--- title: CrowdStrike Falcon V2 slug: connectors/crowdstrike-falcon-v2 docTags: createdAt: 2026-06-09T16:30:01.509Z --- CrowdStrike Falcon is a cloud-native endpoint security platform that provides advanced threat prevention, detection, and response capabilities through real-time telemetry and integrated threat intelligence. CrowdStrike Falcon is a leading cloud-native endpoint protection platform that delivers advanced threat detection, response, and intelligence across endpoints, workloads, and identities. The CrowdStrike Falcon V2 connector for Swimlane Turbine enables seamless integration with Falcon’s robust APIs, allowing users to automate incident response, threat intelligence enrichment, case management, and real-time endpoint actions—all without writing code. By leveraging this integration, security teams can orchestrate complex workflows, accelerate investigations, and respond to threats faster, while maintaining full visibility and control across their security operations. ### Limitations - None to date. ### Supported Versions - This CrowdStrike Falcon V2 connector is implemented based on the CrowdStrike Falcon SDK (pip package crowdstrike-falconpy 1.4.3). ### Additional Documents - [CrowdStrike Falcon Documentation](https://falcon.crowdstrike.com/support/documentation) - [CrowdStrike Falcon V2 Connector Documentation](https://docs.swimlane.com/connectors/crowdstrike-falcon-v2) ## Configuration ### Prerequisites To use the CrowdStrike Falcon V2 connector, ensure you have the following prerequisites in place: - OAuth 2.0 Client Credentials authentication configured, which requires: - URL: The base URL for your CrowdStrike Falcon API instance. - Client ID: The unique identifier for your CrowdStrike Falcon API client application. - Client Secret: The secret key associated with your API client, used for secure authentication. ## Authentication Methods - URL: The base URL for accessing the CrowdStrike Falcon API. - Client ID: The client identifier for authenticating API requests. - Client Secret: The secret key associated with the client ID for secure authentication. ## Capabilities This CrowdStrike Falcon V2 connector provides the following capabilities: **Alerts** - Get Alert Details - Get Query Alerts - Post Aggregate Alerts - Query Alerts - Update Alerts By ID **Detections** - Get Detections Summaries **Falcon Sandbox** - Get File Analysis - Get Reports - Query Reports - Query Submissions - Submit File for Analysis - Upload File for Analysis **Host** - Get Host Info - Lift Contained Endpoint - Perform Action - Search Host **Identity Protection** - Get Sensor Details - Query Identity Protection by GraphQL - Query Sensors **Incidents** - Get Behaviors - Get Incidents - Query CrowdScore **Indicators** - Create Indicator - Get Indicators - Get Process Details - Query Host by Indicator - Query Indicator - Query Indicator Entities - Update Indicator **Intelligence Indicator Graph** - Lookup Indicators - Search Indicators **Threat Intelligence (Actors)** - Get Threat Actor Details - Search Actors - Get MITRE ATT\&CK Techniques for Actor - Get Actor Attack/Report References - Get Threat Report (PDF) **MessageCenter** - Add Case Activity - Create a New Case - Download Case Attachment - Get Case Activity - Query Activities - Query Cases - Retrieve Activities for IDs - Retrieve Activities IDs for Case - Retrieve Aggregate Case Values - Retrieve Case IDs - Retrieve Message Center Cases - Upload an Attachment for Case **Notifications** - Get Notifications Detailed - Query Notifications - Update Notifications **Real Time Response (RTR)** - Create RTR Scripts - Delete RTR File - Delete RTR Put Files - Delete RTR Scripts - Delete RTR Session - Execute Admin RTR Command - Execute RTR Command - Get RTR Put Files - Get RTR Scripts - Init RTR Session - List All RTR Sessions - List RTR Falcon Scripts - List RTR Files - RTR Check Command Status - RTR Get Batch Get Cmd *... and so on* **Report Executions** - Download Report Execution - Get Report Executions **Scan** - Get Scans **SpotlightVulnerabilities** - List Host Vulnerabilities **Event Streams** - List Available Streams - Refresh Active Stream Session **ThreatGraph** - Get Edge Types - Get Edges - Get Ran On - Get Summary - Get Vertices **NGSIEM / LogScale** - Create Query Job - Get Query Job Results ### Get Alert Details - Retrieve detailed information for specified alerts in CrowdStrike Falcon V2 using alert IDs [Click Here](https://falconpy.io/Service-Collections/Alerts.html). ### Get Query Alerts - Retrieve alert IDs matching a specific query from CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Alerts.html). ### Post Aggregate Alerts - Retrieve aggregated alert data from CrowdStrike Falcon using a specified query [Click Here](https://falconpy.io/Service-Collections/Alerts.html). ### Query Alerts - Retrieve a list of alerts from CrowdStrike Falcon based on specified criteria [Click Here](https://falconpy.io/Service-Collections/Alerts.html). ### Update Alerts By ID - Update specific alerts in CrowdStrike Falcon V2 using unique identifiers [Click Here](https://falconpy.io/Service-Collections/Alerts.html). ### Get Detections Summaries - Retrieve summaries for specific detections in CrowdStrike Falcon using detection IDs [Click Here](https://falconpy.io/Service-Collections/Detects.html). ### Get File Analysis - Retrieve detailed analysis of files from CrowdStrike Falcon using provided file identifiers [Click Here](https://falconpy.io/Service-Collections/Falconx-Sandbox.html). ### Get Reports - Fetch threat intelligence reports from CrowdStrike Falcon using specified report IDs [Click Here](https://falconpy.io/Service-Collections/Falconx-Sandbox.html). ### Query Reports - Retrieve a list of reports from CrowdStrike Falcon based on specified criteria [Click Here](https://falconpy.io/Service-Collections/Falconx-Sandbox.html). ### Query Submissions - Retrieve detailed information on submissions, including status and results, from CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Falconx-Sandbox.html). ### Submit File for Analysis - Submit a file to CrowdStrike Falcon V2 for detailed analysis using SHA256, environment, and other parameters [Click Here](https://falconpy.io/Service-Collections/Falconx-Sandbox.html). ### Upload File for Analysis - Upload a file to CrowdStrike Falcon V2 for in-depth threat analysis [Click Here](https://falconpy.io/Service-Collections/Falconx-Sandbox.html). ### Get Host Info - Retrieve detailed information for specified hosts in CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Hosts.html). ### Lift Contained Endpoint - Remove containment from a specified host in your environment using CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Hosts.html). ### Perform Action - Execute specified actions like containment, lifting, deletion, or restoration on hosts in CrowdStrike Falcon [Click Here](https://falconpy.io/Service-Collections/Hosts.html). ### Search Host - Retrieve detailed host information from the CrowdStrike Falcon environment using filter criteria [Click Here](https://falconpy.io/Service-Collections/Hosts.html). ### Get Sensor Details - Retrieve detailed information for specified sensors in CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Identity-Protection.html). ### Query Identity Protection by GraphQL - Execute a GraphQL query in CrowdStrike Falcon V2 for identity protection data [Click Here](https://falconpy.io/Service-Collections/Identity-Protection.html). ### Query Sensors - Retrieve sensor details and status for endpoint monitoring within CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Identity-Protection.html). ### Get Behaviors - Retrieve detailed behavior records for specified IDs from CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Incidents.html). ### Get Incidents - Retrieve detailed information for specified incidents in CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Incidents.html). ### Query CrowdScore - Retrieve the CrowdScore for entities from CrowdStrike Falcon V2 to assess threat levels [Click Here](https://falconpy.io/Service-Collections/Incidents.html). ### Create Indicator - Create new threat indicators in CrowdStrike Falcon V2 using specified parameters [Click Here](https://falconpy.io/Service-Collections/IOC.html). ### Get Indicators - Retrieve detailed information on indicators of compromise from CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/IOC.html). ### Get Process Details - Retrieve detailed information for one or more running processes from CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/IOC.html). ### Query Host by Indicator - Retrieve host details linked to a specific indicator within CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/IOC.html). ### Query Indicator - Retrieve threat intelligence indicators from CrowdStrike Falcon using specified criteria [Click Here](https://falconpy.io/Service-Collections/IOC.html). ### Query Indicator Entities - Retrieve information on indicators within CrowdStrike Falcon V2 using filter criteria [Click Here](https://falconpy.io/Service-Collections/IOC.html). ### Update Indicator - Update an existing indicator in CrowdStrike Falcon with new intelligence data [Click Here](https://falconpy.io/Service-Collections/IOC.html). ### Add Case Activity - Add an activity to a case in CrowdStrike Falcon V2 using the case ID. ### Create a New Case - Create a new case in CrowdStrike Falcon V2 using details like content, title, and type. ### Download Case Attachment - Retrieve an attachment for a case in CrowdStrike Falcon V2 using the attachment ID. ### Get Case Activity - Retrieve specific case activities from CrowdStrike Falcon V2 using resource IDs. ### Query Activities - Retrieve a list of activity IDs linked to a case in CrowdStrike Falcon V2. ### Query Cases - Retrieve case IDs from CrowdStrike Falcon V2 that match specific filter criteria. ### Retrieve Activities for IDs - Retrieve activities for specified IDs in CrowdStrike Falcon V2. ### Retrieve Activities IDs for Case - Retrieve activity IDs for a specific case in CrowdStrike Falcon V2. ### Retrieve Aggregate Case Values - Retrieve aggregate case values in CrowdStrike Falcon V2 using filters. ### Retrieve Case IDs - Retrieve case IDs from CrowdStrike Falcon V2 based on filter criteria. ### Retrieve Message Center Cases - Retrieve message center cases in CrowdStrike Falcon V2 using specified criteria. ### Upload an Attachment for Case - Upload an attachment to a case in CrowdStrike Falcon V2 using specified parameters. ### Get Notifications Detailed - Retrieve detailed notifications from CrowdStrike Falcon V2 using specified IDs. ### Query Notifications - Retrieve notifications from CrowdStrike Falcon V2 using specified criteria. ### Update Notifications - Modify the status or assignee of multiple notifications in CrowdStrike Falcon V2. ### Create RTR Scripts - Initiate the creation of Real Time Response scripts in CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Real-Time-Response-Admin.html). ### Delete RTR File - Remove a specified Real Time Response file from CrowdStrike Falcon hosts [Click Here](https://falconpy.io/Service-Collections/Real-Time-Response.html). ### Delete RTR Put Files - Remove specified Real Time Response files from CrowdStrike Falcon using file IDs [Click Here](https://falconpy.io/Service-Collections/Real-Time-Response-Admin.html). ### Delete RTR Scripts - Remove specified Real Time Response scripts from CrowdStrike Falcon using script IDs [Click Here](https://falconpy.io/Service-Collections/Real-Time-Response-Admin.html). ### Delete RTR Session - End a specified Real Time Response session in CrowdStrike Falcon [Click Here](https://falconpy.io/Service-Collections/Real-Time-Response.html). ### Execute Admin RTR Command - Initiate a Real Time Response Admin command on a host in CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Real-Time-Response-Admin.html). ### Execute RTR Command - Initiate a Real Time Response command on a host within CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Real-Time-Response.html). ### Get RTR Put Files - Retrieve files placed on hosts during Real Time Response sessions [Click Here](https://falconpy.io/Service-Collections/Real-Time-Response-Admin.html). ### Get RTR Scripts - Retrieve specified Real Time Response (RTR) scripts from CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Real-Time-Response-Admin.html). ### Init RTR Session - Initiate a Real Time Response session in CrowdStrike Falcon using a device ID [Click Here](https://falconpy.io/Service-Collections/Real-Time-Response.html). ### List All RTR Sessions - Retrieve an overview of all active and historical Real Time Response sessions [Click Here](https://falconpy.io/Service-Collections/Real-Time-Response.html). ### List RTR Falcon Scripts - Retrieve a list of available Real Time Response scripts from CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Real-Time-Response-Admin.html). ### List RTR Files - Retrieve a list of files from Real Time Response sessions in CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Real-Time-Response.html). ### RTR Check Command Status - Get the status of an executed command on a single host using the cloud\_request\_id [Click Here](https://falconpy.io/Service-Collections/Real-Time-Response.html). ### RTR Get Batch Get Cmd - Retrieve the status and results of a specified batch get command in CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Real-Time-Response.html). ### RTR Post Batch Get Cmd - Execute a batch 'get' command to retrieve files from multiple hosts in CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Real-Time-Response.html). ### Download Report Execution - Retrieve execution details for specified report IDs in CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Report-Executions.html). ### Get Report Executions - Retrieve execution details for specified report IDs in CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Report-Executions.html). ### Get Scans - Obtain detailed results for specified scan IDs in CrowdStrike Falcon V2 [Click Here](https://falconpy.io/Service-Collections/Quick-Scan.html). ### List Host Vulnerabilities - Retrieve a list of host vulnerabilities from CrowdStrike Falcon V2. ### List Available Streams - Retrieve all event streams from the CrowdStrike Falcon V2 environment [Click Here](https://falconpy.io/Service-Collections/Event-Streams.html). ### Refresh Active Stream Session - Renew an active event stream session in CrowdStrike Falcon V2 to maintain connectivity [Click Here](https://falconpy.io/Service-Collections/Event-Streams.html). ### Get Edge Types - Obtain all available edge types from CrowdStrike Falcon V2 to enhance threat graph analysis. ### Get Edges - Retrieve edges for a specified vertex ID in CrowdStrike Falcon V2. ### Get Ran On - Retrieve instances of indicators like hashes, domains, and IPs observed on hosts in CrowdStrike Falcon V2. ### Get Summary - Retrieve a summary for a specified vertex type in CrowdStrike Falcon V2. ### Get Vertices - Retrieve metadata for a specific vertex type in CrowdStrike Falcon V2. ### Create Query Job - Initiate a CrowdStrike Falcon LogScale search by creating an asynchronous query job [Click Here](https://falconpy.io/Service-Collections/NGSIEM.html). ### Get Query Job Results - Poll the status and retrieve results for a previously created CrowdStrike Falcon LogScale query job [Click Here](https://falconpy.io/Service-Collections/NGSIEM.html). ### Lookup Indicators - Retrieve full threat intelligence from the CrowdStrike Falcon Intelligence Indicator Graph for specific hash, domain, IP, or URL values [Click Here](https://falconpy.io/Service-Collections/Intelligence-Indicator-Graph.html). ### Search Indicators - Search the CrowdStrike Falcon Intelligence Indicator Graph for indicators matching an FQL filter [Click Here](https://falconpy.io/Service-Collections/Intelligence-Indicator-Graph.html). ### Get Threat Actor Details - Retrieve the full CrowdStrike Falcon V2 adversary profile for one or more threat actors using their actor IDs [Click Here](https://falconpy.io/Service-Collections/Intel.html). ### Search Actors - Search CrowdStrike Falcon V2 threat actors matching an FQL filter [Click Here](https://falconpy.io/Service-Collections/Intel.html). ### Get MITRE ATT\&CK Techniques for Actor - Export the MITRE ATT\&CK tactics and techniques associated with a CrowdStrike Falcon V2 threat actor [Click Here](https://falconpy.io/Service-Collections/Intel.html). ### Get Actor Attack/Report References - Retrieve the CrowdStrike Falcon V2 report and observable IDs associated with a given threat actor and MITRE ATT\&CK techniques [Click Here](https://falconpy.io/Service-Collections/Intel.html). ### Get Threat Report (PDF) - Download a CrowdStrike Falcon V2 intelligence report as a PDF attachment using the report ID returned by indicator or actor results [Click Here](https://falconpy.io/Service-Collections/Intel.html). # Configurations ## CrowdStrike Falcon V2 Oauth 2.0 Client Credentials Authenticates using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------------- | --------------------------------------------------------------------------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | client\_id | The client ID | string | Required | | client\_secret | The client secret. | string | Required | | ignore\_http\_errors | Ignore HTTP errors. | boolean | Optional | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through Example - [http://myproxy:8888](http://myproxy:8888). | string | Optional | | https\_proxy | A proxy to route requests through Example - [https://myotherproxy:8080](https://myotherproxy:8080). | string | Optional | # Actions ## Add Case Activity Add a new activity entry to a specified case in CrowdStrike Falcon V2 using the case ID, content, activity type, and user UUID. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------------------------------------------- | | `content` | string | Optional | Case activity content. Used for the body key within the BODY payload. | | `case_id` | string | Optional | Case ID to attach the activity to. | | `type` | string | Optional | Case activity type. | | `user_uuid` | string | Optional | UUID of the user attached to the case activity. | ### Input Example `{"json_body":{"body":"test","case_id":"case_123","type":"test","user_uuid":"fed9b1c0-1234-5678-9101-abcdef123456"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `errors` | array | Error message if any | | `errors.code` | number | Error message if any | | `errors.id` | string | Unique identifier | | `errors.message` | string | Response message | | `meta` | object | Output field: meta | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.query_time` | number | Time value | | `meta.trace_id` | string | Unique identifier | | `meta.writes` | object | Output field: meta.writes | | `meta.writes.resources_affected` | number | Output field: meta.writes.resources\_affected | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"errors":[{}],"meta":{"pagination":{},"powered_by":"string","query_time":0,"trace_id":"string","writes":{}}}}` ## Create a new case Create a new case in CrowdStrike Falcon V2 by specifying content, detections, incidents, title, type, and user UUID. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ------------------------------------------------------------ | | `content` | string | Optional | Case content. Used for the body key within the BODY payload. | | `detections` | array | Optional | Detections of the case being created. | | `detections.id` | string | Required | ID of the detection being created. | | `detections.product` | string | Optional | Product of the detection being created. | | `detections.url` | string | Required | URL of the detection being created. | | `incidents` | array | Optional | Incidents of the case being created. | | `incidents.id` | string | Required | ID of the incident being created. | | `incidents.url` | string | Required | URL of the incident being created. | | `malware_submission_id` | string | Optional | Malware submission ID of the case being created. | | `recon_rule_type` | string | Optional | Recon rule type of the case being created. | | `title` | string | Optional | Title of the case being created. | | `type` | string | Optional | Type of the case being created. | | `user_uuid` | string | Optional | UUID of the user creating the case. | ### Input Example `{"json_body":{"content":"test","detections":[{"id":"123","product":"Threat Detection Platform","url":"https://example.com/detection/123"}],"incidents":[{"id":"456","url":"https://example.com/incident/456"}],"malware_submission_id":"789","recon_rule_type":"Rule Type A","title":"Test Activity","type":"Visualization","user_uuid":"fed9b1c0-1234-5678-9101-abcdef123456"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `errors` | array | Error message if any | | `errors.code` | number | Error message if any | | `errors.id` | string | Unique identifier | | `errors.message` | string | Response message | | `meta` | object | Output field: meta | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.query_time` | number | Time value | | `meta.trace_id` | string | Unique identifier | | `meta.writes` | object | Output field: meta.writes | | `meta.writes.resources_affected` | number | Output field: meta.writes.resources\_affected | | `resources` | array | Output field: resources | | `resources.id` | string | Unique identifier | | `resources.path` | string | Output field: resources.path | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"errors":[{}],"meta":{"pagination":{},"powered_by":"string","query_time":0,"trace_id":"string","writes":{}},"resources":[{}]}}` ## Create Indicator Add new threat indicators to CrowdStrike Falcon V2 by providing indicator details in the request body. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | ------------------------------------------------ | | `parameters.ignore_warnings` | boolean | Optional | Flag to indicate that warnings are ignored. | | `parameters.retrodetects` | boolean | Optional | Flag to indicate whether to submit retrodetects. | | `comment` | string | Optional | IOC comment. | | `indicators` | array | Optional | List of indicators to create. | | `indicators.action` | string | Optional | Default action for IOC. | | `indicators.applied_globally` | boolean | Optional | Flag indicating this IOC is applied globally. | | `indicators.description` | string | Optional | IOC description. | | `indicators.expiration` | string | Optional | UTC formatted date string. | | `indicators.host_groups` | array | Required | List of host groups this IOC applies to. | | `indicators.metadata` | object | Optional | Dictionary containing the filename for the IOC. | | `indicators.metadata.filename` | string | Optional | Filename to use for the metadata dictionary. | | `indicators.mobile_action` | string | Optional | Parameter for Create Indicator | | `indicators.platforms` | array | Required | Platforms this IOC impacts. | | `indicators.severity` | string | Optional | IOC severity. | | `indicators.source` | string | Optional | IOC source. | | `indicators.tags` | array | Optional | IOC tags. | | `indicators.type` | string | Required | IOC type. | | `indicators.value` | string | Required | String representation of the IOC. | ### Input Example `{"parameters":{"ignore_warnings":true,"retrodetects":true},"json_body":{"indicators":[{"host_groups":["ca420b7a19f148788572431948aafbcd"],"platforms":["mac","linux"],"type":"ipv4","value":"96.79.235.37"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.id` | string | Request body data | | `body.resources.type` | string | Request body data | | `body.resources.value` | string | Request body data | ### Output Example `{"status_code":201,"headers":{"Server":"nginx","Date":"Fri, 31 May 2024 06:47:49 GMT","Content-Type":"application/json","Content-Length":"469","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"0177c568-3429-4acb-a431-364e5b571afe","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5998"},"body":{"meta":{"query_time":0.336750823,"pagination":{},"powered_by...` ## Create Query Job Initiate an asynchronous search in CrowdStrike Falcon LogScale and receive a job ID for polling results. Requires queryString and start parameters in the JSON body. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------- | | `parameters.repository` | string | Optional | Name of the repository or view to search. Defaults to 'search-all' to search across all repositories. | | `queryString` | string | Optional | LogScale query syntax to execute against the repository. | | `start` | string | Optional | Search starting time range. Supports relative (e.g. '24h', '7d') or absolute (epoch milliseconds / ISO-8601) values. | | `end` | string | Optional | Search ending time range. Supports relative or absolute values. Defaults to 'now' when omitted. | | `isLive` | boolean | Optional | Flag indicating whether this is a live (streaming) search. | | `timezone` | string | Optional | Timezone applied to the search. | | `timezoneOffsetMinutes` | number | Optional | Timezone offset in minutes. | | `useIngestTime` | boolean | Optional | Flag indicating whether ingest time should be used instead of event time. | | `allowEventSkipping` | boolean | Optional | Flag indicating whether event skipping is allowed. | | `autobucketCount` | number | Optional | Number of events per bucket. | | `arguments` | object | Optional | Search arguments to pass to the query. | | `around` | object | Optional | Search proximity arguments. | ### Input Example `{"parameters":{"repository":"search-all"},"json_body":{"queryString":"#event_simpleName=DnsRequest | head(100)","start":"24h"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.id` | string | Job ID used to poll for query results. | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Thu, 11 Jun 2026 09:03:20 GMT","Content-Type":"application/json","Connection":"keep-alive","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"88c181db-510b-4386-a7e3-c8ccff94aca7","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"id":"5a4c8a3d-2c1f-4b7a-9b2e-3f8d1e2c4a5b"}}` ## Create RTR Scripts Initiate the creation of Real Time Response scripts in CrowdStrike Falcon V2 for immediate deployment to endpoints using a specified data body. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------- | | `data_body` | object | Required | Response data | | `data_body.comments_for_audit_log` | string | Optional | A descriptive comment for the audit log. | | `data_body.description` | string | Optional | File description. | | `data_body.name` | string | Optional | File name (if different than actual file name). | | `data_body.platform` | array | Optional | Platform for the script. Currently supports windows, mac, and linux. If no platform is provided, windows is assumed. | | `data_body.permission_type` | string | Required | Permissions for the custom-script. | | `data_body.content` | string | Optional | The text contents you want to use for the script. Takes place of a file upload. | | `files` | array | Optional | Parameter for Create RTR Scripts | | `files.file_name` | string | Required | Name of the resource | | `files.file` | string | Required | Parameter for Create RTR Scripts | ### Input Example `{"data_body":{"comments_for_audit_log":"sample audit","description":"sample desc","name":"sample_file","platform":["mac"],"permission_type":"public","content":"Inline file data"},"files":[{"file":"123-456-789","file_name":"test_file_2"}]}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.writes` | object | Request body data | | `body.meta.writes.resources_affected` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.id` | string | Request body data | | `body.resources.name` | string | Request body data | | `body.resources.description` | string | Request body data | | `body.resources.file_type` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Wed, 29 May 2024 11:22:55 GMT","Content-Type":"application/json","Content-Length":"160","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"e37ebaae-7daa-4da2-9c2c-b491369e1d78","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5998","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"body":{"meta":{"query_time":0.841638876,"writes":{},"powered_by":"empower-api","trace_id":"e37ebaae-7daa...` ## Delete RTR File Remove a specified Real Time Response file from CrowdStrike Falcon hosts by providing the required file IDs and session ID. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ----------------------------- | | `parameters.ids` | string | Required | RTR Session file ID (SHA256). | | `parameters.session_id` | string | Required | RTR Session ID. | ### Input Example `{"parameters":{"ids":"e9dbc600-1476-4d6b-855d-ee5e24064e5e","session_id":"96306856-91c0-4bd7-8672-2c0a03397a65"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `body` | object | Request body data | | `body.errors` | array | Request body data | | `body.errors.message` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.file_name` | string | Request body data | | `body.resources.file` | string | Request body data | ### Output Example `{"status_code":204,"headers":{},"body":{"errors":[{}],"resources":[]}}` ## Delete RTR Put Files Remove specified Real Time Response files from CrowdStrike Falcon by providing their unique IDs as parameters. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `parameters.ids` | array | Required | File IDs. | ### Input Example `{"parameters":{"ids":["ef9a3b83323611ee89bc0e02492fd4cf_6890622d3b88416f90879f7c3497ac1f"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.writes` | object | Request body data | | `body.meta.writes.resources_affected` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Mon, 27 May 2024 17:15:18 GMT","Content-Type":"application/json","Content-Length":"161","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"25446ed1-d0d4-4374-9281-c596387b6064","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"body":{"meta":{"query_time":0.969570258,"writes":{},"powered_by":"empower-api","trace_id":"25446ed1-d0d4...` ## Delete RTR Scripts Remove specified Real Time Response scripts from CrowdStrike Falcon V2 by providing one or more script IDs. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `parameters.ids` | array | Required | File IDs. | ### Input Example `{"parameters":{"ids":["ce4b7d781cdc11ef8b17b60ca7c6aaf0_fe41f2ee79c84d25bf3740369ea8bdb4"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.writes` | object | Request body data | | `body.meta.writes.resources_affected` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Tue, 28 May 2024 17:43:18 GMT","Content-Type":"application/json","Content-Length":"160","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"f33c1753-6451-4160-961b-c95d5110a1f0","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"body":{"meta":{"query_time":0.786009831,"writes":{},"powered_by":"empower-api","trace_id":"f33c1753-6451...` ## Delete RTR Session Terminate a specified Real Time Response session in CrowdStrike Falcon V2 using the provided session ID. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | --------------- | | `parameters.session_id` | string | Required | RTR Session ID. | ### Input Example `{"parameters":{"session_id":"e77dee0e-208c-4150-bc35-0ae1e177b0f7"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `body` | object | Request body data | | `body.errors` | array | Request body data | | `body.errors.message` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.file_name` | string | Request body data | | `body.resources.file` | string | Request body data | ### Output Example `{"status_code":204,"headers":{},"body":{"errors":[{}],"resources":[]}}` ## Download Case Attachment Retrieve a specific case attachment from CrowdStrike Falcon V2 using the provided attachment ID. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------------------- | | `parameters.id` | string | Required | Parameters for the Download Case Attachment action | ### Input Example `{"parameters":{"id":"1234567890"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `file` | array | Report chunks. | | `file.file` | string | Output field: file.file | | `file.file_name` | string | Name of the resource | ### Output Example `{"status_code":200,"body":{"meta":{"query_time":0.032564367,"powered_by":"reports","trace_id":"a8f42c6a-9965-4d85-939c-ab5a81a50e63"},"resources":[{}],"errors":[]}}` ## Download Report Execution Retrieve execution details for specified report IDs in CrowdStrike Falcon V2 using the 'ids' parameter. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------ | | `parameters.ids` | array | Required | The report\_execution ID to get details about. | | `chunksize` | number | Optional | The number of objects to have in each attachment | ### Input Example `{"parameters":{"ids":["5c53d6559c7244c897c862ba3149c548"]},"chunksize":["20"]}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `file` | array | Report chunks. | | `file.file` | string | Output field: file.file | | `file.file_name` | string | Name of the resource | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Tue, 28 May 2024 18:00:53 GMT","Content-Type":"application/json","Content-Length":"464","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"a8f42c6a-9965-4d85-939c-ab5a81a50e63","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.032564367,"powered_by":"reports","tra...` ## Execute Admin RTR Command Initiate a Real Time Response admin command on a specified host in CrowdStrike Falcon using base\_command, command\_string, and session\_id. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------------------------------------------ | | `base_command` | string | Optional | Read-only base command to perform. | | `command_string` | string | Optional | Full command line of the command to execute. | | `persist` | boolean | Optional | Flag indicating if this command should be executed when the host returns to service. | | `session_id` | string | Optional | RTR Session ID to execute the command against. | ### Input Example `{"json_body":{"base_command":"ls","command_string":"ls","persist":true,"session_id":"96306856-91c0-4bd7-8672-2c0a03397a65"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.session_id` | string | Request body data | | `body.resources.cloud_request_id` | string | Request body data | | `body.resources.queued_command_offline` | boolean | Request body data | | `body.errors` | array | Request body data | | `body.errors.file_name` | string | Request body data | | `body.errors.file` | string | Request body data | ### Output Example `{"status_code":201,"headers":{"Server":"nginx","Date":"Mon, 27 May 2024 05:39:07 GMT","Content-Type":"application/json","Content-Length":"261","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"ec8b5d53-770e-44c9-91e7-410e436f0860","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5998","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"body":{"meta":{"query_time":0.013513642,"powered_by":"empower-api","trace_id":"ec8b5d53-770e-44c9-91e7-4...` ## Execute RTR Command Initiate a Real Time Response command on a host in CrowdStrike Falcon V2 using the specified base command, command string, and session ID. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------------------------------------------ | | `base_command` | string | Optional | Read-only base command to perform. | | `command_string` | string | Optional | Full command line of the command to execute. | | `persist` | boolean | Optional | Flag indicating if this command should be executed when the host returns to service. | | `session_id` | string | Optional | RTR Session ID to execute the command against. | ### Input Example `{"json_body":{"base_command":"ls","command_string":"ls","persist":true,"session_id":"96306856-91c0-4bd7-8672-2c0a03397a65"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.session_id` | string | Request body data | | `body.resources.cloud_request_id` | string | Request body data | | `body.resources.queued_command_offline` | boolean | Request body data | | `body.errors` | array | Request body data | | `body.errors.file_name` | string | Request body data | | `body.errors.file` | string | Request body data | ### Output Example `{"status_code":201,"headers":{"Server":"nginx","Date":"Mon, 27 May 2024 05:39:07 GMT","Content-Type":"application/json","Content-Length":"261","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"ec8b5d53-770e-44c9-91e7-410e436f0860","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5998","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"body":{"meta":{"query_time":0.013513642,"powered_by":"empower-api","trace_id":"ec8b5d53-770e-44c9-91e7-4...` ## Get Actor Attack/Report References Retrieve report and observable IDs linked to a specified threat actor and MITRE ATT\&CK techniques in CrowdStrike Falcon V2 using provided actor IDs. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------------------------------------------------------- | | `ids` | array | Optional | The actor slug followed by the MITRE ATT\&CK technique IDs to retrieve references for. | ### Input Example `{"json_body":{"ids":["fancy-bear","T1110"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.id` | string | Request body data | | `body.resources.attacks` | array | Request body data | | `body.resources.attacks.id` | string | Request body data | | `body.resources.attacks.reports` | array | Request body data | | `body.resources.attacks.observables` | array | Request body data | | `body.errors` | array | Request body data | ### Output Example `{"status_code":200,"headers":{"Content-Type":"application/json","X-Cs-Region":"us-1","X-Cs-Traceid":"3145c559-d52e-425f-8a3f-798060f0be55","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.053341804,"powered_by":"intel-api","trace_id":"3145c559-d52e-425f-8a3f-798060f0be55"},"resources":[{}],"errors":[]}}` ## Get Alert Details Retrieve detailed information for specified alerts in CrowdStrike Falcon V2 using provided composite IDs. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ------------------------------------------------ | | `parameters.include_hidden` | boolean | Optional | Allows previously hidden alerts to be retrieved. | | `composite_ids` | array | Optional | ID(s) of the alerts to retrieve. | ### Input Example `{"parameters":{"include_hidden":true},"json_body":{"composite_ids":["9cee3cb8390040a986142632cff93a6f:ind:ccde88355e0a48fa9558daadb64861ea:26027824139-10303-1316112"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Transfer-Encoding` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.writes` | object | Request body data | | `body.meta.writes.resources_affected` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.agent_id` | string | Request body data | | `body.resources.aggregate_id` | string | Request body data | | `body.resources.alleged_filetype` | string | Request body data | | `body.resources.cid` | string | Request body data | ### Output Example `{"headers":{"Server":"string","Date":"2024-01-01T00:00:00Z","Content-Type":"string","Transfer-Encoding":"string","Connection":"string","Content-Encoding":"string","Strict-Transport-Security":"string","X-Cs-Region":"string","X-Cs-Traceid":"string","X-Ratelimit-Limit":"string","X-Ratelimit-Remaining":"string"},"body":{"meta":{"query_time":123,"writes":{},"powered_by":"string","trace_id":"string"},"resources":[{}],"errors":[{}]}}` ## Get Behaviors Retrieve detailed behavior records for specified IDs from CrowdStrike Falcon using a JSON body containing the 'ids' parameter. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------- | | `ids` | array | Optional | Behavior ID(s) to retrieve. | ### Input Example `{"json_body":{"ids":["ind:c4c4b501190c48089ab7ab7671233545:150544003011-5733-528144"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.behavior_id` | string | Request body data | | `body.resources.alert_ids` | array | Request body data | | `body.resources.cid` | string | Request body data | | `body.resources.aid` | string | Request body data | | `body.resources.pattern_id` | number | Request body data | | `body.resources.template_instance_id` | number | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Mon, 27 May 2024 07:48:54 GMT","Content-Type":"application/json","Content-Length":"894","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"92e99eb6-b1c1-430c-8f2a-6df85afb94c6","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.00887423,"powered_by":"incident-api",...` ## Get Case Activity Retrieve detailed activity logs for specific cases from CrowdStrike Falcon V2 using resource IDs. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------------- | | `ids` | array | Optional | The resource id to be used to fetch the activity for. | ### Input Example `{"ids":["fc-CS-1234569-123456789-11"]}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------------- | -------- | ---------------------------- | | `body` | object | Request body data | | `body.errors` | array | Request body data | | `body.errors.file_name` | string | Request body data | | `body.errors.file` | string | Request body data | | `body.meta` | object | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.body` | string | Request body data | | `body.resources.case_id` | string | Request body data | | `body.resources.cid` | string | Request body data | | `body.resources.created_by` | object | Request body data | | `body.resources.created_by.display_name` | string | Request body data | | `body.resources.created_by.first_name` | string | Request body data | | `body.resources.created_by.last_name` | string | Request body data | | `body.resources.created_by.uid` | string | Request body data | | `body.resources.created_by.uuid` | string | Request body data | | `body.resources.created_time` | string | Request body data | | `body.resources.id` | string | Request body data | | `body.resources.type` | string | Request body data | | `headers` | object | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | ### Output Example `{"body":{"errors":[],"meta":{"powered_by":"message-center","query_time":0.061716984,"trace_id":"trace-id"},"resources":[{}]},"headers":{"Connection":"keep-alive","Content-Encoding":"gzip","Content-Length":"327","Content-Type":"application/json","Date":"Thu, 29 Jan 2026 23:53:23 GMT","Server":"nginx","Strict-Transport-Security":"max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains","Vary":"Origin","X-Cs-Region":"us-2","X-Cs-Traceid":"trace-id","X-Ratelimit-Limit":"6000","X-Rat...` ## Get Detections Summaries Retrieve concise summaries for specified detections in CrowdStrike Falcon V2 using provided detection IDs. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------ | | `ids` | array | Optional | ID(s) of the detections to retrieve. | ### Input Example `{"json_body":{"ids":["ldt:c4c4b501190c48089ab7ab7671233545:81605197317"]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.cid` | string | Request body data | | `body.resources.created_timestamp` | string | Request body data | | `body.resources.detection_id` | string | Request body data | | `body.resources.device` | object | Request body data | | `body.resources.device.device_id` | string | Request body data | | `body.resources.device.cid` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Fri, 24 May 2024 19:13:06 GMT","Content-Type":"application/json","Content-Length":"1877","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"eb80164d-f5f8-4462-bed0-f4c7e849a2de","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.002821487,"powered_by":"legacy-detec...` ## Get Edge Types Retrieve all available edge types from CrowdStrike Falcon V2 to support enhanced incident analysis and response workflows. ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Get Edges Retrieve edges associated with a specified vertex ID in CrowdStrike Falcon V2 by providing at least one edge type parameter. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ---------------------------------------------------------- | | `parameters.ids` | string | Optional | Vertex ID to get details for. Only one value is supported. | | `parameters.limit` | number | Optional | How many edges to return in a single request \[1-100]. | | `parameters.offset` | string | Optional | The offset to use to retrieve the next page of results. | | `parameters.edge_type` | string | Optional | The type of edges that you would like to retrieve. | | `parameters.direction` | string | Optional | The direction of edges that you would like to retrieve. | | `parameters.scope` | string | Optional | Scope of the request. | | `parameters.nano` | boolean | Optional | Return nano-precision entity timestamps. | ### Input Example `{"parameters":{"ids":"string","limit":123,"offset":"string","edge_type":"string","direction":"string","scope":"string","nano":true}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Get File Analysis Retrieve comprehensive file analysis reports from CrowdStrike Falcon V2 using specified file IDs as parameters. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------- | | `parameters.ids` | array | Required | ID of a submitted malware sample. | ### Input Example `{"parameters":{"ids":["9cee3cb8390040a986142632cff93a6f_39def1af7703496bafacbf47ffa458fe"]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.meta.quota` | object | Request body data | | `body.meta.quota.total` | number | Request body data | | `body.meta.quota.used` | number | Request body data | | `body.meta.quota.in_progress` | number | Request body data | | `body.resources` | array | Request body data | | `body.resources.id` | string | Request body data | | `body.resources.cid` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Thu, 30 May 2024 09:36:05 GMT","Content-Type":"application/json","Content-Length":"427","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"52257afe-cfa3-4a54-8b56-86f9f360ec9f","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.010101636,"powered_by":"falconx-api",...` ## Get Host Info Retrieve detailed information for specified hosts in CrowdStrike Falcon using their unique IDs. Requires the 'ids' parameter to identify the hosts. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------- | | `parameters.ids` | array | Required | The host agent ID's used to get details on. | ### Input Example `{"parameters":{"ids":["ccde88355e0a48fa9558daadb64861ea"]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.device_id` | string | Request body data | | `body.resources.cid` | string | Request body data | | `body.resources.agent_load_flags` | string | Request body data | | `body.resources.agent_local_time` | string | Request body data | | `body.resources.agent_version` | string | Request body data | | `body.resources.bios_manufacturer` | string | Request body data | ### Output Example `{"headers":{"Server":"string","Date":"2024-01-01T00:00:00Z","Content-Type":"string","Content-Length":"string","Connection":"string","Content-Encoding":"string","Strict-Transport-Security":"string","X-Cs-Region":"string","X-Cs-Traceid":"string","X-Ratelimit-Limit":"string","X-Ratelimit-Remaining":"string"},"body":{"meta":{"query_time":123,"powered_by":"string","trace_id":"string"},"resources":[{}],"errors":[{}]}}` ## Get Incidents Retrieve detailed information for specified incidents in CrowdStrike Falcon V2 using provided incident IDs. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------- | | `ids` | array | Optional | Incident ID(s) to retrieve. | ### Input Example `{"json_body":{"ids":["inc:2ec86c41c8524a4b86a0f675e919857f:0d03844fc2cc448eb37f8b8476fb2c95"]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.incident_id` | string | Request body data | | `body.resources.incident_type` | number | Request body data | | `body.resources.cid` | string | Request body data | | `body.resources.host_ids` | array | Request body data | | `body.resources.hosts` | array | Request body data | | `body.resources.hosts.device_id` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Mon, 27 May 2024 07:33:12 GMT","Content-Type":"application/json","Content-Length":"960","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"9cec3c3b-bff9-41b5-9b59-86fa593f6df1","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.004143106,"powered_by":"incident-api"...` ## Get Indicators Retrieve detailed information about indicators of compromise from CrowdStrike Falcon V2 using specified indicator IDs. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------- | | `parameters.ids` | array | Required | The IDs of the Indicators to retrieve. | ### Input Example `{"parameters":{"ids":["48e23334c3854063dd96f8dd863b0f98046d35a8dbf0cbe7a30b2eb41b47e31e"]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.id` | string | Request body data | | `body.resources.type` | string | Request body data | | `body.resources.value` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Thu, 30 May 2024 20:07:47 GMT","Content-Type":"application/json","Content-Length":"512","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"ed545c3a-c1e4-4ae5-afda-d729d167bb82","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.018581527,"pagination":{},"powered_by...` ## Get MITRE ATT\&CK Techniques for Actor Export the MITRE ATT\&CK tactics and techniques linked to a specified threat actor in CrowdStrike Falcon V2, returning results as JSON or CSV based on your selected format. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | -------------------------------------- | | `parameters.actor_id` | string | Required | Actor ID, derived from the actor name. | | `parameters.format` | string | Required | The report format to export. | ### Input Example `{"parameters":{"actor_id":"fancy-bear","format":"JSON"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | ----------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | The MITRE ATT\&CK report when the JSON format is requested. | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.actor_id` | string | Request body data | | `body.resources.tactic` | string | Request body data | | `body.resources.tactic_id` | string | Request body data | | `body.resources.technique` | string | Request body data | | `body.resources.technique_id` | string | Request body data | | `body.errors` | array | Request body data | | `file` | array | The MITRE ATT\&CK report when the CSV format is requested. | | `file.file` | string | Output field: file.file | | `file.file_name` | string | Name of the resource | ### Output Example `{"status_code":200,"headers":{"Content-Type":"application/json","X-Cs-Region":"us-1","X-Cs-Traceid":"3145c559-d52e-425f-8a3f-798060f0be55","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.093341804,"powered_by":"intel-api","trace_id":"3145c559-d52e-425f-8a3f-798060f0be55"},"resources":[{}],"errors":[]}}` ## Get Notifications Detailed Retrieve comprehensive notification details from CrowdStrike Falcon V2 using specified notification IDs and parameters. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------ | | `parameters.ids` | array | Optional | List of notification IDs to retrieve details for | ### Input Example `{"parameters":{"ids":["MjAyNi0wMS0wMVQwMDowMDowMFpfYWIzNTkzNzEtNjQ2MC0yYTI1LTk1MWItMmNiMjdjMTQzODkz"]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------- | -------- | ----------------- | | `body` | object | Request body data | | `body.errors` | array | Request body data | | `body.meta` | object | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.id` | string | Request body data | | `body.resources.notification` | object | Request body data | | `body.resources.notification.actor_slug` | string | Request body data | | `body.resources.notification.assigned_to_uuid` | string | Request body data | | `body.resources.notification.cid` | string | Request body data | | `body.resources.notification.created_date` | string | Request body data | | `body.resources.notification.highlights` | array | Request body data | | `body.resources.notification.id` | string | Request body data | | `body.resources.notification.item_date` | string | Request body data | | `body.resources.notification.item_id` | string | Request body data | | `body.resources.notification.item_type` | string | Request body data | | `body.resources.notification.raw_intel_id` | string | Request body data | | `body.resources.notification.rule_creator_name` | string | Request body data | | `body.resources.notification.rule_creator_uid` | string | Request body data | | `body.resources.notification.rule_creator_uuid` | string | Request body data | | `body.resources.notification.rule_id` | string | Request body data | | `body.resources.notification.rule_name` | string | Request body data | | `body.resources.notification.rule_priority` | string | Request body data | ### Output Example `{"body":{"errors":[],"meta":{"powered_by":"recon","query_time":0.033706956,"trace_id":"3765de52-7064-4358-bbd8-12ac89c311d2"},"resources":[{}]},"headers":{"Cache-Control":"no-cache, no-store, must-revalidate","Connection":"keep-alive","Content-Encoding":"gzip","Content-Length":"1073","Content-Type":"application/json","Date":"Thu, 08 Jan 2026 00:12:39 GMT","Expires":"0","Pragma":"no-cache","Server":"nginx","Strict-Transport-Security":"max-age=31536000; includeSubDomains, max-age=31536000; include...` ## Get Process Details Retrieve detailed information for one or more running processes in CrowdStrike Falcon using their process graph IDs. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------------------------------------------------------------------- | | `parameters.ids` | array | Required | The Process IDs (also referred to as process graph IDs) for the running processes to look up. | ### Input Example `{"parameters":{"ids":["pid:9cee3cb8390040a986142632cff93a6f:26027824139"]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.device_id` | string | The agent ID (AID) of the host the process ran on. | | `body.resources.process_id` | string | The CrowdStrike process graph ID. | | `body.resources.process_id_local` | string | The OS-local process identifier. | | `body.resources.command_line` | string | The command line used to launch the process. | | `body.resources.filename` | string | The path to the executable image. | | `body.resources.start_timestamp` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Mon, 15 Jun 2026 09:03:20 GMT","Content-Type":"application/json","Content-Length":"512","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"ed545c3a-c1e4-4ae5-afda-d729d167bb82","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.018581527,"powered_by":"msa-api","tra...` ## Get Queries Alerts Retrieve alert IDs from CrowdStrike Falcon V2 that match a specific query, enabling streamlined alert management without requiring additional parameters. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------- | | `parameters.filter` | string | Optional | Filter alerts using a query in Falcon Query Language (FQL) An asterisk wildcard \* includes all results. | | `parameters.limit` | number | Optional | The maximum number of alerts to return in this response. | | `parameters.offset` | number | Optional | The first alert to return, where 0 is the latest alert. Use with the limit parameter to manage pagination of results. | | `parameters.q` | string | Optional | Search all alert metadata for the provided string. | | `parameters.sort` | string | Optional | Sort alerts using the provided FQL filter. | | `parameters.include_hidden` | boolean | Optional | Allows previously hidden alerts to be retrieved. | ### Input Example `{"parameters":{"filter":"string1","limit":10,"offset":2,"q":"string","sort":"asc","include_hidden":true}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.offset` | number | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.writes` | object | Request body data | | `body.meta.writes.resources_affected` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Mon, 10 Jun 2024 10:09:58 GMT","Content-Type":"application/json","Content-Length":"498","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"c355acdd-5c61-4e72-821b-6219e3e8de7f","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.018427628,"pagination":{},"writes":{}...` ## Get Query Job Results Poll the status and retrieve results for a previously created CrowdStrike Falcon LogScale query job using its job ID. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ---------------------------------------------------------------------------------- | | `parameters.job_id` | string | Required | ID of the query job returned by Create Query Job. Used to poll for the result set. | | `parameters.repository` | string | Optional | Name of the repository or view that was searched. Defaults to 'search-all'. | ### Input Example `{"parameters":{"job_id":"5a4c8a3d-2c1f-4b7a-9b2e-3f8d1e2c4a5b","repository":"search-all"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | --------------------------------------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.done` | boolean | Whether the query has finished executing. Continue polling while this value is false. | | `body.cancelled` | boolean | Whether the query was cancelled before completion. | | `body.events` | array | The query result events. Each element is an event object whose shape depends on the LogScale query. | | `body.metaData` | object | Metadata about the query execution such as progress, counts, and timing. | | `body.metaData.eventCount` | number | Response data | | `body.metaData.extraData` | object | Response data | | `body.metaData.isAggregate` | boolean | Response data | | `body.metaData.poll_after` | number | Recommended delay (ms) before polling again. | | `body.metaData.processedBytes` | number | Response data | | `body.metaData.processedEvents` | number | Response data | | `body.metaData.queryStart` | number | Response data | | `body.metaData.queryEnd` | number | Response data | | `body.metaData.resultBufferSize` | number | Response data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Thu, 11 Jun 2026 09:05:00 GMT","Content-Type":"application/json","Connection":"keep-alive","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"88c181db-510b-4386-a7e3-c8ccff94aca7","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"done":true,"events":[{}],"metaData":{"eventCount":1,"extraData":{},"isAggregate":false,"poll_after":1000,"pr...` ## Get Ran On Retrieve instances of indicators such as hashes, domains, and IPs observed on devices within the CrowdStrike Falcon environment using specified parameters. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------------------- | | `parameters.value` | string | Optional | The value of the indicator to search by. | | `parameters.type` | string | Optional | The type of indicator that you would like to retrieve. | | `parameters.limit` | number | Optional | How many edges to return in a single request \[1-100]. | | `parameters.offset` | string | Optional | The offset to use to retrieve the next page of results. | | `parameters.nano` | boolean | Optional | Return nano-precision entity timestamps. | ### Input Example `{"parameters":{"value":"string","type":"string","limit":123,"offset":"string","nano":true}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Get Report Executions Retrieve execution details for specified report IDs in CrowdStrike Falcon V2 using the 'ids' parameter. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ---------------------------------------------- | | `parameters.ids` | array | Required | The report\_execution ID to get details about. | ### Input Example `{"parameters":{"ids":["5c53d6559c7244c897c862ba3149c548"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.id` | string | Request body data | | `body.resources.customer_id` | string | Request body data | | `body.resources.user_uuid` | string | Request body data | | `body.resources.user_id` | string | Request body data | | `body.resources.type` | string | Request body data | | `body.resources.scheduled_report_id` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Tue, 28 May 2024 18:00:53 GMT","Content-Type":"application/json","Content-Length":"464","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"a8f42c6a-9965-4d85-939c-ab5a81a50e63","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.032564367,"powered_by":"reports","tra...` ## Get Reports Retrieve threat intelligence reports from CrowdStrike Falcon V2 using specified report IDs for detailed analysis. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `parameters.ids` | array | Required | ID of a report. | ### Input Example `{"parameters":{"ids":["9cee3cb8390040a986142632cff93a6f_cc338bfdc9314f619f873c216a085472"]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Transfer-Encoding` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.meta.quota` | object | Request body data | | `body.meta.quota.total` | number | Request body data | | `body.meta.quota.used` | number | Request body data | | `body.meta.quota.in_progress` | number | Request body data | | `body.resources` | array | Request body data | | `body.resources.id` | string | Request body data | | `body.resources.cid` | string | Request body data | ### Output Example `{"headers":{"Server":"string","Date":"2024-01-01T00:00:00Z","Content-Type":"string","Transfer-Encoding":"string","Connection":"string","Content-Encoding":"string","Strict-Transport-Security":"string","X-Cs-Region":"string","X-Cs-Traceid":"string","X-Ratelimit-Limit":"string","X-Ratelimit-Remaining":"string"},"body":{"meta":{"query_time":123,"powered_by":"string","trace_id":"string","quota":{}},"resources":[{}],"errors":[{}]}}` ## Get RTR Put Files Retrieve files placed on hosts during Real Time Response sessions by specifying file IDs in CrowdStrike Falcon V2. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `parameters.ids` | array | Required | File IDs. | ### Input Example `{"parameters":{"ids":["ef9a3b83323611ee89bc0e02492fd4cf_6890622d3b88416f90879f7c3497ac1f"]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.id` | string | Request body data | | `body.resources.name` | string | Request body data | | `body.resources.file_type` | string | Request body data | | `body.resources.platform` | array | Request body data | | `body.resources.size` | number | Request body data | | `body.resources.created_by` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Mon, 27 May 2024 17:10:02 GMT","Content-Type":"application/json","Content-Length":"477","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"3acc8952-e34b-42c0-906d-92e1fbbd9863","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"body":{"meta":{"query_time":0.69794026,"powered_by":"empower-api","trace_id":"3acc8952-e34b-42c0-906d-92...` ## Get RTR Scripts Retrieve specified Real Time Response (RTR) scripts from CrowdStrike Falcon V2 using provided script IDs and return their details. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | | `parameters.ids` | array | Required | File IDs. | ### Input Example `{"parameters":{"ids":["d8367f494e9311ea97920662caec3daa_6890622d3b88416f90879f7c3497ac1f"]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.id` | string | Request body data | | `body.resources.name` | string | Request body data | | `body.resources.description` | string | Request body data | | `body.resources.file_type` | string | Request body data | | `body.resources.platform` | array | Request body data | | `body.resources.size` | number | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Tue, 28 May 2024 17:35:03 GMT","Content-Type":"application/json","Content-Length":"563","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"226cf254-2b1d-4e8f-a4b0-e76c41dfc0bd","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"body":{"meta":{"query_time":0.104620007,"powered_by":"empower-api","trace_id":"226cf254-2b1d-4e8f-a4b0-e...` ## Get Scans Obtain detailed results for specified scan IDs in CrowdStrike Falcon V2, providing insights into conducted scans. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------- | | `parameters.ids` | array | Required | ID of a submitted scan to retrieve. | ### Input Example `{"parameters":{"ids":["0edf67fa585bedac6db7571f9fe3a449a2d0a4d78529a8bfee4f845f00931f89"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `body` | object | Request body data | ### Output Example `{"status_code":200,"headers":{},"body":{}}` ## Get Sensor Details Retrieve detailed information for specified sensors in CrowdStrike Falcon V2 using provided sensor IDs. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------ | | `ids` | array | Optional | The host agent IDs used to get details on. | ### Input Example `{"json_body":{"ids":["fdc71309-8745-4c39-9c9b-859f171036bf"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `body` | object | Request body data | ### Output Example `{"status_code":200,"headers":{},"body":{}}` ## Get Summary Retrieve a summary for a specified vertex type in CrowdStrike Falcon V2 using the required 'vertex\_type' path parameter. ### Endpoint - **URL:** `/threatgraph/combined/{{vertex_type}}/summary/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | ---------------------------------------- | | `path_parameters.vertex_type` | string | Required | Type of vertex to get properties for. | | `parameters.ids` | array | Optional | Vertex ID to get details for. | | `parameters.scope` | string | Optional | Scope of the request | | `parameters.nano` | boolean | Optional | Return nano-precision entity timestamps. | ### Input Example `{"path_parameters":{"vertex_type":"string"},"parameters":{"ids":["string"],"scope":"string","nano":true}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Get Threat Actor Details Retrieve detailed adversary profiles for one or more threat actors in CrowdStrike Falcon V2 using their actor IDs. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `parameters.ids` | array | Required | The IDs of the actors to retrieve. | | `parameters.fields` | array | Optional | The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores, for example **full**. Defaults to **basic**. | ### Input Example `{"parameters":{"ids":["2871"],"fields":["__full__"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.id` | number | Request body data | | `body.resources.name` | string | Request body data | | `body.resources.slug` | string | Request body data | | `body.resources.short_description` | string | Request body data | | `body.resources.description` | string | Request body data | | `body.resources.url` | string | Request body data | | `body.resources.active` | boolean | Request body data | | `body.resources.created_date` | number | Request body data | | `body.resources.last_modified_date` | number | Request body data | | `body.resources.first_activity_date` | number | Request body data | | `body.resources.last_activity_date` | number | Request body data | | `body.resources.known_as` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Content-Type":"application/json","X-Cs-Region":"us-1","X-Cs-Traceid":"3145c559-d52e-425f-8a3f-798060f0be55","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.043341804,"powered_by":"intel-api","trace_id":"3145c559-d52e-425f-8a3f-798060f0be55"},"resources":[{}],"errors":[]}}` ## Get Threat Report (PDF) Download an intelligence report as a PDF attachment from CrowdStrike Falcon V2 using the report ID obtained from indicator or actor results. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------------------------------------------- | | `parameters.id` | string | Optional | The ID of the report to download as a PDF. | | `parameters.ids` | string | Optional | The ID of the report to download as a PDF. Used only when no ID parameter is given. | ### Input Example `{"parameters":{"id":"csa-260812"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Disposition` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `file` | array | The intelligence report PDF. | | `file.file` | string | Output field: file.file | | `file.file_name` | string | Name of the resource | ### Output Example `{"status_code":200,"headers":{"Content-Type":"application/pdf","Content-Disposition":"attachment; filename=\"csa-260812.pdf\"","X-Cs-Region":"us-1","X-Cs-Traceid":"3145c559-d52e-425f-8a3f-798060f0be55","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"}}` ## Get Vertices Retrieve metadata details for a specified vertex type in CrowdStrike Falcon V2 using the 'vertex\_type' path parameter. ### Endpoint - **URL:** `/threatgraph/entities/{{vertex_type}}/v2` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | ---------------------------------------- | | `path_parameters.vertex_type` | string | Required | Type of vertex to get properties for. | | `parameters.ids` | array | Optional | Vertex ID to get details for. | | `parameters.scope` | string | Optional | Scope of the request | | `parameters.nano` | boolean | Optional | Return nano-precision entity timestamps. | ### Input Example `{"path_parameters":{"vertex_type":"string"},"parameters":{"ids":["string"],"scope":"string","nano":true}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Init RTR Session Initiate a Real Time Response session on a specified device in CrowdStrike Falcon, with the option to queue the request if the device is offline. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ---------------------------------------------------------------------------------------- | | `device_id` | string | Optional | The host agent ID to refresh the RTR session on. | | `origin` | string | Optional | Origin of the request. | | `queue_offline` | boolean | Optional | Flag indicating if this should be queued to pulse after the host returns to service. | | `timeout` | number | Optional | Timeout for how long to wait for the request in seconds.Defaults to 30 with maximum 600. | | `timeout_duration` | string | Optional | Timeout duration for how long to wait for the request in duration syntax. | ### Input Example `{"json_body":{"device_id":"ccde88355e0a48fa9558daadb64861ea","queue_offline":true,"timeout":30,"timeout_duration":"s"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Transfer-Encoding` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.session_id` | string | Request body data | | `body.resources.scripts` | array | Request body data | | `body.resources.scripts.command` | string | Request body data | | `body.resources.scripts.description` | string | Request body data | | `body.resources.scripts.examples` | string | Request body data | | `body.resources.scripts.internal_only` | boolean | Request body data | ### Output Example `{"status_code":201,"headers":{"Server":"nginx","Date":"Sun, 26 May 2024 16:47:17 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"c18de5c7-28b6-4edb-a43a-696049e0fec4","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"body":{"meta":{"query_time":3.894993811,"powered_by":"empower-api","trace_id":"c18de5c7-28b6-4edb...` ## Lift Contained Endpoint Remove containment from specified hosts in your environment using CrowdStrike Falcon V2 by providing the required host IDs. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.action_name` | string | Optional | Action Name | | `ids` | array | Optional | The host agent ID (AID) of the host you want to impact. If you provide IDs to the method using this keyword, you do not have to provide a body payload. | ### Input Example `{"parameters":{"action_name":"contain"},"json_body":{"ids":["ccde88355e0a48fa9558daadb64861ea"]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.id` | string | Request body data | | `body.resources.path` | string | Request body data | | `body.errors` | array | Request body data | | `body.errors.file_name` | string | Request body data | | `body.errors.file` | string | Request body data | ### Output Example `{"status_code":202,"headers":{"Server":"nginx","Date":"Mon, 10 Jun 2024 09:21:46 GMT","Content-Type":"application/json","Content-Length":"216","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"012d36b3-bfe8-4563-a037-aa7db99ae68f","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5998"},"body":{"meta":{"query_time":0.313760617,"powered_by":"device-api","...` ## List All RTR Sessions Retrieve an overview of all active and historical Real Time Response sessions in CrowdStrike Falcon, including session details for monitoring and analysis. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | -------------------------------------------------------------- | | `parameters.limit` | number | Optional | Maximum number of records to return. Max - 5000. | | `parameters.offset` | number | Optional | Starting index of overall result set from which to return ids. | | `parameters.filter` | string | Optional | FQL query expression that should be used to limit the results. | | `parameters.sort` | string | Optional | The property to sort by. | ### Input Example `{"parameters":{"limit":10,"offset":0}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.offset` | number | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.errors` | array | Request body data | | `body.errors.file_name` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Sun, 26 May 2024 16:18:03 GMT","Content-Type":"application/json","Content-Length":"436","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"8a850895-10ba-443b-bf4f-e1b67358bf85","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"body":{"meta":{"query_time":0.065409959,"pagination":{},"powered_by":"empower-api","trace_id":"8a850895-...` ## List Available Streams Retrieve all available event streams from the CrowdStrike Falcon V2 environment using the specified app\_id. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------ | | `parameters.app_id` | string | Required | Label that identifies your connection. Maximum 32 alphanumeric characters (a-z, A-Z, 0-9). | | `parameters.format` | string | Optional | Format for streaming events. | ### Input Example `{"parameters":{"app_id":" ","format":"json"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Fri, 20 Sep 2024 08:04:38 GMT","Content-Type":"application/json","Content-Length":"215","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"2b13ff37-6ffc-40cb-8027-1b702cd13ccb","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"json_body":{}}` ## List Host Vulnerabilities Retrieve host vulnerability IDs from CrowdStrike Falcon V2 by applying an FQL filter to return matching results. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.after` | string | Optional | A pagination token used with the limit parameter to manage pagination of results. On your first request, don't provide an after token. | | `parameters.limit` | number | Optional | The number of items to return in this response. | | `parameters.sort` | string | Optional | Full query string parameters payload in JSON format. | | `parameters.filter` | string | Required | Sort vulnerabilities by their properties. | ### Input Example `{"parameters":{"after":"string","limit":10,"sort":"created_timestamp|desc","filter":"aid:'abcde6b9a3427d8c4a1af416424d6231'"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.X-Content-Type-Options` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.errors` | array | Request body data | | `body.errors.file_name` | string | Request body data | | `body.errors.file` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Mon, 10 Jun 2024 10:31:46 GMT","Content-Type":"application/json","Content-Length":"231","Connection":"keep-alive","X-Content-Type-Options":"nosniff","X-Cs-Traceid":"1a41eb4c-eb2e-4a10-a8e0-da0fd3322018","X-Ratelimit-Limit":"15","X-Ratelimit-Remaining":"14","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"body":{"meta":{"query_time":1.57e-07,"powered_by":"crowdstrike-api-gateway","trace_id":"1a41eb4c-eb2e-4a10-a8e0-da0fd332...` ## List RTR Falcon Scripts Retrieve a list of available Real Time Response scripts from CrowdStrike Falcon for execution on remote hosts. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------------------------- | | `parameters.filter` | string | Optional | Optional filter criteria in the form of an FQL query. | | `parameters.offset` | number | Optional | Starting index of overall result set from which to return ID's. | | `parameters.limit` | number | Optional | Number of ID's to return. | | `parameters.sort` | string | Optional | Sort by spec. Ex - 'created\_at | ### Input Example `{"parameters":{"offset":0,"limit":10}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.offset` | number | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.errors` | array | Request body data | | `body.errors.file_name` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Mon, 27 May 2024 06:19:58 GMT","Content-Type":"application/json","Content-Length":"397","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"0873f04c-1e64-48a5-9613-17d4f5bc1cdb","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"body":{"meta":{"query_time":0.003614303,"pagination":{},"powered_by":"empower-api","trace_id":"0873f04c-...` ## List RTR Files Retrieve a list of files from Real Time Response sessions in CrowdStrike Falcon V2 using the specified session ID. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | --------------- | | `parameters.session_id` | string | Required | RTR Session ID. | ### Input Example `{"parameters":{"session_id":"96306856-91c0-4bd7-8672-2c0a03397a65"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.errors` | array | Request body data | | `body.errors.file_name` | string | Request body data | | `body.errors.file` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Mon, 27 May 2024 05:27:36 GMT","Content-Type":"application/json","Content-Length":"158","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"51a5a683-e7b8-42a9-9bb7-9d0b5f77a3e5","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5998","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"body":{"meta":{"query_time":0.015268557,"powered_by":"empower-api","trace_id":"51a5a683-e7b8-42a9-9bb7-9...` ## Lookup Indicators Retrieve comprehensive threat intelligence for specified hashes, domains, IPs, or URLs from the CrowdStrike Falcon Intelligence Indicator Graph. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------- | | `values` | array | Optional | Indicator values to look up. Accepts SHA256, SHA1, and MD5 hashes, domains, IPv4 and IPv6 addresses, and URLs. | ### Input Example `{"json_body":{"values":["example.com","1.2.3.4","7391279b68dd9ae643125aef4af41b87a17fc8cea669a6ffa709c8470236e25a"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------- | -------- | ----------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.ID` | string | Request body data | | `body.resources.LookupValue` | string | The submitted value this indicator was matched against. | | `body.resources.Type` | string | Request body data | | `body.resources.MaliciousConfidence` | string | CrowdStrike confidence rating - high, medium, low, or unverified. | | `body.resources.MaliciousConfidenceValidatedTime` | string | Request body data | | `body.resources.PublishDate` | string | Request body data | | `body.resources.FirstSeen` | string | Request body data | | `body.resources.LastSeen` | string | Request body data | | `body.resources.LastUpdated` | string | Request body data | | `body.resources.AffectedCustomers` | string | Request body data | | `body.resources.KillChain` | array | Request body data | | `body.resources.Adversaries` | array | Adversary groups associated with this indicator. | ### Output Example `{"status_code":200,"headers":{"Content-Type":"application/json","X-Cs-Region":"us-1","X-Cs-Traceid":"3145c559-d52e-425f-8a3f-798060f0be55","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.113341804,"powered_by":"intelligence-indicator-graph","trace_id":"3145c559-d52e-425f-8a3f-798060f0be55"},"resources":[{}],"errors":[]}}` ## Perform Action Perform actions like containment, lifting, deletion, or restoration on specified hosts in CrowdStrike Falcon using the provided action name and host IDs. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.action_name` | string | Required | Specify one of the actions to perform the action. | | `ids` | array | Optional | The host agent ID (AID) of the host you want to impact. If you provide IDs to the method using this keyword, you do not have to provide a body payload. (Service class usage only) A maximum of 100 IDs may be provided to this keyword. | ### Input Example `{"parameters":{"action_name":"detection_suppress"},"json_body":{"ids":["20","100"]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.id` | string | Request body data | | `body.resources.path` | string | Request body data | | `body.errors` | array | Request body data | | `body.errors.file_name` | string | Request body data | | `body.errors.file` | string | Request body data | ### Output Example `{"status_code":202,"headers":{"Server":"nginx","Date":"Fri, 20 Sep 2024 08:16:47 GMT","Content-Type":"application/json","Content-Length":"217","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"35b0eb2c-1375-4f13-b902-03fe20a7943c","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5994"},"body":{"meta":{"query_time":0.469539059,"powered_by":"device-api","...` ## Post Aggregate Alerts Retrieve aggregated alert data from CrowdStrike Falcon V2 by filtering results based on the specified field parameter. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | | --------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | | `parameters.include_hidden` | boolean | Optional | Allows previously hidden alerts to be retrieved. | | | `date_ranges` | array | Optional | Applies to date\_range aggregations. List of date ranges for aggregation. | | | `date_ranges.from` | string | Required | Start date/time for the range. | | | `date_ranges.to` | string | Required | End date/time for the range. | | | `exclude` | string | Optional | Elements to exclude. | | | `field` | string | Optional | The field on which to compute the aggregation. | | | `filter` | string | Optional | FQL syntax formatted string to use to filter the results. | | | `from` | number | Optional | Starting position. | | | `include` | string | Optional | Elements to include. | | | `interval` | string | Optional | Time interval for date histogram aggregations. Required for date\_histogram type. | | | `max_doc_count` | number | Optional | Only return buckets if values are less than or equal to the value here. | | | `min_doc_count` | number | Optional | Only return buckets if values are greater than or equal to the value here. | | | `missing` | string | Optional | Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value. | | | `name` | string | Optional | Name of the aggregate query, as chosen by the user. Used to identify the results returned to you. | | | `q` | string | Optional | Full text search across all metadata fields. | | | `ranges` | array | Optional | Applies to range aggregations. Ranges values will depend on field. For example, if max\_severity is used, ranges might look like ranges with From and To values. | | | `ranges.From` | number | Optional | Starting value for the range. | | | `ranges.To` | number | Optional | Ending value for the range. | | | `size` | number | Optional | The max number of term buckets to be returned. | | | `sort` | string | Optional | FQL syntax string to sort bucket results. \_count - sort by document count, \_term - sort by the string value alphabetically. Supports asc and desc using | format. | | `sub_aggregates` | array | Optional | A nested aggregation. There is a maximum of 3 nested aggregations per request. | | | `sub_aggregates.name` | string | Required | Name for the sub-aggregate. | | | `sub_aggregates.type` | string | Required | Type of sub-aggregation. | | | `sub_aggregates.field` | string | Required | Field to aggregate on. | | | `time_zone` | string | Optional | Time zone for bucket results. | | ### Input Example `{"parameters":{"include_hidden":false},"json_body":{"date_ranges":[{"from":"2024-01-01T00:00:00Z","to":"2024-01-31T23:59:59Z"}],"field":"severity","filter":"status:'new'","type":"terms"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | ------------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Transfer-Encoding` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.value` | string | The aggregated field value. | | `body.resources.count` | number | The count of alerts for this value. | | `body.resources.sub_aggregates` | array | Sub-aggregation results if specified. | | `body.resources.sub_aggregates.value` | string | Request body data | | `body.resources.sub_aggregates.count` | number | Request body data | | `body.errors` | array | Request body data | ### Output Example `{"headers":{"Server":"string","Date":"2024-01-01T00:00:00Z","Content-Type":"string","Transfer-Encoding":"string","Connection":"string","Content-Encoding":"string","Strict-Transport-Security":"string","X-Cs-Region":"string","X-Cs-Traceid":"string","X-Ratelimit-Limit":"string","X-Ratelimit-Remaining":"string"},"body":{"meta":{"query_time":123,"powered_by":"string","trace_id":"string"},"resources":[{}],"errors":[{}]}}` ## Query Activities Retrieve activity IDs associated with a case in CrowdStrike Falcon V2 to support incident analysis and tracking. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------ | | `parameters.case_id` | string | Optional | Parameters for the Query Activities action | | `parameters.filter` | string | Optional | Parameters for the Query Activities action | | `parameters.limit` | number | Optional | Parameters for the Query Activities action | | `parameters.offset` | number | Optional | Parameters for the Query Activities action | | `parameters.sort` | string | Optional | Parameters for the Query Activities action | ### Input Example `{"parameters":{"case_id":"fc-CS-1234569","filter":"","limit":100,"offset":0,"sort":""}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.Vary` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.offset` | number | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.errors` | array | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Thu, 29 Jan 2026 21:00:59 GMT","Content-Type":"application/json","Content-Length":"222","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains","Vary":"Origin","X-Cs-Region":"us-2","X-Cs-Traceid":"106793b4-7bdd-4d0d-84ca-57af1d2fbf8a","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5998"},"body":{"meta":{"query_time":0.210693664,"pagination...` ## Query Alerts Retrieve a list of alerts from CrowdStrike Falcon V2 based on specified criteria to support targeted security investigations and responses. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ----------------------------------------------------------- | | `parameters.offset` | number | Optional | The first alert to return, where 0 is the latest alert. | | `parameters.limit` | number | Optional | The maximum number of alerts to return in this response. | | `parameters.include_hidden` | boolean | Optional | Allows previously hidden alerts to be retrieved. | | `parameters.sort` | string | Optional | Sort alerts using the FQL filter. | | `parameters.filter` | string | Optional | Filter alerts using a query in Falcon Query Language (FQL). | | `parameters.q` | string | Optional | Search all alert metadata for the provided string. | ### Input Example `{"parameters":{"offset":0,"limit":10,"include_hidden":false}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.offset` | number | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.writes` | object | Request body data | | `body.meta.writes.resources_affected` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Mon, 27 May 2024 09:03:20 GMT","Content-Type":"application/json","Content-Length":"475","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"88c181db-510b-4386-a7e3-c8ccff94aca7","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.016096131,"pagination":{},"writes":{}...` ## Query Cases Retrieve case IDs from CrowdStrike Falcon that match specific filter criteria to streamline incident analysis and response. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------------------------------------- | | `parameters.filter` | string | Optional | The filter expression that should be used to limit the results. FQL syntax. | | `parameters.limit` | number | Optional | The maximum number of records to return. \[integer, 1-500] | | `parameters.offset` | number | Optional | The integer offset to start retrieving records from. | | `parameters.sort` | string | Optional | The property to sort on. FQL syntax. | ### Input Example `{"parameters":{"filter":"","limit":100,"offset":0,"sort":""}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.Vary` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.offset` | number | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.errors` | array | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Thu, 29 Jan 2026 21:00:59 GMT","Content-Type":"application/json","Content-Length":"222","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains","Vary":"Origin","X-Cs-Region":"us-2","X-Cs-Traceid":"106793b4-7bdd-4d0d-84ca-57af1d2fbf8a","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5998"},"body":{"meta":{"query_time":0.210693664,"pagination...` ## Query CrowdScore Retrieve the CrowdScore for entities from CrowdStrike Falcon V2 to assess and understand their associated risk levels. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | -------------------------------------------------------------- | | `parameters.filter` | string | Optional | FQL Syntax formatted string used to limit the results. | | `parameters.offset` | number | Optional | Starting index of overall result set from which to return IDs. | | `parameters.limit` | number | Optional | Maximum number of records to return. | | `parameters.sort` | string | Optional | The property to sort by. (Ex - modified\_timestamp.desc) | ### Input Example `{"parameters":{"offset":1,"limit":10}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.offset` | number | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.id` | string | Request body data | | `body.resources.cid` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Thu, 30 May 2024 18:12:05 GMT","Content-Type":"application/json","Content-Length":"375","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"d4d5beb0-aec6-469b-9b39-469db91b9349","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.025790123,"pagination":{},"powered_by...` ## Query Host by Indicator Retrieve host details associated with a specific indicator in CrowdStrike Falcon V2 using the indicator type and value as parameters. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------------- | | `parameters.type` | string | Required | Parameters for the Query Host by Indicator action | | `parameters.value` | string | Required | Parameters for the Query Host by Indicator action | | `parameters.limit` | number | Optional | Parameters for the Query Host by Indicator action | | `parameters.offset` | number | Optional | Parameters for the Query Host by Indicator action | ### Input Example `{"parameters":{"type":"sha256","value":"swimlane.com","limit":10,"offset":0}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.offset` | string | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.meta.entity` | string | Request body data | | `body.resources` | array | Request body data | | `body.errors` | array | Request body data | | `body.errors.file_name` | string | Request body data | | `body.errors.file` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Mon, 27 May 2024 17:45:39 GMT","Content-Type":"application/json","Content-Length":"249","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"7dfddaf4-fec6-492b-a5be-9a11fe0b5bcc","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":6.9e-08,"pagination":{},"trace_id":"81b...` ## Query Identity Protection by GraphQL Execute a GraphQL query to retrieve identity protection data from CrowdStrike Falcon V2 using the specified query parameter. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------ | | `query` | string | Optional | JSON-similar formatted query to perform. | | `variables` | object | Optional | Dictionary of variables to provide to the query. | ### Input Example `{"json_body":{"query":"{\n entities(first: 1)\n {\n nodes {\n entityId \n }\n }\n}"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Fri, 20 Sep 2024 07:50:03 GMT","Content-Type":"application/json","Content-Length":"456","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"0186811e-4b00-49d8-a9e6-e7b2f59f5f87","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"json_body":{}}` ## Query Indicator Retrieve threat intelligence indicators from CrowdStrike Falcon using specified criteria to enhance security insights. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | --------------------------------------------------------------------------------- | | `parameters.limit` | number | Optional | Maximum number of results to return. | | `parameters.offset` | number | Optional | The offset to start retrieving records from. | | `parameters.filter` | string | Optional | FQL Syntax formatted filter that should be used to limit the results. | | `parameters.from_parent` | boolean | Optional | Return results for the parent only. | | `parameters.sort` | string | Optional | FQL Syntax formatted sort filter. | | `parameters.after` | string | Optional | A pagination token used with the limit parameter to manage pagination of results. | ### Input Example `{"parameters":{"limit":100,"offset":35}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.pagination.offset` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.errors` | array | Request body data | | `body.errors.file_name` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Fri, 24 May 2024 07:39:09 GMT","Content-Type":"application/json","Content-Length":"522","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"3145c559-d52e-425f-8a3f-798060f0be55","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.013341804,"pagination":{},"powered_by...` ## Query Indicator Entities Retrieve detailed information on indicators in CrowdStrike Falcon V2 using FQL filters provided in the JSON body. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | | ------------------ | -------- | ------------ | ----------------------------------------------------------------- | ----- | | `fql` | string | Optional | A query string used to filter results returned by this endpoint. | | | `sort` | string | Optional | The property to sort by. FQL syntax (e.g. published\_date | asc). | | `limit` | number | Optional | The maximum number of indicators to return. \[integer, 1-50000] | | | `include_deleted` | boolean | Optional | include both published and deleted indicators. Defaults to False. | | | `include_relation` | boolean | Optional | Include related indicators. Defaults to True. | | ### Input Example `{"json_body":{"fql":"type:'ip_address'+deleted:false+malicious_confidence:'High'","sort":"published_date|desc","limit":1,"include_deleted":false,"include_relation":true}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | ----------------- | | `body` | object | Request body data | | `body.errors` | array | Request body data | | `body.meta` | object | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.offset` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources._marker` | string | Request body data | | `body.resources.actors` | array | Request body data | | `body.resources.deleted` | boolean | Request body data | | `body.resources.domain_types` | array | Request body data | | `body.resources.id` | string | Request body data | | `body.resources.indicator` | string | Request body data | | `body.resources.ip_address_types` | array | Request body data | | `body.resources.kill_chains` | array | Request body data | | `body.resources.labels` | array | Request body data | | `body.resources.labels.created_on` | number | Request body data | | `body.resources.labels.last_valid_on` | number | Request body data | | `body.resources.labels.name` | string | Request body data | | `body.resources.last_updated` | number | Request body data | | `body.resources.malicious_confidence` | string | Request body data | ### Output Example `{"body":{"errors":[],"meta":{"pagination":{},"powered_by":"msa-api","query_time":0.056493166,"trace_id":"524cde1d-87bc-4d0c-8766-47cd2df6e206"},"resources":[{}]},"headers":{"Connection":"keep-alive","Content-Encoding":"gzip","Content-Type":"application/json","Date":"Wed, 07 Jan 2026 19:26:43 GMT","Server":"nginx","Strict-Transport-Security":"max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains","Transfer-Encoding":"chunked","Vary":"Origin","X-Cs-Region":"us-2","X-Cs-Traceid":...` ## Query Notifications Retrieve notifications from CrowdStrike Falcon V2 based on specified criteria to support threat analysis and incident response workflows. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | | | ------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------ | ----- | | `parameters.filter` | string | Optional | The filter expression that should be used to limit the results. FQL syntax. Available filters cid rule\_topic created\_date rule\_priority id status item\_type type rule\_name updated\_date rule\_id user\_uuid | | | | | | | | | | | `parameters.q` | string | Optional | Free text search across all indexed fields. | | | | `parameters.sort` | string | Optional | The property to sort by. FQL syntax. (e.g. created\_date | asc, updated\_date | desc) | | `parameters.limit` | number | Optional | The maximum number of IDs to return. \[integer, 1-500] | | | | `parameters.offset` | number | Optional | The first item to return, where 0 is the latest item. Use with the limit parameter to manage pagination of results. | | | | | | | | | | ### Input Example `{"parameters":{"filter":"status:'new'","q":"your-search-text","sort":"created_date|desc","limit":1,"offset":0}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | ---------------------------- | | `body` | object | Request body data | | `body.errors` | array | Request body data | | `body.meta` | object | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.offset` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `headers` | object | HTTP headers for the request | | `headers.Cache-Control` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Expires` | string | HTTP headers for the request | | `headers.Pragma` | string | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.Transfer-Encoding` | string | HTTP headers for the request | | `headers.Vary` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | ### Output Example `{"body":{"errors":[],"meta":{"pagination":{},"powered_by":"recon","query_time":0.166370264,"trace_id":"688fc104-2b5c-4a36-8c95-5850c11fbaec"},"resources":["MjAyNi0wMS0wMVQwMDowMDowMFpfYWIzNTkzNzEtNjQ2MC0yYjExLTk1MWItMmNiMjdjMTQzODkz"]},"headers":{"Cache-Control":"no-cache, no-store, must-revalidate","Connection":"keep-alive","Content-Encoding":"gzip","Content-Type":"application/json","Date":"Wed, 07 Jan 2026 23:48:15 GMT","Expires":"0","Pragma":"no-cache","Server":"nginx","Strict-Transport-Secur...` ## Query Reports Retrieve a list of reports from CrowdStrike Falcon V2 based on specified query criteria and return detailed report information. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------- | | `parameters.filter` | string | Optional | Optional filter and sort criteria in the form of an FQL query. | | `parameters.offset` | number | Optional | Starting index of overall result set from which to return IDs. | | `parameters.limit` | number | Optional | The maximum records to return. (Max - 5000). | | `parameters.sort` | string | Optional | The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc. | ### Input Example `{"parameters":{"offset":0,"limit":10}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.offset` | number | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.meta.quota` | object | Request body data | | `body.meta.quota.total` | number | Request body data | | `body.meta.quota.used` | number | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Mon, 27 May 2024 10:28:27 GMT","Content-Type":"application/json","Content-Length":"301","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"0c39193e-9bec-4bb9-a498-d49d076014ed","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.116668387,"pagination":{},"powered_by...` ## Query Sensors Retrieve details and status of sensors for endpoint monitoring in the CrowdStrike Falcon environment. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------------------------- | | `parameters.limit` | number | Optional | The maximum records to return. \[1-200] | | `parameters.offset` | number | Optional | The offset to start retrieving records from. | | `parameters.filter` | string | Optional | The filter expression that should be used to limit the results. | | `parameters.sort` | string | Optional | The property to sort by (e.g. status.desc or hostname.asc) | ### Input Example `{"parameters":{"limit":100,"offset":35}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `body` | object | Request body data | ### Output Example `{"status_code":200,"headers":{},"body":{}}` ## Query Submissions Retrieve detailed information on submissions, including their status and results, from CrowdStrike Falcon V2. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------- | | `filter` | string | Optional | Optional filter and sort criteria in the form of an FQL query. | | `limit` | number | Optional | The maximum records to return. (Max 5000). | | `offset` | number | Optional | Starting index of overall result set from which to return ids. | | `sort` | string | Optional | The property to sort on, followed by a dot (.), followed by the sort direction, either asc or desc. | ### Input Example `{"parameters":{"filter":" ","limit":50,"offset":0,"sort":"desc"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.errors` | array | Request body data | | `body.errors.code` | number | Request body data | | `body.errors.id` | string | Request body data | | `body.errors.message` | string | Request body data | | `body.meta` | object | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.offset` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.query_time` | number | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Fri, 20 Sep 2024 07:50:03 GMT","Content-Type":"application/json","Content-Length":"456","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"0186811e-4b00-49d8-a9e6-e7b2f59f5f87","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"body":{"errors":[{}],"meta":{"pagination":{},"powered_by":"string","query_time":0,"trace_id":"string","w...` ## Refresh Active Stream Session Renew an active event stream session in CrowdStrike Falcon V2 to maintain continuous monitoring using partition and app\_id. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `partition` | number | Required | Partition to request data for. If you are using the Service Class, this will default to 0 when not specified. | | `parameters.action_name` | string | Required | The name of the action to perform. The only allowed value is refresh\_active\_stream\_session. Defaults to this value if not present when using the Service Class. | | `parameters.app_id` | string | Required | Label that identifies your connection. Maximum 32 alphanumeric characters (a-z, A-Z, 0-9). | ### Input Example `{"parameters":{"action_name":"refresh_active_stream_session","app_id":" "},"partition":0}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.errors` | array | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Fri, 20 Sep 2024 07:50:03 GMT","Content-Type":"application/json","Content-Length":"456","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"0186811e-4b00-49d8-a9e6-e7b2f59f5f87","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"body":{"meta":{"query_time":0.000257867,"powered_by":"FalconHose","trace_id":"f02691b5-5fcd-4e1f-9e5d-d3...` ## Retrieve Activities for IDs Retrieve activity details for specified IDs in CrowdStrike Falcon V2 using a JSON body with 'ids' as a required field. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------- | | `ids` | array | Optional | List of activity IDs to retrieve. | ### Input Example `{"json_body":{"ids":["activity_123","activity_456"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `errors` | array | Error message if any | | `errors.code` | number | Error message if any | | `errors.id` | string | Unique identifier | | `errors.message` | string | Response message | | `meta` | object | Output field: meta | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.query_time` | number | Time value | | `meta.trace_id` | string | Unique identifier | | `meta.writes` | object | Output field: meta.writes | | `meta.writes.resources_affected` | number | Output field: meta.writes.resources\_affected | | `resources` | array | Output field: resources | | `resources.body` | string | Request body data | | `resources.case_id` | string | Unique identifier | | `resources.cid` | string | Unique identifier | | `resources.created_by` | object | Output field: resources.created\_by | | `resources.created_by.display_name` | string | Name of the resource | | `resources.created_by.email_address` | string | Output field: resources.created\_by.email\_address | | `resources.created_by.first_name` | string | Name of the resource | | `resources.created_by.last_name` | string | Name of the resource | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"errors":[{}],"meta":{"pagination":{},"powered_by":"string","query_time":0,"trace_id":"string","writes":{}},"resources":[{}]}}` ## Retrieve activities ids for a case Retrieve activity IDs for a specific case in CrowdStrike Falcon V2 using parameters such as case ID, limit, sort, filter, and offset. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | --------------------------------------------------------------- | | `parameters.limit` | number | Required | Maximum number of records to return. | | `parameters.sort` | string | Required | The property to sort by. | | `parameters.filter` | string | Required | The filter expression that should be used to limit the results. | | `parameters.offset` | number | Required | Starting index of overall result set from which to return ids. | | `parameters.case_id` | string | Required | Case ID to search for activities. | ### Input Example `{"parameters":{"limit":10,"sort":"activity.type.asc","filter":"activity.created_time:>'2024-01-01T00:00:00Z'","offset":0,"case_id":"case_123"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `errors` | array | Error message if any | | `errors.code` | number | Error message if any | | `errors.id` | string | Unique identifier | | `errors.message` | string | Response message | | `meta` | object | Output field: meta | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.query_time` | number | Time value | | `meta.trace_id` | string | Unique identifier | | `meta.writes` | object | Output field: meta.writes | | `meta.writes.resources_affected` | number | Output field: meta.writes.resources\_affected | | `resources` | array | Output field: resources | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"errors":[{}],"meta":{"pagination":{},"powered_by":"string","query_time":0,"trace_id":"string","writes":{}},"resources":["string"]}}` ## Retrieve aggregate case values Retrieve and analyze aggregate case values in CrowdStrike Falcon V2 using filters such as date ranges, fields, intervals, and more for comprehensive case data insights. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | | ---------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- | | `date_ranges` | array | Optional | Applies to date\_range aggregations. | | | `date_ranges.from` | string | Required | Start date/time for the range. | | | `date_ranges.to` | string | Required | End date/time for the range. | | | `field` | string | Optional | The field on which to compute the aggregation. | | | `filter` | string | Optional | The filter expression that should be used to limit the results. | | | `interval` | string | Optional | Time interval for date histogram aggregations. | | | `max_doc_count` | number | Optional | Count value | | | `min_doc_count` | number | Optional | Only return buckets if values are greater than or equal to the value here. | | | `missing` | string | Optional | Missing is the value to be used when the aggregation field is missing from the object. | | | `name` | string | Optional | Name of the aggregate query, as chosen by the user. | | | `q` | string | Optional | Full text search across all metadata fields. | | | `ranges` | array | Optional | Applies to range aggregations. Ranges values will depend on field. | | | `ranges.From` | number | Required | Parameter for Retrieve aggregate case values | | | `ranges.To` | number | Required | Parameter for Retrieve aggregate case values | | | `size` | number | Optional | The max number of term buckets to be returned. | | | `sort` | string | Optional | FQL syntax string to sort bucket results. \_count - sort by document count, \_term - sort by the string value alphabetically. Supports asc and desc using | format. | | `sub_aggregates` | array | Optional | A nested aggregation. | | | `sub_aggregates.name` | string | Optional | Name of the resource | | | `sub_aggregates.type` | string | Optional | Type of the resource | | | `sub_aggregates.field` | string | Optional | Parameter for Retrieve aggregate case values | | | `time_zone` | string | Optional | Time zone for bucket results. | | | `type` | string | Optional | Type of aggregation. | | ### Input Example `{"json_body":{"date_ranges":[{"from":"2016-05-28T09:00:31Z","to":"2016-05-30T09:00:31Z"},{"from":"2016-06-01T09:00:31Z","to":"2016-06-10T09:00:31Z"}],"field":"case.created_time","filter":"case.created_time:>'2024-01-01T00:00:00Z'","interval":"month","max_doc_count":100,"min_doc_count":0,"missing":"string","name":"string","percents":[0],"q":"string","ranges":[{"From":70,"To":100}],"size":0,"sort":"_count|desc","sub_aggregates":[{"name":"max_first_behavior","type":"max","field":"first_behavior"}],"time_zone":"UTC","type":"date_histogram"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | ----------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `errors` | array | Error message if any | | `errors.code` | number | Error message if any | | `errors.id` | string | Unique identifier | | `errors.message` | string | Response message | | `meta` | object | Output field: meta | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.query_time` | number | Time value | | `meta.trace_id` | string | Unique identifier | | `meta.writes` | object | Output field: meta.writes | | `meta.writes.resources_affected` | number | Output field: meta.writes.resources\_affected | | `resources` | array | Output field: resources | | `resources.buckets` | array | Output field: resources.buckets | | `resources.buckets.count` | number | Count value | | `resources.buckets.from` | number | Output field: resources.buckets.from | | `resources.buckets.key_as_string` | string | Output field: resources.buckets.key\_as\_string | | `resources.buckets.string_from` | string | Output field: resources.buckets.string\_from | | `resources.buckets.string_to` | string | Output field: resources.buckets.string\_to | | `resources.buckets.sub_aggregates` | array | Output field: resources.buckets.sub\_aggregates | | `resources.buckets.sub_aggregates.name` | string | Name of the resource | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"errors":[{}],"meta":{"pagination":{},"powered_by":"string","query_time":0,"trace_id":"string","writes":{}},"resources":[{}]}}` ## Retrieve case ids Retrieve case IDs from CrowdStrike Falcon V2 using filter, sort, limit, and offset parameters to customize the results. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------- | | `parameters.limit` | number | Required | The maximum records to return. \[1-500]. | | `parameters.sort` | string | Required | The property to sort on, followed by a dot (.), followed by the sort direction, either "asc" or "desc". | | `parameters.filter` | string | Required | The filter expression that should be used to limit the results. | | `parameters.offset` | number | Required | Starting index of overall result set from which to return ids. | ### Input Example `{"parameters":{"limit":10,"sort":"case.created_time.desc","filter":"case.created_time:>'2024-01-01T00:00:00Z'","offset":0}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `errors` | array | Error message if any | | `errors.code` | number | Error message if any | | `errors.id` | string | Unique identifier | | `errors.message` | string | Response message | | `meta` | object | Output field: meta | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.query_time` | number | Time value | | `meta.trace_id` | string | Unique identifier | | `meta.writes` | object | Output field: meta.writes | | `meta.writes.resources_affected` | number | Output field: meta.writes.resources\_affected | | `resources` | array | Output field: resources | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"errors":[{}],"meta":{"pagination":{},"powered_by":"string","query_time":0,"trace_id":"string","writes":{}},"resources":["string"]}}` ## Retrieve message center cases Retrieve message center cases from CrowdStrike Falcon V2 by specifying case IDs in the JSON body. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------- | | `ids` | array | Optional | List of case IDs to retrieve. | ### Input Example `{"json_body":{"ids":["activity_123"]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | ----------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `errors` | array | Error message if any | | `errors.code` | number | Error message if any | | `errors.id` | string | Unique identifier | | `errors.message` | string | Response message | | `meta` | object | Output field: meta | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.query_time` | number | Time value | | `meta.trace_id` | string | Unique identifier | | `meta.writes` | object | Output field: meta.writes | | `meta.writes.resources_affected` | number | Output field: meta.writes.resources\_affected | | `resources` | array | Output field: resources | | `resources.aids` | array | Unique identifier | | `resources.assigner` | object | Output field: resources.assigner | | `resources.assigner.display_name` | string | Name of the resource | | `resources.assigner.email_address` | string | Output field: resources.assigner.email\_address | | `resources.assigner.first_name` | string | Name of the resource | | `resources.assigner.last_name` | string | Name of the resource | | `resources.assigner.uid` | string | Unique identifier | | `resources.assigner.uuid` | string | Unique identifier | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"errors":[{}],"meta":{"pagination":{},"powered_by":"string","query_time":0,"trace_id":"string","writes":{}},"resources":[{}]}}` ## RTR Check Command Status Retrieve the status of a previously executed command on a single host in CrowdStrike Falcon V2 using the provided cloud\_request\_id. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------- | | `parameters.cloud_request_id` | string | Required | Cloud Request ID of the executed command to query. | | `parameters.sequence_id` | number | Optional | Sequence ID that we want to retrieve. Command responses are chunked across sequences. | ### Input Example `{"parameters":{"cloud_request_id":"519b67ad-7d37-49fe-a6ba-921dfd6a015f","sequence_id":0}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.base_command` | string | Request body data | | `body.resources.cloud_request_id` | string | Request body data | | `body.resources.complete` | boolean | Request body data | | `body.resources.errors` | array | Request body data | | `body.resources.errors.code` | number | Request body data | | `body.resources.errors.id` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Mon, 27 May 2024 05:39:07 GMT","Content-Type":"application/json","Content-Length":"350","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"ec8b5d53-770e-44c9-91e7-410e436f0860","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5998","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"body":{"meta":{"query_time":0.013513642,"powered_by":"empower-api","trace_id":"ec8b5d53-770e-44c9-91e7-4...` ## RTR Get Batch Get Cmd Retrieve the status and results of a specific batch get command in CrowdStrike Falcon V2 using the provided request ID. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------- | | `parameters.batch_get_cmd_req_id` | string | Required | Batch Get Command Request ID (usually retrieved when making a call to BatchGetCmd). | | `parameters.timeout` | number | Optional | Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. | | `parameters.timeout_duration` | string | Optional | Parameters for the RTR Get Batch Get Cmd action | ### Input Example `{"parameters":{"batch_get_cmd_req_id":"request_id123342","timeout":30,"timeout_duration":"60s"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.errors` | array | Request body data | | `body.errors.code` | number | Request body data | | `body.errors.id` | string | Request body data | | `body.errors.message` | string | Request body data | | `body.meta` | object | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.offset` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.query_time` | number | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Tue, 11 Jun 2024 05:37:32 GMT","Content-Type":"application/json","Content-Length":"210","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"ffa4bb9b-3c9b-4178-b0f1-aab2c8c5ca76","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"body":{"errors":[{}],"meta":{"pagination":{},"powered_by":"string","query_time":0,"trace_id":"string","w...` ## RTR Post Batch Get Cmd Execute a batch 'get' command to retrieve files from multiple hosts in CrowdStrike Falcon V2, with status tracked via BatchGetCmdStatus. ### Endpoint - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------- | -------- | ------------ | ------------------------------------------------ | | `parameters.timeout` | number | Optional | Parameters for the RTR Post Batch Get Cmd action | | `parameters.timeout_duration` | string | Optional | Parameters for the RTR Post Batch Get Cmd action | | `parameters.host_timeout_duration` | string | Optional | Parameters for the RTR Post Batch Get Cmd action | | `batch_id` | string | Optional | Unique identifier | | `file_path` | string | Optional | Parameter for RTR Post Batch Get Cmd | | `optional_hosts` | array | Optional | Parameter for RTR Post Batch Get Cmd | ### Input Example `{"parameters":{"timeout":30,"timeout_duration":"30s","host_timeout_duration":"10s"},"json_body":{"batch_id":"string","file_path":"string","optional_hosts":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.batch_get_cmd_req_id` | string | Request body data | | `body.combined` | object | Request body data | | `body.combined.resources` | object | Request body data | | `body.combined.resources.additionalProp1` | object | Request body data | | `body.combined.resources.additionalProp1.aid` | string | Request body data | | `body.combined.resources.additionalProp1.base_command` | string | Request body data | | `body.combined.resources.additionalProp1.complete` | boolean | Request body data | | `body.combined.resources.additionalProp1.errors` | array | Request body data | | `body.combined.resources.additionalProp1.offline_queued` | boolean | Request body data | | `body.combined.resources.additionalProp1.query_time` | number | Request body data | | `body.combined.resources.additionalProp1.sequence_id` | number | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Tue, 11 Jun 2024 05:37:32 GMT","Content-Type":"application/json","Content-Length":"210","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"ffa4bb9b-3c9b-4178-b0f1-aab2c8c5ca76","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"body":{"batch_get_cmd_req_id":"string","combined":{"resources":{}},"errors":[{}],"meta":{"pagination":{}...` ## Search Actors Search for threat actors in CrowdStrike Falcon V2 using FQL filters such as name, region, motivation, or target industry. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | | ------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | | `parameters.filter` | string | Optional | FQL Syntax formatted filter used to limit the results. Filter parameters include: actor\_type, animal\_classifier, capabilities, created\_date, description, first\_activity\_date, group, id, kill\_chain.delivery, known\_as, last\_activity\_date, last\_modified\_date, mitre\_attack.technique\_id, mitre\_attack.tactic\_name, motivations, name, objectives, origins, region, short\_description, slug, status, target\_countries, target\_industries, and target\_regions. | | | `parameters.q` | string | Optional | Perform a generic substring search across all fields. | | | `parameters.sort` | string | Optional | FQL Syntax formatted sort filter, for example created\_date | asc. | | `parameters.limit` | number | Optional | The number of actors to return. The value must be between 1 and 5000. | | | `parameters.offset` | number | Optional | The starting row number to return actors from. Defaults to 0. | | | `parameters.fields` | array | Optional | The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores, for example **full**. Defaults to **basic**. | | ### Input Example `{"parameters":{"filter":"target_industries:'Financial Services'+motivations:'Criminal'","sort":"last_activity_date|desc","limit":50,"offset":0,"fields":["__full__"]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.pagination.offset` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.id` | number | Request body data | | `body.resources.name` | string | Request body data | | `body.resources.slug` | string | Request body data | | `body.resources.short_description` | string | Request body data | | `body.resources.description` | string | Request body data | | `body.resources.url` | string | Request body data | | `body.resources.active` | boolean | Request body data | | `body.resources.created_date` | number | Request body data | ### Output Example `{"status_code":200,"headers":{"Content-Type":"application/json","X-Cs-Region":"us-1","X-Cs-Traceid":"3145c559-d52e-425f-8a3f-798060f0be55","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.073341804,"pagination":{},"powered_by":"intel-api","trace_id":"3145c559-d52e-425f-8a3f-798060f0be55"},"resources":[{}],"errors":[]}}` ## Search Host Retrieve detailed information about hosts in the CrowdStrike Falcon environment based on specified search criteria. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------------------------- | | `parameters.offset` | number | Optional | The offset to start retrieving records from. | | `parameters.limit` | number | Optional | The maximum records to return. \[1-5000]. | | `parameters.sort` | string | Optional | The property to sort by (e.g. status.desc or hostname.asc). | | `parameters.filter` | string | Optional | The filter expression that should be used to limit the results. | ### Input Example `{"parameters":{"offset":0,"limit":10}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.offset` | number | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.errors` | array | Request body data | | `body.errors.file_name` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Fri, 24 May 2024 18:21:07 GMT","Content-Type":"application/json","Content-Length":"411","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"35ff4175-dc74-45a7-969c-3707822de1ea","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.007732427,"pagination":{},"powered_by...` ## Search Indicators Search the CrowdStrike Falcon Intelligence Indicator Graph for indicators matching an FQL filter, such as high confidence indicators published in the last 30 days. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | | ------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | | `parameters.filter` | string | Optional | FQL Syntax formatted filter used to limit the results. Filter parameters include: Type, LastUpdated, KillChain, MaliciousConfidence, MaliciousConfidenceValidatedTime, FirstSeen, LastSeen, Adversaries.Name, Adversaries.Slug, Reports.Title, Reports.Slug, Threats.FamilyName, Vulnerabilities.CVE, Sectors.Name, FileDetails.SHA256, FileDetails.SHA1, FileDetails.MD5, DomainDetails.Detail, IPv4Details.IPv4, IPv6Details.IPv6, and URLDetails.URL. | | | `parameters.sort` | string | Optional | FQL Syntax formatted sort filter, for example PublishDate | asc. Sortable fields include FileDetails.SHA256, URLDetails.URL, PublishDate, and MaliciousConfidence. | | `parameters.limit` | number | Optional | Maximum number of results to return. | | | `parameters.offset` | string | Optional | The offset to start returning results from. | | ### Input Example `{"parameters":{"filter":"MaliciousConfidence:'high'+PublishDate:>'now-30d'","sort":"PublishDate|desc","limit":100,"offset":"0"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------------- | -------- | ----------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.pagination.offset` | string | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.ID` | string | Request body data | | `body.resources.Type` | string | Request body data | | `body.resources.MaliciousConfidence` | string | CrowdStrike confidence rating - high, medium, low, or unverified. | | `body.resources.MaliciousConfidenceValidatedTime` | string | Request body data | | `body.resources.PublishDate` | string | Request body data | | `body.resources.FirstSeen` | string | Request body data | | `body.resources.LastSeen` | string | Request body data | | `body.resources.LastUpdated` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Content-Type":"application/json","X-Cs-Region":"us-1","X-Cs-Traceid":"3145c559-d52e-425f-8a3f-798060f0be55","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.213341804,"pagination":{},"powered_by":"intelligence-indicator-graph","trace_id":"3145c559-d52e-425f-8a3f-798060f0be55"},"resources":[{}],"errors":[]}}` ## Submit File for Analysis Submit a file for analysis using SHA256, user tags, and environment ID to receive detailed threat intelligence from CrowdStrike Falcon V2. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `action_script` | string | Optional | Runtime script for sandbox analysis. | | `command_line` | string | Optional | Command line script passed to the submitted file at runtime. Max length 2048 characters | | `document_password` | string | Optional | Auto-filled for Adobe or Office files that prompt for a password. Max length 32 characters | | `enable_tor` | boolean | Optional | Deprecated, please use network\_settings instead. If true, sandbox analysis routes network traffic via TOR. | | `environment_id` | number | Optional | Specifies the sandbox environment used for analysis. Accepted values are 400 - macOS Catalina 10.15, 300 - Linux Ubuntu 16.04, 64-bit, 200 - Android (static analysis), 160 - Windows 10, 64-bit, 110 - Windows 7, 64-bit and 100 - Windows 7, 32-bit | | `network_settings` | string | Optional | Specifies the sandbox network\_settings used for analysis. | | `send_email_notification` | boolean | Optional | Boolean indicating if an email notification should be sent. | | `sha256` | string | Optional | ID of the sample, which is a SHA256 hash value. | | `submit_name` | string | Optional | Name of the malware sample that's used for file type detection and analysis. | | `system_date` | string | Optional | Set a custom date in the format yyyy-MM-dd for the sandbox environment. | | `system_time` | string | Optional | Set a custom time in the format HH\:mm for the sandbox environment. | | `url` | string | Optional | A web page or file URL. It can be HTTP(S) or FTP. The sha256 keyword must be unset if this keyword is used. | | `user_tags` | array | Optional | User tags. | ### Input Example `{"json_body":{"environment_id":300,"sha256":"0edf67fa585bedac6db7571f9fe3a449a2d0a4d78529a8bfee4f845f00931f89","user_tags":["t1"]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.meta.quota` | object | Request body data | | `body.meta.quota.total` | number | Request body data | | `body.meta.quota.used` | number | Request body data | | `body.meta.quota.in_progress` | number | Request body data | | `body.resources` | array | Request body data | | `body.resources.id` | string | Request body data | | `body.resources.cid` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Thu, 30 May 2024 09:20:40 GMT","Content-Type":"application/json","Content-Length":"416","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"40292170-d8b7-40a2-b0f9-59fbc30d6c86","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5998"},"body":{"meta":{"query_time":0.124695049,"powered_by":"falconx-api",...` ## Test Asset Connection Verify connectivity to the configured asset in CrowdStrike Falcon V2 and ensure successful integration setup. ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Update Alerts By ID Update specific alerts in CrowdStrike Falcon V2 by providing alert IDs and optionally including hidden alerts using the 'include\_hidden' parameter. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.include_hidden` | boolean | Required | Allows previously hidden alerts to be retrieved. | | `add_tag` | string | Optional | Add a tag to 1 or more alert(s). | | `append_comment` | string | Optional | Appends new comment to existing comments. | | `assign_to_name` | string | Optional | Assign 1 or more alert(s) to a user identified by user name. | | `assign_to_user_id` | string | Optional | Assign 1 or more alert(s) to a user identified by user id (eg - [user1@example.com](mailto\:user1@example.com)). | | `assign_to_uuid` | string | Optional | A user ID (Ex - [user@somewhere.com](mailto\:user@somewhere.com)) to assign the alert to. | | `ids` | array | Optional | Composite ID(s) of the alerts to update. | | `new_behavior_processed` | string | Optional | Adds a newly processed behavior to 1 or more alert(s). | | `remove_tag` | string | Optional | Remove a tag from 1 or more alert(s). | | `remove_tags_by_prefix` | string | Optional | Remove tags with given prefix from 1 or more alert(s). | | `show_in_ui` | boolean | Optional | Boolean determining if this alert is displayed in the Falcon console. True - This alert is displayed in Falcon. False - This alert is not displayed in Falcon. | | `unassign` | string | Optional | Unassign an previously assigned user from 1 or more alert(s). The value passed to this action is ignored. | | `update_status` | string | Optional | Update status of the alert. | ### Input Example `{"parameters":{"include_hidden":true},"json_body":{"ids":["9cee3cb8390040a986142632cff93a6f:ind:ccde88355e0a48fa9558daadb64861ea:26027824139-10303-1316112"],"update_status":"in_progress"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.writes` | object | Request body data | | `body.meta.writes.resources_affected` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Thu, 30 May 2024 06:13:34 GMT","Content-Type":"application/json","Content-Length":"161","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"d063bf0b-7622-428e-846d-646ab236ca3b","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":0.466943467,"writes":{},"powered_by":"d...` ## Update Indicator Update an existing indicator in CrowdStrike Falcon V2 with new intelligence or modifications using a JSON body input. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ----------------------------------------------------------------------------- | | `parameters.ignore_warnings` | boolean | Optional | Flag to indicate that warnings are ignored. | | `parameters.retrodetects` | boolean | Optional | Flag to indicate whether to submit retrodetects. | | `bulk_update` | object | Optional | Date value | | `bulk_update.action` | string | Optional | Default action for IOC. | | `bulk_update.applied_globally` | boolean | Optional | Flag indicating this IOC is applied globally. | | `bulk_update.description` | string | Optional | IOC description. | | `bulk_update.expiration` | string | Optional | UTC formatted date string. | | `bulk_update.from_parent` | boolean | Optional | Return results for the parent only. | | `bulk_update.host_groups` | array | Optional | List of host groups this IOC applies to. | | `bulk_update.metadata` | object | Optional | Response data | | `bulk_update.metadata.filename` | string | Optional | Filename to use for the metadata dictionary. | | `bulk_update.mobile_action` | string | Optional | Mobile action to perform. | | `bulk_update.platforms` | array | Optional | Platforms this IOC impacts. | | `bulk_update.severity` | string | Optional | IOC severity. | | `bulk_update.source` | string | Optional | IOC source. | | `bulk_update.tags` | array | Optional | IOC tags. | | `bulk_update.filter` | string | Optional | FQL Syntax formatted filter that should be used to filter indicators in bulk. | | `bulk_update.type` | string | Optional | IOC type. | | `bulk_update.value` | string | Optional | String representation of the IOC. | | `comment` | string | Optional | IOC comment. | | `indicators` | array | Optional | Parameter for Update Indicator | | `indicators.id` | string | Optional | The Indicator ID to be updated. | | `indicators.action` | string | Optional | Default action for IOC. | | `indicators.applied_globally` | boolean | Optional | Flag indicating this IOC is applied globally. | | `indicators.description` | string | Optional | IOC description. | ### Input Example `{"parameters":{"ignore_warnings":true,"retrodetects":true},"json_body":{"bulk_update":{"platforms":["linux","windows","mac"],"filter":"id:'251f034e85cae0de16c1ac1d4bca712b7d39889d3fab896c7e7b5b680b6479f8' "}}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.pagination` | object | Request body data | | `body.meta.pagination.limit` | number | Request body data | | `body.meta.pagination.total` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.file_name` | string | Request body data | | `body.resources.file` | string | Request body data | | `body.errors` | array | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Tue, 28 May 2024 06:29:11 GMT","Content-Type":"application/json","Content-Length":"192","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"0af52173-f617-4266-b0da-778f4e79af06","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5998"},"body":{"meta":{"query_time":0.719683384,"pagination":{},"powered_by...` ## Update Notifications Modify the status or assignee of multiple notifications in CrowdStrike Falcon V2 to streamline bulk notification management. ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Cache-Control` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Expires` | string | HTTP headers for the request | | `headers.Pragma` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.Vary` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Frame-Options` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.powered_by` | string | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.resources.cid` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Thu, 08 Jan 2026 00:30:22 GMT","Content-Type":"application/json","Content-Length":"1090","Connection":"keep-alive","Cache-Control":"no-cache, no-store, must-revalidate","Content-Encoding":"gzip","Expires":"0","Pragma":"no-cache","Strict-Transport-Security":"max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains","Vary":"Origin","X-Cs-Region":"us-2","X-Cs-Traceid":"3ea5c980-14eb-4d9c-967e-14d24fb05114","X-Frame-Options":"SAM...` ## Upload an attachment for Case Upload specified files as attachments to a case in CrowdStrike Falcon V2 using the provided data body. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ------------------------------------------------------------------------------- | | `files` | array | Required | The file to be uploaded, in the form of a data URI with base64-encoded content. | | `files.file_name` | string | Required | Name to use for the file. Uses current file name if not specified. | | `files.file` | string | Required | The file to be uploaded, in the form of a data URI with base64-encoded content. | | `data_body` | object | Required | Response data | | `data_body.case_id` | string | Required | ID of the case to which the attachment is being uploaded. | | `data_body.user_uuid` | string | Required | UUID of the user uploading the attachment. | ### Input Example `{"files":[{"file":"123-456-789","file_name":"test123"}],"data_body":{"case_id":"case_123","file":"data:application/octet-stream;base64,SGVsbG8sIHRoaXMgaXMgYSB0ZXN0IGF0dGFjaG1lbnQgZGF0YS4=","user_uuid":"fed9b1c0-1234-5678-9101-abcdef123456"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `errors` | array | Error message if any | | `errors.code` | number | Error message if any | | `errors.id` | string | Unique identifier | | `errors.message` | string | Response message | | `meta` | object | Output field: meta | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.query_time` | number | Time value | | `meta.trace_id` | string | Unique identifier | | `meta.writes` | object | Output field: meta.writes | | `meta.writes.resources_affected` | number | Output field: meta.writes.resources\_affected | | `resources` | array | Output field: resources | | `resources.created_by` | string | Output field: resources.created\_by | | `resources.created_time` | string | Time value | | `resources.id` | string | Unique identifier | | `resources.mime_type` | string | Type of the resource | | `resources.name` | string | Name of the resource | | `resources.size` | number | Output field: resources.size | ### Output Example `{"status_code":200,"reason":"OK","json_body":{"errors":[{}],"meta":{"pagination":{},"powered_by":"string","query_time":0,"trace_id":"string","writes":{}},"resources":[{}]}}` ## Upload File for Analysis Upload a file to CrowdStrike Falcon V2 for comprehensive threat analysis using the required 'file\_data' input. ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `data_body` | object | Optional | Response data | | `data_body.comment` | string | Optional | A descriptive comment to identify the file for other users. | | `data_body.file_name` | string | Optional | Name to use for the file. Uses current file name if not specified. | | `data_body.is_confidential` | boolean | Optional | Defines the visibility of this file in Falcon MalQuery, either via the API or the Falcon console. True - File is only shown to users within your customer account. False - File can be seen by other CrowdStrike customers. | | `file_data` | array | Required | Response data | | `file_data.file_name` | string | Required | Response data | | `file_data.file` | string | Required | Response data | ### Input Example `{"data_body":{"comment":"sample file","file_name":"sample.doc","is_confidential":true},"file_data":[{"file":"123-456-789","file_name":"test123"}]}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `headers` | object | HTTP headers for the request | | `headers.Server` | string | HTTP headers for the request | | `headers.Date` | string | HTTP headers for the request | | `headers.Content-Type` | string | HTTP headers for the request | | `headers.Content-Length` | string | HTTP headers for the request | | `headers.Connection` | string | HTTP headers for the request | | `headers.Content-Encoding` | string | HTTP headers for the request | | `headers.Strict-Transport-Security` | string | HTTP headers for the request | | `headers.X-Cs-Region` | string | HTTP headers for the request | | `headers.X-Cs-Traceid` | string | HTTP headers for the request | | `headers.X-Ratelimit-Limit` | string | HTTP headers for the request | | `headers.X-Ratelimit-Remaining` | string | HTTP headers for the request | | `body` | object | Request body data | | `body.meta` | object | Request body data | | `body.meta.query_time` | number | Request body data | | `body.meta.trace_id` | string | Request body data | | `body.resources` | array | Request body data | | `body.errors` | array | Request body data | | `body.errors.file_name` | string | Request body data | | `body.errors.file` | string | Request body data | ### Output Example `{"status_code":200,"headers":{"Server":"nginx","Date":"Wed, 29 May 2024 17:30:22 GMT","Content-Type":"application/json","Content-Length":"208","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"d1e81c8a-5b34-49e3-94b5-8cd04b60323d","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999"},"body":{"meta":{"query_time":8.8e-08,"trace_id":"28f9533c-951d-4357-...` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |