689-81348c270689","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5995","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"reason":"OK","json_body":{"meta":{"query_time":0.001995284,"pagination":{},"powered_by":"empowe...

Get Scheduled Reports

Retrieve scheduled reports from CrowdStrike Falcon using specified report IDs. Requires 'ids' parameter.

Endpoint

URL: /reports/entities/scheduled-reports/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.ids	array	Required	The scheduled report ID to get details about.

Input Example

{"parameters":{"ids":["07c38c6536454292b199145fa2903bee"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
errors	array	Error message if any
errors.code	number	Error message if any
errors.id	string	Unique identifier
errors.message	string	Response message
meta	object	Output field: meta
meta.pagination	object	Output field: meta.pagination
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.query_time	number	Time value
meta.trace_id	string	Unique identifier
meta.writes	object	Output field: meta.writes
meta.writes.resources_affected	number	Output field: meta.writes.resources_affected
resources	array	Output field: resources
resources.api_client_id	string	Unique identifier
resources.can_write	boolean	Output field: resources.can_write
resources.created_on	string	Output field: resources.created_on
resources.customer_id	string	Unique identifier
resources.description	string	Output field: resources.description
resources.expiration_on	string	Output field: resources.expiration_on
resources.id	string	Unique identifier
resources.last_execution	object	Output field: resources.last_execution

Output Example

{"errors":[{"code":123,"id":"12345678-1234-1234-1234-123456789abc","message":"string"}],"meta":{"pagination":{"limit":123,"offset":123,"total":123},"powered_by":"string","query_time":123,"trace_id":"string","writes":{"resources_affected":123}},"resources":[{"api_client_id":"string","can_write":true,"created_on":"string","customer_id":"string","description":"string","expiration_on":"string","id":"12345678-1234-1234-1234-123456789abc","last_execution":{},"last_updated_on":"string","name":"Example ...

Get Scripts

Retrieve custom scripts by specified IDs for Real Time Response operations in CrowdStrike Falcon.

Endpoint

URL: real-time-response/entities/scripts/v2

Method: GET

Input

Argument Name	Type	Required	Description
parameters.ids	array	Required	Parameters for the Get Scripts action

Input Example

{"parameters":{"ids":["d8367f494e9311ea97920662caec3daa_6890622d3b88416f90879f7c3497ac1f","44d5b6154e9211ea800f02e419334184_6890622d3b88416f90879f7c3497ac1f"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
resources.id	string	Unique identifier
resources.name	string	Name of the resource
resources.description	string	Output field: resources.description
resources.file_type	string	Type of the resource
resources.platform	array	Output field: resources.platform
resources.size	number	Output field: resources.size
resources.content	string	Response content
resources.created_by	string	Output field: resources.created_by
resources.created_by_uuid	string	Unique identifier
resources.created_timestamp	string	Output field: resources.created_timestamp
resources.modified_by	string	Output field: resources.modified_by
resources.modified_timestamp	string	Output field: resources.modified_timestamp
resources.sha256	string	Output field: resources.sha256
resources.permission_type	string	Type of the resource
resources.run_attempt_count	number	Count value
resources.run_success_count	number	Whether the operation was successful
resources.write_access	boolean	Output field: resources.write_access

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 20 Oct 2022 17:50:32 GMT","Content-Type":"application/json","Content-Length":"605","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"07e49eb5-409a-4a44-a233-3037b242ad9c","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5995","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"reason":"OK","json_body":{"meta":{"query_time":0.115900991,"powered_by":"empower-api","trace_id...

Get Scripts IDs

Obtain Real Time Response script IDs from CrowdStrike Falcon for incident response playbook integration.

Endpoint

URL: real-time-response/queries/scripts/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.offset	string	Optional	Parameters for the Get Scripts IDs action
parameters.limit	number	Optional	Parameters for the Get Scripts IDs action
parameters.sort	string	Optional	Parameters for the Get Scripts IDs action
parameters.filter	string	Optional	Parameters for the Get Scripts IDs action

Input Example

{"parameters":{"offset":"0","limit":100,"sort":"created_at|asc","filter":"name:'script-1.ps1'"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.pagination	object	Output field: meta.pagination
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 20 Oct 2022 17:37:05 GMT","Content-Type":"application/json","Content-Length":"650","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"31159bff-08b4-4175-a561-e6b7aa7f70c4","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"reason":"OK","json_body":{"meta":{"query_time":0.019319069,"pagination":{},"powered_by":"empowe...

Get User IDs

Retrieve a list of unique user IDs from CrowdStrike Falcon for system user identification.

Endpoint

URL: user-management/queries/users/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Parameters for the Get User IDs action
parameters.limit	number	Optional	Parameters for the Get User IDs action
parameters.offset	number	Optional	Parameters for the Get User IDs action
parameters.sort	string	Optional	Parameters for the Get User IDs action

Input Example

{"parameters":{"filter":"","limit":1,"offset":0,"sort":"uid|asc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.pagination	object	Output field: meta.pagination
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Mon, 09 Jan 2023 23:11:38 GMT","Content-Type":"application/json","Content-Length":"222","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"97f3a15e-2472-49ef-af72-1d675c122098","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5997"},"reason":"OK","json_body":{"meta":{"query_time":0.005224134...

Get Host Info

Retrieve detailed information for specified hosts in CrowdStrike Falcon using their unique IDs.

Endpoint

URL: /devices/entities/devices/v2

Method: POST

Input

Argument Name	Type	Required	Description
ids	array	Optional	Unique identifier

Input Example

{"json_body":{"ids":["4e400866e4d8462a9d1824eb52ca2516","e4c65cfccae64aa68271cb9d947543f6","cbfa8e6cecb1400993830b1b9d6d98f4"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
resources.device_id	string	Unique identifier
resources.cid	string	Unique identifier
resources.agent_load_flags	string	Output field: resources.agent_load_flags
resources.agent_local_time	string	Time value
resources.agent_version	string	Output field: resources.agent_version
resources.bios_manufacturer	string	Output field: resources.bios_manufacturer
resources.bios_version	string	Output field: resources.bios_version
resources.build_number	string	Output field: resources.build_number
resources.config_id_base	string	Unique identifier
resources.config_id_build	string	Unique identifier
resources.config_id_platform	string	Unique identifier
resources.cpu_signature	string	Output field: resources.cpu_signature
resources.external_ip	string	Output field: resources.external_ip
resources.mac_address	string	Output field: resources.mac_address
resources.hostname	string	Name of the resource
resources.first_seen	string	Output field: resources.first_seen
resources.last_seen	string	Output field: resources.last_seen
resources.local_ip	string	Output field: resources.local_ip

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 18 Oct 2022 22:01:51 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"fa8f0e31-b0b0-4f71-a82e-aed99cff4785","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.00...

Search Host

Execute a search across all hosts in CrowdStrike Falcon using a specified Falcon Query Language (FQL) query.

Endpoint

URL: /devices/queries/devices/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.offset	number	Optional	Parameters for the Search Host action
parameters.limit	number	Optional	Parameters for the Search Host action
parameters.sort	string	Optional	Parameters for the Search Host action
parameters.filter	string	Optional	Parameters for the Search Host action

Input Example

{"parameters":{"offset":0,"limit":1,"sort":"first_behavior","filter":"filter expression"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.pagination	object	Output field: meta.pagination
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
errors	array	Error message if any
errors.file_name	string	Name of the resource
errors.file	string	Error message if any

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 18 Oct 2022 21:36:02 GMT","Content-Type":"application/json","Content-Length":"267","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"3c0f732c-44bc-42f2-8b21-582b4054486b","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.005665941...

Get Incidents

Retrieve detailed information for specified incidents in CrowdStrike Falcon using unique incident identifiers provided in the JSON body.

Endpoint

URL: incidents/entities/incidents/GET/v1

Method: POST

Input

Argument Name	Type	Required	Description
ids	array	Optional	Unique identifier

Input Example

{"json_body":{"ids":["inc:4e400866e4d8462a9d1824eb52ca2516:c8a3075e582a46dd86da7a35ab1e73e3"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
resources.incident_id	string	Unique identifier
resources.incident_type	number	Unique identifier
resources.cid	string	Unique identifier
resources.host_ids	array	Unique identifier
resources.hosts	array	Output field: resources.hosts
resources.hosts.device_id	string	Unique identifier
resources.hosts.cid	string	Unique identifier
resources.hosts.agent_load_flags	string	Output field: resources.hosts.agent_load_flags
resources.hosts.agent_local_time	string	Time value
resources.hosts.agent_version	string	Output field: resources.hosts.agent_version
resources.hosts.bios_manufacturer	string	Output field: resources.hosts.bios_manufacturer
resources.hosts.bios_version	string	Output field: resources.hosts.bios_version
resources.hosts.config_id_base	string	Unique identifier
resources.hosts.config_id_build	string	Unique identifier
resources.hosts.config_id_platform	string	Unique identifier
resources.hosts.external_ip	string	Output field: resources.hosts.external_ip
resources.hosts.hostname	string	Name of the resource
resources.hosts.first_seen	string	Output field: resources.hosts.first_seen

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Wed, 19 Oct 2022 21:08:34 GMT","Content-Type":"application/json","Content-Length":"984","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"ed44f4f3-d445-43df-8f19-97e27c1b07fc","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5993"},"reason":"OK","json_body":{"meta":{"query_time":0.050719544...

Create Indicator

Create a new threat intelligence indicator in CrowdStrike Falcon using the specified JSON body format.

Endpoint

URL: iocs/entities/indicators/v1

Method: POST

Input

Argument Name	Type	Required	Description
comment	string	Optional	Parameter for Create Indicator
indicators	array	Optional	Parameter for Create Indicator
indicators.action	string	Optional	Parameter for Create Indicator
indicators.applied_globally	boolean	Optional	Parameter for Create Indicator
indicators.description	string	Optional	Parameter for Create Indicator
indicators.expiration	string	Optional	Parameter for Create Indicator
indicators.host_groups	array	Optional	Parameter for Create Indicator
indicators.metadata	object	Optional	Response data
indicators.metadata.filename	string	Optional	Response data
indicators.mobile_action	string	Optional	Parameter for Create Indicator
indicators.platforms	array	Optional	Parameter for Create Indicator
indicators.severity	string	Optional	Parameter for Create Indicator
indicators.source	string	Optional	Parameter for Create Indicator
indicators.tags	array	Optional	Parameter for Create Indicator
indicators.type	string	Optional	Type of the resource
indicators.value	string	Optional	Value for the parameter

Input Example

{"comment":"string","indicators":[{"action":"string","applied_globally":true,"description":"string","expiration":"string","host_groups":["string"],"metadata":{"filename":"Example Name"},"mobile_action":"string","platforms":["string"],"severity":"string","source":"string","tags":["string"],"type":"string","value":"string"}]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.pagination	object	Output field: meta.pagination
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
errors	object	Error message if any
resources	array	Output field: resources
resources.id	string	Unique identifier
resources.type	string	Type of the resource
resources.value	string	Value for the parameter
resources.action	string	Output field: resources.action
resources.severity	string	Output field: resources.severity
resources.platforms	array	Output field: resources.platforms
resources.tags	array	Output field: resources.tags
resources.tags.file_name	string	Name of the resource
resources.tags.file	string	Output field: resources.tags.file
resources.expired	boolean	Output field: resources.expired
resources.deleted	boolean	Output field: resources.deleted
resources.applied_globally	boolean	Output field: resources.applied_globally
resources.from_parent	boolean	Output field: resources.from_parent
resources.created_on	string	Output field: resources.created_on

Output Example

{"status_code":201,"response_headers":{"Server":"nginx","Date":"Mon, 17 Oct 2022 18:32:59 GMT","Content-Type":"application/json","Content-Length":"440","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"42dfdd44-d39d-4f40-9e2e-22639b5de5d8","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5995"},"reason":"Created","json_body":{"meta":{"query_time":0.1892...

Delete Indicator

Remove a specified indicator from CrowdStrike Falcon using the provided parameters.

Endpoint

URL: iocs/entities/indicators/v1

Method: DELETE

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Parameters for the Delete Indicator action
parameters.ids	array	Optional	Parameters for the Delete Indicator action
parameters.comment	string	Optional	Parameters for the Delete Indicator action

Input Example

{"parameters":{"filter":"FQL filter","ids":["48e23334c3854063dd96f8dd863b0f98046d35a8dbf0cbe7a30b2eb41b47e31e"],"comment":"The comment why this indicators were deleted"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
errors	object	Error message if any
resources	array	Output field: resources

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 18 Oct 2022 18:32:58 GMT","Content-Type":"application/json","Content-Length":"207","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"276d1125-e1ff-41a3-bdc6-ff9db65f3d81","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.154435027...

Get Indicator

Retrieve detailed information for a specific indicator in CrowdStrike Falcon using its unique ID. Requires 'ids' in the JSON body.

Endpoint

URL: iocs/entities/indicators/v1

Method: GET

Input

Argument Name	Type	Required	Description
ids	array	Optional	Unique identifier

Input Example

{"json_body":{"ids":["48e23334c3854063dd96f8dd863b0f98046d35a8dbf0cbe7a30b2eb41b47e31e"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.pagination	object	Output field: meta.pagination
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
errors	object	Error message if any
resources	array	Output field: resources
resources.id	string	Unique identifier
resources.type	string	Type of the resource
resources.value	string	Value for the parameter
resources.action	string	Output field: resources.action
resources.severity	string	Output field: resources.severity
resources.platforms	array	Output field: resources.platforms
resources.tags	array	Output field: resources.tags
resources.tags.file_name	string	Name of the resource
resources.tags.file	string	Output field: resources.tags.file
resources.expired	boolean	Output field: resources.expired
resources.deleted	boolean	Output field: resources.deleted
resources.applied_globally	boolean	Output field: resources.applied_globally
resources.from_parent	boolean	Output field: resources.from_parent
resources.created_on	string	Output field: resources.created_on

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 18 Oct 2022 18:45:23 GMT","Content-Type":"application/json","Content-Length":"441","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"84480a60-2e75-4deb-9abd-44ac034175a1","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5994"},"reason":"OK","json_body":{"meta":{"query_time":0.000457506...

Query Indicator

Query CrowdStrike Falcon for indicator IDs using 'type' and 'value' parameters to enhance threat intelligence efforts.

Endpoint

URL: /indicators/queries/devices/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.type	string	Required	Parameters for the Query Indicator action
parameters.value	string	Required	Parameters for the Query Indicator action
parameters.limit	number	Optional	Parameters for the Query Indicator action
parameters.offset	number	Optional	Parameters for the Query Indicator action

Input Example

{"parameters":{"type":"domain","value":"swimlane.com","limit":10,"offset":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.pagination	object	Output field: meta.pagination
meta.pagination.offset	string	Output field: meta.pagination.offset
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.trace_id	string	Unique identifier
meta.entity	string	Output field: meta.entity
resources	array	Output field: resources
errors	array	Error message if any
errors.file_name	string	Name of the resource
errors.file	string	Error message if any

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 20 Oct 2022 17:06:57 GMT","Content-Type":"application/json","Content-Length":"228","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"7a0bdb09-f1df-48ee-970f-48291e14ea00","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.035178383...

Search Indicators

Execute a refined search for indicators within CrowdStrike Falcon using specified filter criteria and return matching results.

Endpoint

URL: iocs/queries/indicators/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Required	Parameters for the Search Indicators action
parameters.offset	number	Optional	Parameters for the Search Indicators action
parameters.limit	number	Optional	Parameters for the Search Indicators action
parameters.sort	string	Optional	Parameters for the Search Indicators action
parameters.after	string	Optional	Parameters for the Search Indicators action

Input Example

{"parameters":{"filter":"value: 'swimlane.com'","offset":0,"limit":10,"sort":"action","after":"pagination_token"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.pagination	object	Output field: meta.pagination
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.total	number	Output field: meta.pagination.total
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.after	string	Output field: meta.pagination.after
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
errors	object	Error message if any
resources	array	Output field: resources

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 18 Oct 2022 18:22:49 GMT","Content-Type":"application/json","Content-Length":"362","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"49884bfe-e178-45a0-84e0-dd8445d67abc","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.013260798...

Update Indicator

Update specific indicator details within the CrowdStrike Falcon platform to maintain accurate threat intelligence.

Endpoint

URL: iocs/entities/indicators/v1

Method: PATCH

Input

Argument Name	Type	Required	Description
parameters.retrodetects	boolean	Optional	Parameters for the Update Indicator action
parameters.ignore_warnings	boolean	Optional	Parameters for the Update Indicator action
bulk_update	object	Optional	Date value
bulk_update.action	string	Optional	Parameter for Update Indicator
bulk_update.applied_globally	boolean	Optional	Parameter for Update Indicator
bulk_update.description	string	Optional	Parameter for Update Indicator
bulk_update.expiration	string	Optional	Parameter for Update Indicator
bulk_update.filter	string	Optional	Parameter for Update Indicator
bulk_update.from_parent	boolean	Optional	Parameter for Update Indicator
bulk_update.host_groups	array	Optional	Parameter for Update Indicator
bulk_update.metadata	object	Optional	Response data
bulk_update.metadata.filename	string	Optional	Response data
bulk_update.mobile_action	string	Optional	Parameter for Update Indicator
bulk_update.platforms	array	Optional	Parameter for Update Indicator
bulk_update.severity	string	Optional	Parameter for Update Indicator
bulk_update.source	string	Optional	Parameter for Update Indicator
bulk_update.tags	array	Optional	Parameter for Update Indicator
comment	string	Optional	Parameter for Update Indicator
indicators	array	Optional	Parameter for Update Indicator
indicators.action	string	Optional	Parameter for Update Indicator
indicators.applied_globally	boolean	Optional	Parameter for Update Indicator
indicators.description	string	Optional	Parameter for Update Indicator
indicators.expiration	string	Optional	Parameter for Update Indicator
indicators.host_groups	array	Optional	Parameter for Update Indicator
indicators.id	string	Optional	Unique identifier

Input Example

{"parameters":{"retrodetects":true,"ignore_warnings":true},"bulk_update":{"action":"string","applied_globally":true,"description":"string","expiration":"string","filter":"string","from_parent":true,"host_groups":["string"],"metadata":{"filename":"Example Name"},"mobile_action":"string","platforms":["string"],"severity":"string","source":"string","tags":["string"]},"comment":"string","indicators":[{"action":"string","applied_globally":true,"description":"string","expiration":"string","host_groups":["string"],"id":"12345678-1234-1234-1234-123456789abc","metadata":{"filename":"Example Name"},"mobile_action":"string","platforms":["string"],"severity":"string","source":"string","tags":["string"]}]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.pagination	object	Output field: meta.pagination
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
errors	object	Error message if any
resources	array	Output field: resources
resources.file_name	string	Name of the resource
resources.file	string	Output field: resources.file

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 18 Oct 2022 19:21:59 GMT","Content-Type":"application/json","Content-Length":"192","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"9b70ab70-9506-4f11-abc8-920efde2034d","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.667011146...

Initialize RTR Session

Establish A New Real Time Response Session Within CrowdStrike Falcon For Immediate Incident Response.

Endpoint

URL: real-time-response/entities/sessions/v1

Method: POST

Input

Argument Name	Type	Required	Description
paramters	object	Optional	Parameter for Initialize RTR Session
paramters.timeout	number	Optional	Parameter for Initialize RTR Session
paramters.timeout_duration	string	Optional	Parameter for Initialize RTR Session
device_id	string	Optional	Unique identifier
origin	string	Optional	Parameter for Initialize RTR Session
queue_offline	boolean	Optional	Parameter for Initialize RTR Session

Input Example

{"json_body":{"device_id":"985a4275d7ae4e34be339c68d43cc81a","origin":"string","queue_offline":true},"paramters":{"timeout":300,"timeout_duration":"1m"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
data	object	Response data
data.meta	object	Response data
data.meta.query_time	number	Response data
data.meta.powered_by	string	Response data
data.meta.trace_id	string	Response data
data.resources	array	Response data
data.resources.session_id	string	Response data
data.resources.scripts	array	Response data
data.resources.scripts.command	string	Response data
data.resources.scripts.description	string	Response data
data.resources.scripts.examples	string	Response data
data.resources.scripts.internal_only	boolean	Response data
data.resources.scripts.runnable	boolean	Response data
data.resources.scripts.sub_commands	array	Response data
data.resources.scripts.sub_commands.file_name	string	Response data
data.resources.scripts.sub_commands.file	string	Response data
data.resources.scripts.args	array	Response data
data.resources.scripts.args.id	number	Response data
data.resources.scripts.args.created_at	string	Response data
data.resources.scripts.args.updated_at	string	Response data
data.resources.scripts.args.script_id	number	Response data
data.resources.scripts.args.arg_type	string	Response data
data.resources.scripts.args.data_type	string	Response data
data.resources.scripts.args.requires_value	boolean	Response data

Output Example

{"status_code":201,"response_headers":{"Server":"nginx","Date":"Wed, 07 Sep 2022 11:23:32 GMT","Content-Type":"application/json","Content-Length":"1924","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"91ceb5e2-dd30-440c-b4ee-d63aa0e6b2df","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"data":{"meta":{"query_time":1.504846194,"powered_by":"empower-api","trace_id":"91ceb5e2-dd30-4...

Launch Scheduled Reports

Initiate execution of scheduled reports in CrowdStrike Falcon using provided ID(s) and report details.

Endpoint

URL: /reports/entities/scheduled-reports/execution/v1

Method: POST

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
errors	array	Error message if any
errors.code	number	Error message if any
errors.id	string	Unique identifier
errors.message	string	Response message
meta	object	Output field: meta
meta.pagination	object	Output field: meta.pagination
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.query_time	number	Time value
meta.trace_id	string	Unique identifier
meta.writes	object	Output field: meta.writes
meta.writes.resources_affected	number	Output field: meta.writes.resources_affected
resources	array	Output field: resources
resources.can_write	boolean	Output field: resources.can_write
resources.created_on	string	Output field: resources.created_on
resources.customer_id	string	Unique identifier
resources.execution_metadata	object	Response data
resources.execution_metadata.report_params	object	Response data
resources.execution_metadata.report_params.columns	array	Response data
resources.execution_metadata.report_params.dashboard_id	string	Response data
resources.execution_metadata.report_params.dashboard_visibility	string	Response data

Output Example

{"errors":[{"code":123,"id":"12345678-1234-1234-1234-123456789abc","message":"string"}],"meta":{"pagination":{"limit":123,"offset":123,"total":123},"powered_by":"string","query_time":123,"trace_id":"string","writes":{"resources_affected":123}},"resources":[{"can_write":true,"created_on":"string","customer_id":"string","execution_metadata":{},"expiration_on":"string","id":"12345678-1234-1234-1234-123456789abc","job_reference":"string","last_updated_on":"string","report_file_reference":"string","r...

Manage Scans

Initiate, schedule, or control on-demand Windows scans in CrowdStrike Falcon using specified host and file path details.

Endpoint

URL: /ods/entities/scans/v1

Method: POST

Input

Argument Name	Type	Required	Description
hosts	array	Optional	Parameter for Manage Scans
host_groups	array	Optional	Parameter for Manage Scans
file_paths	array	Optional	Parameter for Manage Scans
scan_exclusions	array	Optional	Parameter for Manage Scans
initiated_from	string	Optional	Parameter for Manage Scans
cpu_priority	number	Optional	Parameter for Manage Scans
description	string	Optional	Parameter for Manage Scans
quarantine	boolean	Optional	Parameter for Manage Scans
endpoint_notification	boolean	Optional	Parameter for Manage Scans
pause_duration	number	Optional	Parameter for Manage Scans
sensor_ml_level_detection	number	Optional	Parameter for Manage Scans
sensor_ml_level_prevention	number	Optional	Parameter for Manage Scans
cloud_ml_level_detection	number	Optional	Parameter for Manage Scans
cloud_ml_level_prevention	number	Optional	Parameter for Manage Scans
max_duration	number	Optional	Parameter for Manage Scans

Input Example

{"json_body":{"hosts":["49d80845335940c888b88bbaa632bd7e"],"host_groups":[""],"file_paths":["C:\\WINDOWS\\Explorer.EXE"],"scan_exclusions":[""],"initiated_from":"falcon_adhoc","cpu_priority":1,"description":"test APIS ","quarantine":true,"endpoint_notification":true,"pause_duration":2,"sensor_ml_level_detection":2,"sensor_ml_level_prevention":2,"cloud_ml_level_detection":2,"cloud_ml_level_prevention":2,"max_duration":2}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.writes	object	Output field: meta.writes
meta.writes.resources_affected	number	Output field: meta.writes.resources_affected
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
resources.id	string	Unique identifier
resources.cid	string	Unique identifier
resources.profile_id	string	Unique identifier
resources.description	string	Output field: resources.description
resources.file_paths	array	Output field: resources.file_paths
resources.initiated_from	string	Output field: resources.initiated_from
resources.quarantine	boolean	Output field: resources.quarantine
resources.cpu_priority	number	Output field: resources.cpu_priority
resources.preemption_priority	number	Output field: resources.preemption_priority
resources.metadata	array	Response data
resources.metadata.host_id	string	Response data
resources.metadata.scan_host_metadata_id	string	Response data
resources.metadata.filecount	object	Response data
resources.metadata.last_updated	string	Response data
resources.filecount	object	Count value
resources.status	string	Status value

Output Example

Perform Device Action

Execute a specified action on multiple devices in CrowdStrike Falcon using their IDs and the chosen action name.

Endpoint

URL: devices/entities/devices-actions/v2

Method: POST

Input

Argument Name	Type	Required	Description
parameters.action_name	string	Required	Parameters for the Perform Device Action action
action_parameters	array	Optional	Parameters for the Perform Device Action action
action_parameters.name	string	Optional	Parameters for the Perform Device Action action
action_parameters.value	string	Optional	Parameters for the Perform Device Action action
ids	array	Optional	Unique identifier

Input Example

{"parameters":{"action_name":"unhide_host"},"json_body":{"action_parameters":[{"name":"name","value":"value"}],"ids":["985a4275d7ae4e34be339c68d43cc81a"]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
resources.id	string	Unique identifier
resources.path	string	Output field: resources.path
errors	array	Error message if any
errors.file_name	string	Name of the resource
errors.file	string	Error message if any

Output Example

{"status_code":202,"response_headers":{"Server":"nginx","Date":"Thu, 20 Oct 2022 15:41:32 GMT","Content-Type":"application/json","Content-Length":"214","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"9a624a54-733b-41cd-9fae-fce985b7ea10","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5994"},"reason":"Accepted","json_body":{"meta":{"query_time":14.05...

Perform Incident Action

Execute specified actions on multiple incidents in CrowdStrike Falcon using provided 'ids' and 'action_parameters'.

Endpoint

URL: incidents/entities/incident-actions/v1

Method: POST

Input

Argument Name	Type	Required	Description
ids	array	Optional	Unique identifier
action_parameters	array	Optional	Parameters for the Perform Incident Action action
action_parameters.name	string	Required	Parameters for the Perform Incident Action action
action_parameters.value	string	Required	Parameters for the Perform Incident Action action

Input Example

{"json_body":{"ids":["inc:4e400866e4d8462a9d1824eb52ca2516:50e5a788a8b14ca4ad23aa909bd16efb"],"action_parameters":[{"name":"update_name","value":"Renamed incident"}]}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
resources.file_name	string	Name of the resource
resources.file	string	Output field: resources.file
errors	array	Error message if any
errors.file_name	string	Name of the resource
errors.file	string	Error message if any

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 20 Oct 2022 15:55:00 GMT","Content-Type":"application/json","Content-Length":"160","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"eede97f3-8a60-476a-934d-d4051d4f4a37","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.063349771...

Query Behaviors

Retrieve CrowdStrike Falcon behaviors using an FQL filter with sorting and paging options.

Endpoint

URL: /incidents/queries/behaviors/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.filter	string	Optional	Optional filter and sort criteria in the form of an FQL query.
parameters.offset	number	Optional	Starting index of overall result set from which to return ids.
parameters.limit	number	Optional	The maximum records to return. [1-500]
parameters.sort	string	Optional	The property to sort on, followed by a dot (.), followed by the sort direction, either "asc" or "desc".

Input Example

{"parameters":{"filter":"filepath: test","offset":0,"limit":100,"sort":"alert_ids.asc"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.pagination	object	Output field: meta.pagination
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
resources.file_name	string	Name of the resource
resources.file	string	Output field: resources.file
errors	array	Error message if any
errors.file_name	string	Name of the resource
errors.file	string	Error message if any

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 22 Jul 2025 08:38:10 GMT","Content-Type":"application/json","Content-Length":"198","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"98aa8db9-a69d-4b87-907a-2393919c8f11","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5951"},"reason":"OK","json_body":{"meta":{"query_time":0.015020273...

Query Host by Indicator

Locate hosts in CrowdStrike Falcon that have observed a specified custom Indicator of Compromise (IOC) using type and value parameters.

Endpoint

URL: /indicators/queries/devices/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.type	string	Required	Parameters for the Query Host by Indicator action
parameters.value	string	Required	Parameters for the Query Host by Indicator action
parameters.limit	string	Optional	Parameters for the Query Host by Indicator action
parameters.offset	string	Optional	Parameters for the Query Host by Indicator action

Input Example

{"parameters":{"type":"domain","value":"swimlane.com","limit":"10","offset":"0"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.pagination	object	Output field: meta.pagination
meta.pagination.offset	string	Output field: meta.pagination.offset
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.trace_id	string	Unique identifier
meta.entity	string	Output field: meta.entity
resources	array	Output field: resources
errors	array	Error message if any
errors.file_name	string	Name of the resource
errors.file	string	Error message if any

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Fri, 21 Oct 2022 20:45:11 GMT","Content-Type":"application/json","Content-Length":"228","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"0e57fcdc-6e9e-4cd3-b493-b6fde9f7a66f","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.035884016...

Query Scheduled Reports

Retrieve a list of report IDs from CrowdStrike Falcon based on specified query and filter criteria.

Endpoint

URL: /reports/queries/scheduled-reports/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.sort	string	Optional	Possible order by fields created_on, last_updated_on, last_execution_on, next_execution_on.
parameters.filter	string	Optional	FQL query specifying the filter parameters. Filter term criteria - type, trigger_reference, recipients, user_uuid, cid, trigger_params.metadata. Filter range criteria - created_on, modified_on; use any common date format, such as '2010-05-15T14:55:21.892315096Z'.
parameters.q	string	Optional	Match query criteria, which includes all the filter string fields.
parameters.offset	string	Optional	Starting index of overall result set from which to return IDs.
parameters.limit	number	Optional	Number of IDs to return.

Input Example

{"parameters":{"sort":"created_on","filter":"trigger_reference","q":"","offset":"","limit":3}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.pagination	object	Output field: meta.pagination
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
meta.writes	object	Output field: meta.writes
meta.writes.resources_affected	number	Output field: meta.writes.resources_affected
resources	array	Output field: resources
errors	array	Error message if any
errors.code	number	Error message if any
errors.id	string	Unique identifier
errors.message	string	Response message

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 16 Jan 2025 10:40:08 GMT","Content-Type":"application/json","Content-Length":"245","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"2bd55126-bb08-44d4-905f-450da0f88a47","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5998"},"reason":"OK","json_body":{"meta":{"query_time":0.030274587...

Retrieve Scans by ID.

Retrieve detailed information for specific scans in CrowdStrike Falcon using their unique identifiers. Requires 'ids' as input parameter.

Endpoint

URL: /ods/entities/scans/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.ids	string	Required	Parameters for the Retrieve Scans by ID. action

Input Example

{"parameters":{"ids":"a69fbc6555704446a10314b70d19955c"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.writes	object	Output field: meta.writes
meta.writes.resources_affected	number	Output field: meta.writes.resources_affected
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
resources.id	string	Unique identifier
resources.cid	string	Unique identifier
resources.profile_id	string	Unique identifier
resources.description	string	Output field: resources.description
resources.file_paths	array	Output field: resources.file_paths
resources.initiated_from	string	Output field: resources.initiated_from
resources.quarantine	boolean	Output field: resources.quarantine
resources.cpu_priority	number	Output field: resources.cpu_priority
resources.preemption_priority	number	Output field: resources.preemption_priority
resources.metadata	array	Response data
resources.metadata.host_id	string	Response data
resources.metadata.host_scan_id	string	Response data
resources.metadata.scan_host_metadata_id	string	Response data
resources.metadata.filecount	object	Response data
resources.metadata.filecount.scanned	number	Response data
resources.metadata.filecount.malicious	number	Response data

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 07 Nov 2023 16:30:27 GMT","Content-Type":"application/json","Content-Length":"1018","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"15c0882f-1bf6-4529-8cbd-cf81c12e4dc9","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.02398445...

RTR CMD Result

Retrieve results of a Real Time Response command in CrowdStrike Falcon using cloud_request_id and sequence_id.

Endpoint

URL: /real-time-response/entities/admin-command/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.cloud_request_id	string	Required	Parameters for the RTR CMD Result action
parameters.sequence_id	number	Required	Parameters for the RTR CMD Result action

Input Example

{"parameters":{"cloud_request_id":"505891fe-2b81-4531-baf0-d4bfc8d38107","sequence_id":0}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
resources.session_id	string	Unique identifier
resources.task_id	string	Unique identifier
resources.complete	boolean	Output field: resources.complete
resources.stdout	string	Output field: resources.stdout
resources.stderr	string	Output field: resources.stderr
resources.base_command	string	Output field: resources.base_command
errors	array	Error message if any
errors.file_name	string	Name of the resource
errors.file	string	Error message if any

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 20 Oct 2022 18:34:29 GMT","Content-Type":"application/json","Content-Length":"875","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"7357b311-85cd-4d26-abdd-8e57e16f3dfb","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5995","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"reason":"OK","json_body":{"meta":{"query_time":0.321708212,"powered_by":"empower-api","trace_id...

Search Reports

Locate and filter CrowdStrike Falcon report IDs by using a query with specific parameters to refine search results.

Endpoint

URL: reports/queries/scheduled-reports/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.q	string	Optional	Parameters for the Search Reports action
parameters.filter	string	Optional	Parameters for the Search Reports action
parameters.sort	string	Optional	Parameters for the Search Reports action
parameters.offset	string	Optional	Parameters for the Search Reports action
parameters.limit	number	Optional	Parameters for the Search Reports action

Input Example

{"parameters":{"q":"match query criteria","filter":"created_on:2010-05-15T14:55:21.892315096Z","sort":"created_on","offset":"0","limit":100}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}

Submit File Analysis

Upload a file to CrowdStrike Falcon for sandbox analysis, specifying the environment using the 'sandbox' parameter.

Endpoint

URL: falconx/entities/submissions/v1

Method: POST

Input

Argument Name	Type	Required	Description
sandbox	array	Optional	Parameter for Submit File Analysis
sandbox.action_script	string	Optional	Parameter for Submit File Analysis
sandbox.command_line	string	Optional	Parameter for Submit File Analysis
sandbox.document_password	string	Optional	Parameter for Submit File Analysis
sandbox.enable_tor	boolean	Optional	Parameter for Submit File Analysis
sandbox.environment_id	number	Required	Unique identifier
sandbox.network_settings	string	Optional	Parameter for Submit File Analysis
sandbox.sha256	string	Optional	Parameter for Submit File Analysis
sandbox.submit_name	string	Optional	Name of the resource
sandbox.system_date	string	Optional	Date value
sandbox.system_time	string	Optional	Time value
sandbox.url	string	Optional	URL endpoint for the request
send_email_notification	boolean	Optional	Parameter for Submit File Analysis
user_tags	array	Optional	Parameter for Submit File Analysis

Input Example

{"sandbox":[{"action_script":"string","command_line":"string","document_password":"string","enable_tor":true,"environment_id":123,"network_settings":"string","sha256":"string","submit_name":"Example Name","system_date":"string","system_time":"string","url":"https://example.com/api/resource"}],"send_email_notification":true,"user_tags":["string"]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase

Output Example

{}

Update Detection

Update specified detections in CrowdStrike Falcon using a list of detection IDs provided in the JSON body.

Endpoint

URL: detects/entities/detects/v2

Method: PATCH

Input

Argument Name	Type	Required	Description
assigned_to_uuid	string	Optional	Unique identifier
comment	string	Optional	Parameter for Update Detection
ids	array	Optional	Unique identifier
show_in_ui	boolean	Optional	Parameter for Update Detection
status	string	Optional	Status value

Input Example

{"json_body":{"assigned_to_uuid":"1234567891234567891","comment":"comment string","ids":["ldt:4e400866e4d8462a9d1824eb52ca2516:64431642420"],"show_in_ui":true,"status":"new"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.writes	object	Output field: meta.writes
meta.writes.resources_affected	number	Output field: meta.writes.resources_affected
meta.powered_by	string	Output field: meta.powered_by
meta.trace_id	string	Unique identifier

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Fri, 21 Oct 2022 16:56:04 GMT","Content-Type":"application/json","Content-Length":"165","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"c72a8e5b-d928-415f-9573-e88a469d075d","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5994"},"reason":"OK","json_body":{"meta":{"query_time":0.047651067...

Upload File Analysis

Upload a file to CrowdStrike Falcon for sandbox analysis, requiring form data and data body inputs.

Endpoint

URL: samples/entities/samples/v2

Method: POST

Input

Argument Name	Type	Required	Description
form_data	object	Required	Response data
form_data.sample	array	Required	Content of the uploaded sample in binary format.
form_data.sample.file_name	string	Required	Response data
form_data.sample.file	string	Required	Response data
data_body	object	Required	Response data
data_body.file_name	string	Required	Name of the file.
data_body.is_confidential	boolean	Optional	Defines visibility of this file in Falcon MalQuery, either via the API or the Falcon console.
data_body.comment	string	Optional	A descriptive comment to identify the file for other users.

Input Example

{"form_data":{"sample":[{"file_name":"Example Name","file":"string"}]},"data_body":{"file_name":"Example Name","is_confidential":true,"comment":"string"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
errors	array	Error message if any
errors.code	number	Error message if any
errors.id	string	Unique identifier
errors.message	string	Response message
meta	object	Output field: meta
meta.pagination	object	Output field: meta.pagination
meta.pagination.limit	number	Output field: meta.pagination.limit
meta.pagination.offset	number	Output field: meta.pagination.offset
meta.pagination.total	number	Output field: meta.pagination.total
meta.powered_by	string	Output field: meta.powered_by
meta.query_time	number	Time value
meta.trace_id	string	Unique identifier
meta.writes	object	Output field: meta.writes
meta.writes.resources_affected	number	Output field: meta.writes.resources_affected
resources	array	Output field: resources

Output Example

{"status_code":200,"response_headers":{"Server":"nginx","Date":"Wed, 19 Oct 2022 19:53:29 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"1b07769e-66b4-41fb-a970-9d6a764206ac","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5995"},"reason":"OK","json_body":{"errors":[{}],"meta":{"pa...

Upload RTR Put File

Upload a new file to CrowdStrike Falcon for use with the Real Time Response 'put' command. This action requires an attachment.

Endpoint

URL: real-time-response/entities/put-files/v1

Method: POST

Input

Argument Name	Type	Required	Description
attachments	array	Required	Script to be uploaded
attachments.file	string	Optional	Parameter for Upload RTR Put File
attachments.description	string	Optional	Parameter for Upload RTR Put File
attachments.name	string	Optional	Name of the resource
attachments.comments_for_audit_log	string	Optional	Parameter for Upload RTR Put File

Input Example

{"attachments":[{"file":"string","description":"string","name":"Example Name","comments_for_audit_log":"string"}]}

Output

Parameter	Type	Description
data	object	Response data
data.meta	object	Response data
data.meta.query_time	number	Response data
data.meta.writes	object	Response data
data.meta.writes.resources_affected	number	Response data
data.meta.powered_by	string	Response data
data.meta.trace_id	string	Response data

Output Example

{"data":{"meta":{"query_time":0.858507743,"writes":{},"powered_by":"empower","trace_id":"348c03bc-24de-4a17-aa8f-b4a5a2a4cd73"}}}

Upload Script

Upload a new custom script to CrowdStrike Falcon for Real Time Response, requiring an attachment.

Endpoint

URL: /real-time-response/entities/scripts/v1

Method: POST

Input

Argument Name	Type	Required	Description
attachments	array	Required	Script to be uploaded
attachments.file	string	Optional	Parameter for Upload Script
attachments.description	string	Optional	Parameter for Upload Script
attachments.name	string	Optional	Name of the resource
attachments.comments_for_audit_log	string	Optional	Parameter for Upload Script
attachments.permission_type	string	Optional	Type of the resource
attachments.content	string	Optional	Response content
attachments.platform	array	Optional	Parameter for Upload Script

Input Example

{"attachments":[{"file":"string","description":"string","name":"Example Name","comments_for_audit_log":"string","permission_type":"string","content":"string","platform":["string"]}]}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
data	object	Response data
data.meta	object	Response data
data.meta.query_time	number	Response data
data.meta.writes	object	Response data
data.meta.writes.resources_affected	number	Response data
data.meta.powered_by	string	Response data
data.meta.trace_id	string	Response data

Output Example

{"status_code":200,"response_headers":{"Content-Type":"application/json","Content-Length":"192"},"data":{"meta":{"query_time":0.652933766,"writes":{},"powered_by":"empower","trace_id":"bf90adeb-8c5e-4c0a-928f-688d9c52a54b"}}}

Vertex Summary

Retrieve a summary of connected edges and vertex data from CrowdStrike Falcon for a specified vertex type and IDs.

Endpoint

URL: /threatgraph/combined/{{vertex_type}}/summary/v1

Method: GET

Input

Argument Name	Type	Required	Description
parameters.scope	string	Optional	Defines what scope you are querying for. For customer scope, use the value "customer". For device scope, use "device" (default).
parameters.ids	string	Required	This represents the identifier of the actual object you're looking for. These IDs should be treated as opaque identifiers and can be retrieved from other ThreatGraph calls. This parameter can be provided up to 100 times to retrieve details on multiple vertices.
path_parameters.vertex_type	string	Required	The vertex that you are looking for.

Input Example

{"parameters":{"ids":"mod:2d6c3ed75e024b317ccd855ce584ac01:1788db64ec645c3bd54a6645f956c28593545bcaa22ae4cd12546954a6911e53","scope":"device"},"path_parameters":{"vertex_type":"process"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.query_time	number	Time value
meta.trace_id	string	Unique identifier
resources	array	Output field: resources
resources.id	string	Unique identifier
resources.customer_id	string	Unique identifier
resources.scope	string	Output field: resources.scope
resources.device_id	string	Unique identifier
resources.vertex_type	string	Type of the resource
resources.object_id	string	Unique identifier
resources.timestamp	string	Output field: resources.timestamp
resources.properties	object	Output field: resources.properties
resources.properties.ActivePrivilegeEscalationCount	string	Count value
resources.properties.AsepWrittenCount	string	Count value
resources.properties.AuthenticationId	string	Unique identifier
resources.properties.BinaryExecutableWrittenCount	string	Count value
resources.properties.CommandLine	string	Output field: resources.properties.CommandLine
resources.properties.ConHostId	string	Unique identifier
resources.properties.ConfigBuild	string	Output field: resources.properties.ConfigBuild
resources.properties.DirectoryCreatedCount	string	Count value
resources.properties.DnsRequestCount	string	Count value
resources.properties.ExeAndServiceCount	string	Count value
resources.properties.ExecutableDeletedCount	string	Count value

Output Example

{"meta":{"query_time":123,"trace_id":"string"},"resources":[{"id":"12345678-1234-1234-1234-123456789abc","customer_id":"string","scope":"string","device_id":"string","vertex_type":"string","object_id":"string","timestamp":"2024-01-01T00:00:00Z","properties":{},"edges":{}}],"errors":[{"file_name":"Example Name","file":"string"}]}

Response Headers

Header	Description	Example
Connection	HTTP response header: Connection	keep-alive
Content-Encoding	HTTP response header: Content-Encoding	gzip
Content-Length	The length of the response body in bytes	273
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Tue, 22 Jul 2025 08:38:10 GMT
Server	Information about the software used by the origin server	nginx
Strict-Transport-Security	HTTP response header: Strict-Transport-Security	max-age=31536000; includeSubDomains
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
X-Content-Type-Options	HTTP response header: X-Content-Type-Options	nosniff
X-Cs-Region	HTTP response header: X-Cs-Region	us-1
X-Cs-Traceid	HTTP response header: X-Cs-Traceid	b353da90-67d7-49f1-8805-21d76bc45c72
X-Ratelimit-Limit	The number of requests allowed in the current rate limit window	6000
X-Ratelimit-Remaining	The number of requests remaining in the current rate limit window	5999