--- title: CrowdStrike Falcon slug: connectors/crowdstrike-falcon docTags: createdAt: 2026-06-09T16:30:00.730Z --- CrowdStrike Falcon is a cloud-native endpoint protection platform designed to detect, prevent, and respond to cyber threats. CrowdStrike Falcon is a leading endpoint protection platform that provides comprehensive threat intelligence and real-time response capabilities. This connector enables seamless integration with Swimlane Turbine, allowing users to automate threat detection, response, and management tasks. By leveraging the capabilities of CrowdStrike Falcon, Swimlane Turbine users can enhance their security operations with automated incident response, real-time threat intelligence, and efficient management of security incidents and vulnerabilities. ## Prerequisites Before you can use the CrowdStrike Falcon connector for Turbine, you'll need access to the CrowdStrike Falcon API. This requires the following: - OAuth 2.0 Client Credentials authentication using the following parameters: - URL: The base URL for accessing the CrowdStrike Falcon API. - Client ID: A unique identifier for your application to authenticate with the API. - Client Secret: A secret key used in conjunction with the Client ID to authenticate your application. ## Asset Configuration Each CrowdStrike cloud has a different base URL. When making requests to the CrowdStrike API, use the base URL that corresponds to the cloud where your integration is hosted. - US-1: [https://api.crowdstrike.com](https://api.crowdstrike.com) - US-2: [https://api.us-2.crowdstrike.com](https://api.us-2.crowdstrike.com) - EU-1: [https://api.eu-1.crowdstrike.com](https://api.eu-1.crowdstrike.com) - US-GOV-1: [https://api.laggar.gcw.crowdstrike.com](https://api.laggar.gcw.crowdstrike.com) - US-GOV-2: [https://api.us-gov-2.crowdstrike.mil](https://api.us-gov-2.crowdstrike.mil) ## Capabilities This connector has the following capabilities: ### Detections - Get Detections - Get Detections Summary - Update Detections ### Host - Get Host Info - Get Host ID - Manage Host - Search Hosts ### Incidents - Get Incidents - Perform Incident Action - Query Behaviors ### Users - Get user IDs by email ### Indicators - Create Indicator - Get Indicator - Query Host for Indicator - Query Indicator - Update Indicator ### Reports - Search Reports ### Real Time Response (RTR) - CMD Result - Admin CMD Run - Get Script - Get Uploaded File Info - Upload Script - Get Script IDs - Extracted File Content - Delete Session File ID - Session File Download - List Files - Get Session IDs - Upload File - Refresh, Delete, and Initialize Session ### Falcon Sandbox - Get File Analysis - Get Reports - Query Reports - Upload File Analysis - Submit File Analysis ### Scan - Delete Quarantine File - Manage Scans - Retrieve Scan by ID ### Scheduled Reports - Get Scheduled Reports - Launch Scheduled Reports - Query Scheduled Reports ### ThreatGraph - Vertex Summary ### Custom Action - Get Results From Vulnerability Keyword Search [Link](https://falconpy.io/Service-Collections/Spotlight-Vulnerabilities.html) - Filter the vulnerabilities, Refer the below example - `filter`: `status:'open'+cve.exploit_status:['90']+cve.exprt_rating:['CRITICAL']` ## Notes - `Manage Scans Action` : File path exclusions can be formatted in glob syntax. For more info, [see Glob Syntax](https://falcon.crowdstrike.com/documentation/page/e2e4b1b4/glob-syntax). - You must have an account in order to view the documentation. - [CrowdStrike Falcon documentation](https://falcon.crowdstrike.com/support/documentation) - [Falconpy Docs](https://www.falconpy.io/Service-Collections/Quarantine.html) ## Additional Documentation - [CrowdStrike Falcon Connector Documentation](https://docs.swimlane.com/connectors/crowdstrike-falcon) - [CrowdStrike Falcon API Documentation](https://falcon.crowdstrike.com/documentation/page/e2e4b1b4/glob-syntax) - [CrowdStrike Falcon Authentication Guide](https://docs.swimlane.com/authentication-guides/crowdstrike-falcon) # Configurations ## Oauth 2.0 Client Credentials Authenticates using oauth 2.0 client credentials ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | -------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | client\_id | The client ID | string | Required | | client\_secret | The client secret. | string | Required | | member\_cid | Member CID for MSSP environment. | string | Optional | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Delete Quarantine File Remove quarantined files from endpoints in CrowdStrike Falcon using specified file IDs, action types, and comments. ### Endpoint - **URL:** `/quarantine/entities/quarantined-files/v1` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------- | | `comment` | string | Optional | Comment to list along with action taken. | | `ids` | array | Optional | List of Quarantine IDs to update. | | `action` | string | Optional | Action to perform against the quarantined file. | ### Input Example `{"json_body":{"comment":"string","ids":["id1","id2"],"action":"delete"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 02 Nov 2023 16:43:41 GMT","Content-Type":"application/json","Content-Length":"231","Connection":"keep-alive","X-Content-Type-Options":"nosniff","X-Cs-Traceid":"c346f1ac-873b-4794-b85f-f35b9a6b7884","X-Ratelimit-Limit":"15","X-Ratelimit-Remaining":"14","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"reason":"OK","json_body":{}}` ## Delete RTR Session Terminate an existing Real Time Response session in CrowdStrike Falcon using the specified session ID. ### Endpoint - **URL:** `real-time-response/entities/sessions/v1` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | -------------------------------------------- | | `parameters.session_id` | string | Required | Parameters for the Delete RTR Session action | ### Input Example `{"parameters":{"session_id":"5366aad8-86a6-4fa0-948e-010cc525e6bd"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `response_text` | string | Output field: response\_text | ### Output Example `{"status_code":204,"response_headers":{"Server":"nginx","Date":"Fri, 21 Oct 2022 18:04:36 GMT","Content-Type":"application/json","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"6fa00735-ec3f-4ce5-be30-5ba5e94ec8e6","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5995","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"reason":"No Content","response_text":""}` ## Delete RTR Session File Remove a specified Real Time Response session file from CrowdStrike Falcon using provided session and file IDs. ### Endpoint - **URL:** `real-time-response/entities/file/v2` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ------------------------------------------------- | | `parameters.session_id` | string | Required | Parameters for the Delete RTR Session File action | | `parameters.ids` | string | Required | Parameters for the Delete RTR Session File action | ### Input Example `{"parameters":{"session_id":"123qwe","ids":"rtrsessionfileid"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `data` | object | Response data | | `data.errors` | array | Response data | | `data.errors.code` | number | Response data | | `data.errors.id` | string | Response data | | `data.errors.message` | string | Response data | | `data.meta` | object | Response data | | `data.meta.pagination` | object | Response data | | `data.meta.pagination.limit` | number | Response data | | `data.meta.pagination.offset` | number | Response data | | `data.meta.pagination.total` | number | Response data | | `data.meta.powered_by` | string | Response data | | `data.meta.query_time` | number | Response data | | `data.meta.trace_id` | string | Response data | | `data.meta.writes` | object | Response data | | `data.meta.writes.resources_affected` | number | Response data | | `response_text` | string | Output field: response\_text | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":204,"response_headers":{"Server":"nginx","Date":"Fri, 09 Sep 2022 14:47:19 GMT","Content-Type":"application/json","Content-Length":"215","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"b353da90-67d7-49f1-8805-21d76bc45c72","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"data":{"errors":[{}],"meta":{"pagination":{},"powered_by":"string","query_time":0,"trace_id":"s...` ## Get Detections Retrieve a list of detection IDs from CrowdStrike Falcon based on specified parameters. ### Endpoint - **URL:** `detects/queries/detects/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ---------------------------------------- | | `parameters.filter` | string | Optional | Parameters for the Get Detections action | | `parameters.offset` | number | Optional | Parameters for the Get Detections action | | `parameters.limit` | number | Optional | Parameters for the Get Detections action | | `parameters.sort` | string | Optional | Parameters for the Get Detections action | | `parameters.q` | string | Optional | Parameters for the Get Detections action | ### Input Example `{"parameters":{"filter":"status:'new'","offset":0,"limit":1,"sort":"first_behavior","q":"query"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | | `errors` | array | Error message if any | | `errors.file_name` | string | Name of the resource | | `errors.file` | string | Error message if any | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 18 Oct 2022 20:46:37 GMT","Content-Type":"application/json","Content-Length":"477","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"3279d3e5-f9fc-4f43-833b-eab293fa9bbe","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5995"},"reason":"OK","json_body":{"meta":{"query_time":0.00738949,...` ## Get Detection Summaries Retrieve summaries for specific detections in CrowdStrike Falcon by providing their unique IDs. ### Endpoint - **URL:** `detects/entities/summaries/GET/v1` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------- | | `ids` | array | Optional | Unique identifier | ### Input Example `{"json_body":{"ids":["ldt:20c5964f60d649439068d19e3be19c2e:4295481339","ldt:4e400866e4d8462a9d1824eb52ca2516:8592791965","ldt:4e400866e4d8462a9d1824eb52ca2516:8591241167","ldt:4e400866e4d8462a9d1824eb52ca2516:8590422710","ldt:4e400866e4d8462a9d1824eb52ca2516:4298085720","ldt:4e400866e4d8462a9d1824eb52ca2516:4296113139","ldt:4e400866e4d8462a9d1824eb52ca2516:4295965514","ldt:766a3015cdcc41b39d24cdf9a1c8afd3:25796649270"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | ------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | | `resources.cid` | string | Unique identifier | | `resources.created_timestamp` | string | Output field: resources.created\_timestamp | | `resources.detection_id` | string | Unique identifier | | `resources.device` | object | Output field: resources.device | | `resources.device.device_id` | string | Unique identifier | | `resources.device.cid` | string | Unique identifier | | `resources.device.agent_load_flags` | string | Output field: resources.device.agent\_load\_flags | | `resources.device.agent_local_time` | string | Time value | | `resources.device.agent_version` | string | Output field: resources.device.agent\_version | | `resources.device.bios_manufacturer` | string | Output field: resources.device.bios\_manufacturer | | `resources.device.bios_version` | string | Output field: resources.device.bios\_version | | `resources.device.config_id_base` | string | Unique identifier | | `resources.device.config_id_build` | string | Unique identifier | | `resources.device.config_id_platform` | string | Unique identifier | | `resources.device.external_ip` | string | Output field: resources.device.external\_ip | | `resources.device.hostname` | string | Name of the resource | | `resources.device.first_seen` | string | Output field: resources.device.first\_seen | | `resources.device.last_seen` | string | Output field: resources.device.last\_seen | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 18 Oct 2022 21:17:15 GMT","Content-Type":"application/json","Content-Length":"1919","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"bbd58ec5-9822-4ed0-bbce-5f5c5b1da5c1","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5995"},"reason":"OK","json_body":{"meta":{"query_time":0.00223369...` ## Execute RTR Command Execute a Real Time Response admin command on a host in CrowdStrike Falcon using a specified command string, device ID, and session ID. ### Endpoint - **URL:** `real-time-response/entities/admin-command/v1` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------- | | `base_command` | string | Optional | Parameter for Execute RTR Command | | `command_string` | string | Optional | Parameter for Execute RTR Command | | `device_id` | string | Optional | Unique identifier | | `id` | number | Optional | Unique identifier | | `persist` | boolean | Optional | Parameter for Execute RTR Command | | `session_id` | string | Optional | Unique identifier | ### Input Example `{"json_body":{"base_command":"ls","command_string":"-la","device_id":"string","id":0,"persist":true,"session_id":"a8f685e0-117a-4707-867c-51b48f767392"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | ------------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | | `resources.session_id` | string | Unique identifier | | `resources.cloud_request_id` | string | Unique identifier | | `resources.queued_command_offline` | boolean | Output field: resources.queued\_command\_offline | | `errors` | object | Error message if any | ### Output Example `{"status_code":201,"response_headers":{"Server":"nginx","Date":"Thu, 20 Oct 2022 18:15:48 GMT","Content-Type":"application/json","Content-Length":"264","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"2c4d5303-a9b9-4dc7-8b17-122bddca8374","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5994","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"reason":"Created","json_body":{"meta":{"query_time":0.059549469,"powered_by":"empower-api","tra...` ## Get File Analysis Retrieve the status of a sandbox file analysis in CrowdStrike Falcon by specifying the 'ids' parameter. ### Endpoint - **URL:** `/falconx/entities/submissions/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------- | | `parameters.ids` | array | Required | Parameters for the Get File Analysis action | ### Input Example `{"parameters":{"ids":["inc:4e400866e4d8462a9d1824eb52ca2516:c8a3075e582a46dd86da7a35ab1e73e3"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Get Incidents IDs Retrieve a list of incident IDs from CrowdStrike Falcon based on specified search parameters. ### Endpoint - **URL:** `incidents/queries/incidents/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------- | | `parameters.sort` | string | Optional | Parameters for the Get Incidents IDs action | | `parameters.filter` | string | Optional | Parameters for the Get Incidents IDs action | | `parameters.offset` | string | Optional | Parameters for the Get Incidents IDs action | | `parameters.limit` | number | Optional | Parameters for the Get Incidents IDs action | ### Input Example `{"parameters":{"sort":"assigned_to.asc","filter":"start:>='2020-06-02T22:15:57Z'","offset":"0","limit":500}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | | `errors` | array | Error message if any | | `errors.file_name` | string | Name of the resource | | `errors.file` | string | Error message if any | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Fri, 21 Oct 2022 17:34:49 GMT","Content-Type":"application/json","Content-Length":"273","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"e832d840-8e96-4ed3-aafd-33f5613f3c0b","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.00960287,...` ## Get Reports by IDs Obtain detailed sandbox analysis reports from CrowdStrike Falcon using specific report IDs provided in parameters. ### Endpoint - **URL:** `falconx/entities/reports/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | -------------------------------------------- | | `parameters.ids` | array | Required | Parameters for the Get Reports by IDs action | ### Input Example `{"parameters":{"ids":["123qweawdkjslkfjadjio1rjfieawfnisd"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Query Reports Finds sandbox reports in CrowdStrike Falcon using an FQL filter and paging, requiring specific parameters for execution. ### Endpoint - **URL:** `falconx/queries/reports/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------- | | `parameters.offset` | string | Optional | Parameters for the Query Reports action | | `parameters.limit` | number | Optional | Parameters for the Query Reports action | | `parameters.sort` | string | Optional | Parameters for the Query Reports action | | `parameters.filter` | string | Optional | Parameters for the Query Reports action | ### Input Example `{"parameters":{"offset":"0","limit":100,"sort":"created_at|asc","filter":"name:'report123'"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Get Results From Vulnerability Keyword Search Retrieve IDs, AIDs, and CVEs related to a specified vulnerability keyword in CrowdStrike Falcon, applying custom filters. Requires keyword and filter in the JSON body. ### Endpoint - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------------------------------------------ | | `keyword` | string | Optional | Keyword for filtering vulnerabilities. | | `filter` | string | Optional | Filter the vulnerabilities based on status, exploit status, expert rating etc. | | `test_mode` | boolean | Optional | Toggle to run a quick test. | ### Input Example `{"json_body":{"keyword":"chrome","test_mode":true}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------------- | -------- | ------------------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `ids` | array | Unique identifier | | `aids` | array | Unique identifier | | `cves` | array | Output field: cves | | `host_info` | object | Output field: host\_info | | `host_info.f06292f397d5438e9cb61faf97aa0726` | object | Output field: host\_info.f06292f397d5438e9cb61faf97aa0726 | | `host_info.f06292f397d5438e9cb61faf97aa0726.hostname` | string | Name of the resource | | `host_info.f06292f397d5438e9cb61faf97aa0726.local_ip` | string | Output field: host\_info.f06292f397d5438e9cb61faf97aa0726.local\_ip | | `host_info.fd3655157efd4d96977cbfd20dfba071` | object | Output field: host\_info.fd3655157efd4d96977cbfd20dfba071 | | `host_info.fd3655157efd4d96977cbfd20dfba071.hostname` | string | Name of the resource | | `host_info.fd3655157efd4d96977cbfd20dfba071.local_ip` | string | Output field: host\_info.fd3655157efd4d96977cbfd20dfba071.local\_ip | | `host_info.2aba60819e344f939811b55a9af52d3f` | object | Output field: host\_info.2aba60819e344f939811b55a9af52d3f | | `host_info.2aba60819e344f939811b55a9af52d3f.hostname` | string | Name of the resource | | `host_info.2aba60819e344f939811b55a9af52d3f.local_ip` | string | Output field: host\_info.2aba60819e344f939811b55a9af52d3f.local\_ip | | `host_info.6ec71e642bac41c790fe263043604c97` | object | Output field: host\_info.6ec71e642bac41c790fe263043604c97 | | `host_info.6ec71e642bac41c790fe263043604c97.hostname` | string | Name of the resource | | `host_info.6ec71e642bac41c790fe263043604c97.local_ip` | string | Output field: host\_info.6ec71e642bac41c790fe263043604c97.local\_ip | | `host_info.35ee5ec29c734a54add3470bb290837b` | object | Output field: host\_info.35ee5ec29c734a54add3470bb290837b | | `host_info.35ee5ec29c734a54add3470bb290837b.hostname` | string | Name of the resource | | `host_info.35ee5ec29c734a54add3470bb290837b.local_ip` | string | Output field: host\_info.35ee5ec29c734a54add3470bb290837b.local\_ip | ### Output Example `{"status_code":200,"json_body":{"ids":["7c5ab944bddb43cd8614686d5d5a2dd1_b144007d1bcb36a68bea0f9b1158a3d1","e2b1964cea2b49bea5f6a44cc61da9ac_b144007d1bcb36a68bea0f9b1158a3d1","8615632cb69a43ce9432ebbaf5ff7f16_01bbf023d3e53b27be58cf5158448733"],"aids":["a3b12addd4d14b959596d4e7c0cdd716","5f7b99fcde0a42cca5d0c4be8c061a80","3d30d861ee0d40f5b7f620b8d0b90c2f"],"cves":["CVE-2023-4863","CVE-2024-7965","CVE-2024-7971"],"host_info":{"f06292f397d5438e9cb61faf97aa0726":{},"fd3655157efd4d96977cbfd20dfba071"...` ## Get RTR Extracted File Contents Retrieve the contents of a file extracted in a CrowdStrike Falcon RTR session using a specific session ID and SHA256. ### Endpoint - **URL:** `real-time-response/entities/extracted-file-contents/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | --------------------------------------------------------- | | `parameters.session_id` | string | Required | Parameters for the Get RTR Extracted File Contents action | | `parameters.sha256` | string | Required | Parameters for the Get RTR Extracted File Contents action | | `parameters.filename` | string | Optional | Parameters for the Get RTR Extracted File Contents action | ### Input Example `{"parameters":{"session_id":"asd123","sha256":"efa256a96af3b556cd3fc9d8b1cf587d72807d7805ced441e8149fc279db422b","filename":"myfile"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `file` | array | Output field: file | | `file.file` | string | Output field: file.file | | `file.file_name` | string | Name of the resource | ### Output Example `{"file":[]}` ## Get RTR Put Files Retrieve files for CrowdStrike Falcon's Real Time Response 'put' command using specified IDs. ### Endpoint - **URL:** `/real-time-response/entities/put-files/v2` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------------- | | `parameters.ids` | array | Required | Parameters for the Get RTR Put Files action | ### Input Example `{"parameters":{"ids":["qwe123"]}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `data` | object | Response data | | `data.errors` | array | Response data | | `data.errors.code` | number | Response data | | `data.errors.id` | string | Response data | | `data.errors.message` | string | Response data | | `data.meta` | object | Response data | | `data.meta.pagination` | object | Response data | | `data.meta.pagination.limit` | number | Response data | | `data.meta.pagination.offset` | number | Response data | | `data.meta.pagination.total` | number | Response data | | `data.meta.powered_by` | string | Response data | | `data.meta.query_time` | number | Response data | | `data.meta.trace_id` | string | Response data | | `data.meta.writes` | object | Response data | | `data.meta.writes.resources_affected` | number | Response data | | `data.resources` | array | Response data | | `data.resources.bucket` | string | Response data | | `data.resources.cid` | string | Response data | | `data.resources.comments_for_audit_log` | string | Response data | | `data.resources.content` | string | Response data | | `data.resources.created_by` | string | Response data | | `data.resources.created_by_uuid` | string | Response data | | `data.resources.created_timestamp` | string | Response data | | `data.resources.description` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Fri, 09 Sep 2022 12:21:15 GMT","Content-Type":"application/json","Content-Length":"149","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"ae976111-9d15-4e08-8fd2-944e29b0a651","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5998","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"data":{"errors":[{}],"meta":{"pagination":{},"powered_by":"string","query_time":0,"trace_id":"s...` ## Get RTR Session Files Retrieve a list of files from a specific CrowdStrike Falcon RTR session using the provided session\_id. ### Endpoint - **URL:** `/real-time-response/entities/file/v2` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ----------------------------------------------- | | `parameters.session_id` | string | Required | Parameters for the Get RTR Session Files action | ### Input Example `{"parameters":{"session_id":"44a70ac4-1482-4cdb-a49f-78eb170ebac4"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ----------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | | `resources.id` | string | Unique identifier | | `resources.cloud_request_id` | string | Unique identifier | | `resources.created_at` | string | Output field: resources.created\_at | | `resources.updated_at` | string | Output field: resources.updated\_at | | `resources.deleted_at` | string | Output field: resources.deleted\_at | | `resources.error_message` | string | Response message | | `resources.name` | string | Name of the resource | | `resources.progress` | number | Output field: resources.progress | | `resources.session_id` | string | Unique identifier | | `resources.sha256` | string | Output field: resources.sha256 | | `resources.size` | number | Output field: resources.size | | `resources.stage` | string | Output field: resources.stage | | `resources.status` | string | Status value | | `resources.complete` | boolean | Output field: resources.complete | | `errors` | array | Error message if any | | `errors.file_name` | string | Name of the resource | | `errors.file` | string | Error message if any | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 20 Oct 2022 17:23:05 GMT","Content-Type":"application/json","Content-Length":"160","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"423cc665-1ac3-4b26-a2ba-5fb778ad0ae7","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"reason":"OK","json_body":{"meta":{"query_time":0.019349868,"powered_by":"empower-api","trace_id...` ## Get RTR Session IDs Retrieve a list of Real Time Response session IDs from CrowdStrike Falcon to aid in incident investigation and response. ### Endpoint - **URL:** `real-time-response/queries/sessions/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------- | ### Input Example `{"parameters":{}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | | `errors` | array | Error message if any | | `errors.file_name` | string | Name of the resource | | `errors.file` | string | Error message if any | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 20 Oct 2022 17:18:21 GMT","Content-Type":"application/json","Content-Length":"323","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"73e24c31-821c-44a0-8689-81348c270689","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5995","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"reason":"OK","json_body":{"meta":{"query_time":0.001995284,"pagination":{},"powered_by":"empowe...` ## Get Scheduled Reports Retrieve scheduled reports from CrowdStrike Falcon using specified report IDs. Requires 'ids' parameter. ### Endpoint - **URL:** `/reports/entities/scheduled-reports/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | --------------------------------------------- | | `parameters.ids` | array | Required | The scheduled report ID to get details about. | ### Input Example `{"parameters":{"ids":["07c38c6536454292b199145fa2903bee"]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `errors` | array | Error message if any | | `errors.code` | number | Error message if any | | `errors.id` | string | Unique identifier | | `errors.message` | string | Response message | | `meta` | object | Output field: meta | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.query_time` | number | Time value | | `meta.trace_id` | string | Unique identifier | | `meta.writes` | object | Output field: meta.writes | | `meta.writes.resources_affected` | number | Output field: meta.writes.resources\_affected | | `resources` | array | Output field: resources | | `resources.api_client_id` | string | Unique identifier | | `resources.can_write` | boolean | Output field: resources.can\_write | | `resources.created_on` | string | Output field: resources.created\_on | | `resources.customer_id` | string | Unique identifier | | `resources.description` | string | Output field: resources.description | | `resources.expiration_on` | string | Output field: resources.expiration\_on | | `resources.id` | string | Unique identifier | | `resources.last_execution` | object | Output field: resources.last\_execution | ### Output Example `{"errors":[{"code":123,"id":"12345678-1234-1234-1234-123456789abc","message":"string"}],"meta":{"pagination":{"limit":123,"offset":123,"total":123},"powered_by":"string","query_time":123,"trace_id":"string","writes":{"resources_affected":123}},"resources":[{"api_client_id":"string","can_write":true,"created_on":"string","customer_id":"string","description":"string","expiration_on":"string","id":"12345678-1234-1234-1234-123456789abc","last_execution":{},"last_updated_on":"string","name":"Example ...` ## Get Scripts Retrieve custom scripts by specified IDs for Real Time Response operations in CrowdStrike Falcon. ### Endpoint - **URL:** `real-time-response/entities/scripts/v2` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ------------------------------------- | | `parameters.ids` | array | Required | Parameters for the Get Scripts action | ### Input Example `{"parameters":{"ids":["d8367f494e9311ea97920662caec3daa_6890622d3b88416f90879f7c3497ac1f","44d5b6154e9211ea800f02e419334184_6890622d3b88416f90879f7c3497ac1f"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | ------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | | `resources.id` | string | Unique identifier | | `resources.name` | string | Name of the resource | | `resources.description` | string | Output field: resources.description | | `resources.file_type` | string | Type of the resource | | `resources.platform` | array | Output field: resources.platform | | `resources.size` | number | Output field: resources.size | | `resources.content` | string | Response content | | `resources.created_by` | string | Output field: resources.created\_by | | `resources.created_by_uuid` | string | Unique identifier | | `resources.created_timestamp` | string | Output field: resources.created\_timestamp | | `resources.modified_by` | string | Output field: resources.modified\_by | | `resources.modified_timestamp` | string | Output field: resources.modified\_timestamp | | `resources.sha256` | string | Output field: resources.sha256 | | `resources.permission_type` | string | Type of the resource | | `resources.run_attempt_count` | number | Count value | | `resources.run_success_count` | number | Whether the operation was successful | | `resources.write_access` | boolean | Output field: resources.write\_access | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 20 Oct 2022 17:50:32 GMT","Content-Type":"application/json","Content-Length":"605","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"07e49eb5-409a-4a44-a233-3037b242ad9c","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5995","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"reason":"OK","json_body":{"meta":{"query_time":0.115900991,"powered_by":"empower-api","trace_id...` ## Get Scripts IDs Obtain Real Time Response script IDs from CrowdStrike Falcon for incident response playbook integration. ### Endpoint - **URL:** `real-time-response/queries/scripts/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ----------------------------------------- | | `parameters.offset` | string | Optional | Parameters for the Get Scripts IDs action | | `parameters.limit` | number | Optional | Parameters for the Get Scripts IDs action | | `parameters.sort` | string | Optional | Parameters for the Get Scripts IDs action | | `parameters.filter` | string | Optional | Parameters for the Get Scripts IDs action | ### Input Example `{"parameters":{"offset":"0","limit":100,"sort":"created_at|asc","filter":"name:'script-1.ps1'"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 20 Oct 2022 17:37:05 GMT","Content-Type":"application/json","Content-Length":"650","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"31159bff-08b4-4175-a561-e6b7aa7f70c4","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"reason":"OK","json_body":{"meta":{"query_time":0.019319069,"pagination":{},"powered_by":"empowe...` ## Get User IDs Retrieve a list of unique user IDs from CrowdStrike Falcon for system user identification. ### Endpoint - **URL:** `user-management/queries/users/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | -------------------------------------- | | `parameters.filter` | string | Optional | Parameters for the Get User IDs action | | `parameters.limit` | number | Optional | Parameters for the Get User IDs action | | `parameters.offset` | number | Optional | Parameters for the Get User IDs action | | `parameters.sort` | string | Optional | Parameters for the Get User IDs action | ### Input Example `{"parameters":{"filter":"","limit":1,"offset":0,"sort":"uid|asc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Mon, 09 Jan 2023 23:11:38 GMT","Content-Type":"application/json","Content-Length":"222","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"97f3a15e-2472-49ef-af72-1d675c122098","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5997"},"reason":"OK","json_body":{"meta":{"query_time":0.005224134...` ## Get Host Info Retrieve detailed information for specified hosts in CrowdStrike Falcon using their unique IDs. ### Endpoint - **URL:** `/devices/entities/devices/v2` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------- | | `ids` | array | Optional | Unique identifier | ### Input Example `{"json_body":{"ids":["4e400866e4d8462a9d1824eb52ca2516","e4c65cfccae64aa68271cb9d947543f6","cbfa8e6cecb1400993830b1b9d6d98f4"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | ------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | | `resources.device_id` | string | Unique identifier | | `resources.cid` | string | Unique identifier | | `resources.agent_load_flags` | string | Output field: resources.agent\_load\_flags | | `resources.agent_local_time` | string | Time value | | `resources.agent_version` | string | Output field: resources.agent\_version | | `resources.bios_manufacturer` | string | Output field: resources.bios\_manufacturer | | `resources.bios_version` | string | Output field: resources.bios\_version | | `resources.build_number` | string | Output field: resources.build\_number | | `resources.config_id_base` | string | Unique identifier | | `resources.config_id_build` | string | Unique identifier | | `resources.config_id_platform` | string | Unique identifier | | `resources.cpu_signature` | string | Output field: resources.cpu\_signature | | `resources.external_ip` | string | Output field: resources.external\_ip | | `resources.mac_address` | string | Output field: resources.mac\_address | | `resources.hostname` | string | Name of the resource | | `resources.first_seen` | string | Output field: resources.first\_seen | | `resources.last_seen` | string | Output field: resources.last\_seen | | `resources.local_ip` | string | Output field: resources.local\_ip | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 18 Oct 2022 22:01:51 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"fa8f0e31-b0b0-4f71-a82e-aed99cff4785","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.00...` ## Search Host Execute a search across all hosts in CrowdStrike Falcon using a specified Falcon Query Language (FQL) query. ### Endpoint - **URL:** `/devices/queries/devices/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------- | | `parameters.offset` | number | Optional | Parameters for the Search Host action | | `parameters.limit` | number | Optional | Parameters for the Search Host action | | `parameters.sort` | string | Optional | Parameters for the Search Host action | | `parameters.filter` | string | Optional | Parameters for the Search Host action | ### Input Example `{"parameters":{"offset":0,"limit":1,"sort":"first_behavior","filter":"filter expression"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | | `errors` | array | Error message if any | | `errors.file_name` | string | Name of the resource | | `errors.file` | string | Error message if any | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 18 Oct 2022 21:36:02 GMT","Content-Type":"application/json","Content-Length":"267","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"3c0f732c-44bc-42f2-8b21-582b4054486b","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.005665941...` ## Get Incidents Retrieve detailed information for specified incidents in CrowdStrike Falcon using unique incident identifiers provided in the JSON body. ### Endpoint - **URL:** `incidents/entities/incidents/GET/v1` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------- | | `ids` | array | Optional | Unique identifier | ### Input Example `{"json_body":{"ids":["inc:4e400866e4d8462a9d1824eb52ca2516:c8a3075e582a46dd86da7a35ab1e73e3"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | ------------------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | | `resources.incident_id` | string | Unique identifier | | `resources.incident_type` | number | Unique identifier | | `resources.cid` | string | Unique identifier | | `resources.host_ids` | array | Unique identifier | | `resources.hosts` | array | Output field: resources.hosts | | `resources.hosts.device_id` | string | Unique identifier | | `resources.hosts.cid` | string | Unique identifier | | `resources.hosts.agent_load_flags` | string | Output field: resources.hosts.agent\_load\_flags | | `resources.hosts.agent_local_time` | string | Time value | | `resources.hosts.agent_version` | string | Output field: resources.hosts.agent\_version | | `resources.hosts.bios_manufacturer` | string | Output field: resources.hosts.bios\_manufacturer | | `resources.hosts.bios_version` | string | Output field: resources.hosts.bios\_version | | `resources.hosts.config_id_base` | string | Unique identifier | | `resources.hosts.config_id_build` | string | Unique identifier | | `resources.hosts.config_id_platform` | string | Unique identifier | | `resources.hosts.external_ip` | string | Output field: resources.hosts.external\_ip | | `resources.hosts.hostname` | string | Name of the resource | | `resources.hosts.first_seen` | string | Output field: resources.hosts.first\_seen | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Wed, 19 Oct 2022 21:08:34 GMT","Content-Type":"application/json","Content-Length":"984","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"ed44f4f3-d445-43df-8f19-97e27c1b07fc","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5993"},"reason":"OK","json_body":{"meta":{"query_time":0.050719544...` ## Create Indicator Create a new threat intelligence indicator in CrowdStrike Falcon using the specified JSON body format. ### Endpoint - **URL:** `iocs/entities/indicators/v1` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------ | -------- | ------------ | ------------------------------ | | `comment` | string | Optional | Parameter for Create Indicator | | `indicators` | array | Optional | Parameter for Create Indicator | | `indicators.action` | string | Optional | Parameter for Create Indicator | | `indicators.applied_globally` | boolean | Optional | Parameter for Create Indicator | | `indicators.description` | string | Optional | Parameter for Create Indicator | | `indicators.expiration` | string | Optional | Parameter for Create Indicator | | `indicators.host_groups` | array | Optional | Parameter for Create Indicator | | `indicators.metadata` | object | Optional | Response data | | `indicators.metadata.filename` | string | Optional | Response data | | `indicators.mobile_action` | string | Optional | Parameter for Create Indicator | | `indicators.platforms` | array | Optional | Parameter for Create Indicator | | `indicators.severity` | string | Optional | Parameter for Create Indicator | | `indicators.source` | string | Optional | Parameter for Create Indicator | | `indicators.tags` | array | Optional | Parameter for Create Indicator | | `indicators.type` | string | Optional | Type of the resource | | `indicators.value` | string | Optional | Value for the parameter | ### Input Example `{"comment":"string","indicators":[{"action":"string","applied_globally":true,"description":"string","expiration":"string","host_groups":["string"],"metadata":{"filename":"Example Name"},"mobile_action":"string","platforms":["string"],"severity":"string","source":"string","tags":["string"],"type":"string","value":"string"}]}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ----------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `errors` | object | Error message if any | | `resources` | array | Output field: resources | | `resources.id` | string | Unique identifier | | `resources.type` | string | Type of the resource | | `resources.value` | string | Value for the parameter | | `resources.action` | string | Output field: resources.action | | `resources.severity` | string | Output field: resources.severity | | `resources.platforms` | array | Output field: resources.platforms | | `resources.tags` | array | Output field: resources.tags | | `resources.tags.file_name` | string | Name of the resource | | `resources.tags.file` | string | Output field: resources.tags.file | | `resources.expired` | boolean | Output field: resources.expired | | `resources.deleted` | boolean | Output field: resources.deleted | | `resources.applied_globally` | boolean | Output field: resources.applied\_globally | | `resources.from_parent` | boolean | Output field: resources.from\_parent | | `resources.created_on` | string | Output field: resources.created\_on | ### Output Example `{"status_code":201,"response_headers":{"Server":"nginx","Date":"Mon, 17 Oct 2022 18:32:59 GMT","Content-Type":"application/json","Content-Length":"440","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"42dfdd44-d39d-4f40-9e2e-22639b5de5d8","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5995"},"reason":"Created","json_body":{"meta":{"query_time":0.1892...` ## Delete Indicator Remove a specified indicator from CrowdStrike Falcon using the provided parameters. ### Endpoint - **URL:** `iocs/entities/indicators/v1` - **Method:** `DELETE` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------ | | `parameters.filter` | string | Optional | Parameters for the Delete Indicator action | | `parameters.ids` | array | Optional | Parameters for the Delete Indicator action | | `parameters.comment` | string | Optional | Parameters for the Delete Indicator action | ### Input Example `{"parameters":{"filter":"FQL filter","ids":["48e23334c3854063dd96f8dd863b0f98046d35a8dbf0cbe7a30b2eb41b47e31e"],"comment":"The comment why this indicators were deleted"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `errors` | object | Error message if any | | `resources` | array | Output field: resources | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 18 Oct 2022 18:32:58 GMT","Content-Type":"application/json","Content-Length":"207","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"276d1125-e1ff-41a3-bdc6-ff9db65f3d81","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.154435027...` ## Get Indicator Retrieve detailed information for a specific indicator in CrowdStrike Falcon using its unique ID. Requires 'ids' in the JSON body. ### Endpoint - **URL:** `iocs/entities/indicators/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------- | | `ids` | array | Optional | Unique identifier | ### Input Example `{"json_body":{"ids":["48e23334c3854063dd96f8dd863b0f98046d35a8dbf0cbe7a30b2eb41b47e31e"]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ----------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `errors` | object | Error message if any | | `resources` | array | Output field: resources | | `resources.id` | string | Unique identifier | | `resources.type` | string | Type of the resource | | `resources.value` | string | Value for the parameter | | `resources.action` | string | Output field: resources.action | | `resources.severity` | string | Output field: resources.severity | | `resources.platforms` | array | Output field: resources.platforms | | `resources.tags` | array | Output field: resources.tags | | `resources.tags.file_name` | string | Name of the resource | | `resources.tags.file` | string | Output field: resources.tags.file | | `resources.expired` | boolean | Output field: resources.expired | | `resources.deleted` | boolean | Output field: resources.deleted | | `resources.applied_globally` | boolean | Output field: resources.applied\_globally | | `resources.from_parent` | boolean | Output field: resources.from\_parent | | `resources.created_on` | string | Output field: resources.created\_on | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 18 Oct 2022 18:45:23 GMT","Content-Type":"application/json","Content-Length":"441","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"84480a60-2e75-4deb-9abd-44ac034175a1","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5994"},"reason":"OK","json_body":{"meta":{"query_time":0.000457506...` ## Query Indicator Query CrowdStrike Falcon for indicator IDs using 'type' and 'value' parameters to enhance threat intelligence efforts. ### Endpoint - **URL:** `/indicators/queries/devices/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ----------------------------------------- | | `parameters.type` | string | Required | Parameters for the Query Indicator action | | `parameters.value` | string | Required | Parameters for the Query Indicator action | | `parameters.limit` | number | Optional | Parameters for the Query Indicator action | | `parameters.offset` | number | Optional | Parameters for the Query Indicator action | ### Input Example `{"parameters":{"type":"domain","value":"swimlane.com","limit":10,"offset":0}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.offset` | string | Output field: meta.pagination.offset | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.trace_id` | string | Unique identifier | | `meta.entity` | string | Output field: meta.entity | | `resources` | array | Output field: resources | | `errors` | array | Error message if any | | `errors.file_name` | string | Name of the resource | | `errors.file` | string | Error message if any | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 20 Oct 2022 17:06:57 GMT","Content-Type":"application/json","Content-Length":"228","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"7a0bdb09-f1df-48ee-970f-48291e14ea00","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.035178383...` ## Search Indicators Execute a refined search for indicators within CrowdStrike Falcon using specified filter criteria and return matching results. ### Endpoint - **URL:** `iocs/queries/indicators/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------- | | `parameters.filter` | string | Required | Parameters for the Search Indicators action | | `parameters.offset` | number | Optional | Parameters for the Search Indicators action | | `parameters.limit` | number | Optional | Parameters for the Search Indicators action | | `parameters.sort` | string | Optional | Parameters for the Search Indicators action | | `parameters.after` | string | Optional | Parameters for the Search Indicators action | ### Input Example `{"parameters":{"filter":"value: 'swimlane.com'","offset":0,"limit":10,"sort":"action","after":"pagination_token"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.after` | string | Output field: meta.pagination.after | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `errors` | object | Error message if any | | `resources` | array | Output field: resources | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 18 Oct 2022 18:22:49 GMT","Content-Type":"application/json","Content-Length":"362","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"49884bfe-e178-45a0-84e0-dd8445d67abc","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.013260798...` ## Update Indicator Update specific indicator details within the CrowdStrike Falcon platform to maintain accurate threat intelligence. ### Endpoint - **URL:** `iocs/entities/indicators/v1` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ------------------------------------------ | | `parameters.retrodetects` | boolean | Optional | Parameters for the Update Indicator action | | `parameters.ignore_warnings` | boolean | Optional | Parameters for the Update Indicator action | | `bulk_update` | object | Optional | Date value | | `bulk_update.action` | string | Optional | Parameter for Update Indicator | | `bulk_update.applied_globally` | boolean | Optional | Parameter for Update Indicator | | `bulk_update.description` | string | Optional | Parameter for Update Indicator | | `bulk_update.expiration` | string | Optional | Parameter for Update Indicator | | `bulk_update.filter` | string | Optional | Parameter for Update Indicator | | `bulk_update.from_parent` | boolean | Optional | Parameter for Update Indicator | | `bulk_update.host_groups` | array | Optional | Parameter for Update Indicator | | `bulk_update.metadata` | object | Optional | Response data | | `bulk_update.metadata.filename` | string | Optional | Response data | | `bulk_update.mobile_action` | string | Optional | Parameter for Update Indicator | | `bulk_update.platforms` | array | Optional | Parameter for Update Indicator | | `bulk_update.severity` | string | Optional | Parameter for Update Indicator | | `bulk_update.source` | string | Optional | Parameter for Update Indicator | | `bulk_update.tags` | array | Optional | Parameter for Update Indicator | | `comment` | string | Optional | Parameter for Update Indicator | | `indicators` | array | Optional | Parameter for Update Indicator | | `indicators.action` | string | Optional | Parameter for Update Indicator | | `indicators.applied_globally` | boolean | Optional | Parameter for Update Indicator | | `indicators.description` | string | Optional | Parameter for Update Indicator | | `indicators.expiration` | string | Optional | Parameter for Update Indicator | | `indicators.host_groups` | array | Optional | Parameter for Update Indicator | | `indicators.id` | string | Optional | Unique identifier | ### Input Example `{"parameters":{"retrodetects":true,"ignore_warnings":true},"bulk_update":{"action":"string","applied_globally":true,"description":"string","expiration":"string","filter":"string","from_parent":true,"host_groups":["string"],"metadata":{"filename":"Example Name"},"mobile_action":"string","platforms":["string"],"severity":"string","source":"string","tags":["string"]},"comment":"string","indicators":[{"action":"string","applied_globally":true,"description":"string","expiration":"string","host_groups":["string"],"id":"12345678-1234-1234-1234-123456789abc","metadata":{"filename":"Example Name"},"mobile_action":"string","platforms":["string"],"severity":"string","source":"string","tags":["string"]}]}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------- | -------- | ----------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `errors` | object | Error message if any | | `resources` | array | Output field: resources | | `resources.file_name` | string | Name of the resource | | `resources.file` | string | Output field: resources.file | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 18 Oct 2022 19:21:59 GMT","Content-Type":"application/json","Content-Length":"192","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"9b70ab70-9506-4f11-abc8-920efde2034d","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.667011146...` ## Initialize RTR Session Establish A New Real Time Response Session Within CrowdStrike Falcon For Immediate Incident Response. ### Endpoint - **URL:** `real-time-response/entities/sessions/v1` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | ------------------------------------ | | `paramters` | object | Optional | Parameter for Initialize RTR Session | | `paramters.timeout` | number | Optional | Parameter for Initialize RTR Session | | `paramters.timeout_duration` | string | Optional | Parameter for Initialize RTR Session | | `device_id` | string | Optional | Unique identifier | | `origin` | string | Optional | Parameter for Initialize RTR Session | | `queue_offline` | boolean | Optional | Parameter for Initialize RTR Session | ### Input Example `{"json_body":{"device_id":"985a4275d7ae4e34be339c68d43cc81a","origin":"string","queue_offline":true},"paramters":{"timeout":300,"timeout_duration":"1m"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `data` | object | Response data | | `data.meta` | object | Response data | | `data.meta.query_time` | number | Response data | | `data.meta.powered_by` | string | Response data | | `data.meta.trace_id` | string | Response data | | `data.resources` | array | Response data | | `data.resources.session_id` | string | Response data | | `data.resources.scripts` | array | Response data | | `data.resources.scripts.command` | string | Response data | | `data.resources.scripts.description` | string | Response data | | `data.resources.scripts.examples` | string | Response data | | `data.resources.scripts.internal_only` | boolean | Response data | | `data.resources.scripts.runnable` | boolean | Response data | | `data.resources.scripts.sub_commands` | array | Response data | | `data.resources.scripts.sub_commands.file_name` | string | Response data | | `data.resources.scripts.sub_commands.file` | string | Response data | | `data.resources.scripts.args` | array | Response data | | `data.resources.scripts.args.id` | number | Response data | | `data.resources.scripts.args.created_at` | string | Response data | | `data.resources.scripts.args.updated_at` | string | Response data | | `data.resources.scripts.args.script_id` | number | Response data | | `data.resources.scripts.args.arg_type` | string | Response data | | `data.resources.scripts.args.data_type` | string | Response data | | `data.resources.scripts.args.requires_value` | boolean | Response data | ### Output Example `{"status_code":201,"response_headers":{"Server":"nginx","Date":"Wed, 07 Sep 2022 11:23:32 GMT","Content-Type":"application/json","Content-Length":"1924","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"91ceb5e2-dd30-440c-b4ee-d63aa0e6b2df","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5999","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"data":{"meta":{"query_time":1.504846194,"powered_by":"empower-api","trace_id":"91ceb5e2-dd30-4...` ## Launch Scheduled Reports Initiate execution of scheduled reports in CrowdStrike Falcon using provided ID(s) and report details. ### Endpoint - **URL:** `/reports/entities/scheduled-reports/execution/v1` - **Method:** `POST` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `errors` | array | Error message if any | | `errors.code` | number | Error message if any | | `errors.id` | string | Unique identifier | | `errors.message` | string | Response message | | `meta` | object | Output field: meta | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.query_time` | number | Time value | | `meta.trace_id` | string | Unique identifier | | `meta.writes` | object | Output field: meta.writes | | `meta.writes.resources_affected` | number | Output field: meta.writes.resources\_affected | | `resources` | array | Output field: resources | | `resources.can_write` | boolean | Output field: resources.can\_write | | `resources.created_on` | string | Output field: resources.created\_on | | `resources.customer_id` | string | Unique identifier | | `resources.execution_metadata` | object | Response data | | `resources.execution_metadata.report_params` | object | Response data | | `resources.execution_metadata.report_params.columns` | array | Response data | | `resources.execution_metadata.report_params.dashboard_id` | string | Response data | | `resources.execution_metadata.report_params.dashboard_visibility` | string | Response data | ### Output Example `{"errors":[{"code":123,"id":"12345678-1234-1234-1234-123456789abc","message":"string"}],"meta":{"pagination":{"limit":123,"offset":123,"total":123},"powered_by":"string","query_time":123,"trace_id":"string","writes":{"resources_affected":123}},"resources":[{"can_write":true,"created_on":"string","customer_id":"string","execution_metadata":{},"expiration_on":"string","id":"12345678-1234-1234-1234-123456789abc","job_reference":"string","last_updated_on":"string","report_file_reference":"string","r...` ## Manage Scans Initiate, schedule, or control on-demand Windows scans in CrowdStrike Falcon using specified host and file path details. ### Endpoint - **URL:** `/ods/entities/scans/v1` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | -------------------------- | | `hosts` | array | Optional | Parameter for Manage Scans | | `host_groups` | array | Optional | Parameter for Manage Scans | | `file_paths` | array | Optional | Parameter for Manage Scans | | `scan_exclusions` | array | Optional | Parameter for Manage Scans | | `initiated_from` | string | Optional | Parameter for Manage Scans | | `cpu_priority` | number | Optional | Parameter for Manage Scans | | `description` | string | Optional | Parameter for Manage Scans | | `quarantine` | boolean | Optional | Parameter for Manage Scans | | `endpoint_notification` | boolean | Optional | Parameter for Manage Scans | | `pause_duration` | number | Optional | Parameter for Manage Scans | | `sensor_ml_level_detection` | number | Optional | Parameter for Manage Scans | | `sensor_ml_level_prevention` | number | Optional | Parameter for Manage Scans | | `cloud_ml_level_detection` | number | Optional | Parameter for Manage Scans | | `cloud_ml_level_prevention` | number | Optional | Parameter for Manage Scans | | `max_duration` | number | Optional | Parameter for Manage Scans | ### Input Example `{"json_body":{"hosts":["49d80845335940c888b88bbaa632bd7e"],"host_groups":[""],"file_paths":["C:\\WINDOWS\\Explorer.EXE"],"scan_exclusions":[""],"initiated_from":"falcon_adhoc","cpu_priority":1,"description":"test APIS ","quarantine":true,"endpoint_notification":true,"pause_duration":2,"sensor_ml_level_detection":2,"sensor_ml_level_prevention":2,"cloud_ml_level_detection":2,"cloud_ml_level_prevention":2,"max_duration":2}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.writes` | object | Output field: meta.writes | | `meta.writes.resources_affected` | number | Output field: meta.writes.resources\_affected | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | | `resources.id` | string | Unique identifier | | `resources.cid` | string | Unique identifier | | `resources.profile_id` | string | Unique identifier | | `resources.description` | string | Output field: resources.description | | `resources.file_paths` | array | Output field: resources.file\_paths | | `resources.initiated_from` | string | Output field: resources.initiated\_from | | `resources.quarantine` | boolean | Output field: resources.quarantine | | `resources.cpu_priority` | number | Output field: resources.cpu\_priority | | `resources.preemption_priority` | number | Output field: resources.preemption\_priority | | `resources.metadata` | array | Response data | | `resources.metadata.host_id` | string | Response data | | `resources.metadata.scan_host_metadata_id` | string | Response data | | `resources.metadata.filecount` | object | Response data | | `resources.metadata.last_updated` | string | Response data | | `resources.filecount` | object | Count value | | `resources.status` | string | Status value | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 02 Nov 2023 16:43:41 GMT","Content-Type":"application/json","Content-Length":"231","Connection":"keep-alive","X-Content-Type-Options":"nosniff","X-Cs-Traceid":"c346f1ac-873b-4794-b85f-f35b9a6b7884","X-Ratelimit-Limit":"15","X-Ratelimit-Remaining":"14","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"reason":"OK","json_body":{"meta":{"query_time":0.207790105,"writes":{},"powered_by":"svc-odsapi","trace_id":"e4...` ## Perform Device Action Execute a specified action on multiple devices in CrowdStrike Falcon using their IDs and the chosen action name. ### Endpoint - **URL:** `devices/entities/devices-actions/v2` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ----------------------------------------------- | | `parameters.action_name` | string | Required | Parameters for the Perform Device Action action | | `action_parameters` | array | Optional | Parameters for the Perform Device Action action | | `action_parameters.name` | string | Optional | Parameters for the Perform Device Action action | | `action_parameters.value` | string | Optional | Parameters for the Perform Device Action action | | `ids` | array | Optional | Unique identifier | ### Input Example `{"parameters":{"action_name":"unhide_host"},"json_body":{"action_parameters":[{"name":"name","value":"value"}],"ids":["985a4275d7ae4e34be339c68d43cc81a"]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | | `resources.id` | string | Unique identifier | | `resources.path` | string | Output field: resources.path | | `errors` | array | Error message if any | | `errors.file_name` | string | Name of the resource | | `errors.file` | string | Error message if any | ### Output Example `{"status_code":202,"response_headers":{"Server":"nginx","Date":"Thu, 20 Oct 2022 15:41:32 GMT","Content-Type":"application/json","Content-Length":"214","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"9a624a54-733b-41cd-9fae-fce985b7ea10","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5994"},"reason":"Accepted","json_body":{"meta":{"query_time":14.05...` ## Perform Incident Action Execute specified actions on multiple incidents in CrowdStrike Falcon using provided 'ids' and 'action\_parameters'. ### Endpoint - **URL:** `incidents/entities/incident-actions/v1` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------------- | | `ids` | array | Optional | Unique identifier | | `action_parameters` | array | Optional | Parameters for the Perform Incident Action action | | `action_parameters.name` | string | Required | Parameters for the Perform Incident Action action | | `action_parameters.value` | string | Required | Parameters for the Perform Incident Action action | ### Input Example `{"json_body":{"ids":["inc:4e400866e4d8462a9d1824eb52ca2516:50e5a788a8b14ca4ad23aa909bd16efb"],"action_parameters":[{"name":"update_name","value":"Renamed incident"}]}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | | `resources.file_name` | string | Name of the resource | | `resources.file` | string | Output field: resources.file | | `errors` | array | Error message if any | | `errors.file_name` | string | Name of the resource | | `errors.file` | string | Error message if any | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 20 Oct 2022 15:55:00 GMT","Content-Type":"application/json","Content-Length":"160","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"eede97f3-8a60-476a-934d-d4051d4f4a37","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.063349771...` ## Query Behaviors Retrieve CrowdStrike Falcon behaviors using an FQL filter with sorting and paging options. ### Endpoint - **URL:** `/incidents/queries/behaviors/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------- | | `parameters.filter` | string | Optional | Optional filter and sort criteria in the form of an FQL query. | | `parameters.offset` | number | Optional | Starting index of overall result set from which to return ids. | | `parameters.limit` | number | Optional | The maximum records to return. \[1-500] | | `parameters.sort` | string | Optional | The property to sort on, followed by a dot (.), followed by the sort direction, either "asc" or "desc". | ### Input Example `{"parameters":{"filter":"filepath: test","offset":0,"limit":100,"sort":"alert_ids.asc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | | `resources.file_name` | string | Name of the resource | | `resources.file` | string | Output field: resources.file | | `errors` | array | Error message if any | | `errors.file_name` | string | Name of the resource | | `errors.file` | string | Error message if any | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 22 Jul 2025 08:38:10 GMT","Content-Type":"application/json","Content-Length":"198","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"98aa8db9-a69d-4b87-907a-2393919c8f11","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5951"},"reason":"OK","json_body":{"meta":{"query_time":0.015020273...` ## Query Host by Indicator Locate hosts in CrowdStrike Falcon that have observed a specified custom Indicator of Compromise (IOC) using type and value parameters. ### Endpoint - **URL:** `/indicators/queries/devices/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ------------------------------------------------- | | `parameters.type` | string | Required | Parameters for the Query Host by Indicator action | | `parameters.value` | string | Required | Parameters for the Query Host by Indicator action | | `parameters.limit` | string | Optional | Parameters for the Query Host by Indicator action | | `parameters.offset` | string | Optional | Parameters for the Query Host by Indicator action | ### Input Example `{"parameters":{"type":"domain","value":"swimlane.com","limit":"10","offset":"0"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.offset` | string | Output field: meta.pagination.offset | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.trace_id` | string | Unique identifier | | `meta.entity` | string | Output field: meta.entity | | `resources` | array | Output field: resources | | `errors` | array | Error message if any | | `errors.file_name` | string | Name of the resource | | `errors.file` | string | Error message if any | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Fri, 21 Oct 2022 20:45:11 GMT","Content-Type":"application/json","Content-Length":"228","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"0e57fcdc-6e9e-4cd3-b493-b6fde9f7a66f","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.035884016...` ## Query Scheduled Reports Retrieve a list of report IDs from CrowdStrike Falcon based on specified query and filter criteria. ### Endpoint - **URL:** `/reports/queries/scheduled-reports/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.sort` | string | Optional | Possible order by fields created\_on, last\_updated\_on, last\_execution\_on, next\_execution\_on. | | `parameters.filter` | string | Optional | FQL query specifying the filter parameters. Filter term criteria - type, trigger\_reference, recipients, user\_uuid, cid, trigger\_params.metadata. Filter range criteria - created\_on, modified\_on; use any common date format, such as '2010-05-15T14:55:21.892315096Z'. | | `parameters.q` | string | Optional | Match query criteria, which includes all the filter string fields. | | `parameters.offset` | string | Optional | Starting index of overall result set from which to return IDs. | | `parameters.limit` | number | Optional | Number of IDs to return. | ### Input Example `{"parameters":{"sort":"created_on","filter":"trigger_reference","q":"","offset":"","limit":3}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `meta.writes` | object | Output field: meta.writes | | `meta.writes.resources_affected` | number | Output field: meta.writes.resources\_affected | | `resources` | array | Output field: resources | | `errors` | array | Error message if any | | `errors.code` | number | Error message if any | | `errors.id` | string | Unique identifier | | `errors.message` | string | Response message | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 16 Jan 2025 10:40:08 GMT","Content-Type":"application/json","Content-Length":"245","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"2bd55126-bb08-44d4-905f-450da0f88a47","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5998"},"reason":"OK","json_body":{"meta":{"query_time":0.030274587...` ## Retrieve Scans by ID. Retrieve detailed information for specific scans in CrowdStrike Falcon using their unique identifiers. Requires 'ids' as input parameter. ### Endpoint - **URL:** `/ods/entities/scans/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------- | -------- | ------------ | ----------------------------------------------- | | `parameters.ids` | string | Required | Parameters for the Retrieve Scans by ID. action | ### Input Example `{"parameters":{"ids":"a69fbc6555704446a10314b70d19955c"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.writes` | object | Output field: meta.writes | | `meta.writes.resources_affected` | number | Output field: meta.writes.resources\_affected | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | | `resources.id` | string | Unique identifier | | `resources.cid` | string | Unique identifier | | `resources.profile_id` | string | Unique identifier | | `resources.description` | string | Output field: resources.description | | `resources.file_paths` | array | Output field: resources.file\_paths | | `resources.initiated_from` | string | Output field: resources.initiated\_from | | `resources.quarantine` | boolean | Output field: resources.quarantine | | `resources.cpu_priority` | number | Output field: resources.cpu\_priority | | `resources.preemption_priority` | number | Output field: resources.preemption\_priority | | `resources.metadata` | array | Response data | | `resources.metadata.host_id` | string | Response data | | `resources.metadata.host_scan_id` | string | Response data | | `resources.metadata.scan_host_metadata_id` | string | Response data | | `resources.metadata.filecount` | object | Response data | | `resources.metadata.filecount.scanned` | number | Response data | | `resources.metadata.filecount.malicious` | number | Response data | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Tue, 07 Nov 2023 16:30:27 GMT","Content-Type":"application/json","Content-Length":"1018","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"15c0882f-1bf6-4529-8cbd-cf81c12e4dc9","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5996"},"reason":"OK","json_body":{"meta":{"query_time":0.02398445...` ## RTR CMD Result Retrieve results of a Real Time Response command in CrowdStrike Falcon using cloud\_request\_id and sequence\_id. ### Endpoint - **URL:** `/real-time-response/entities/admin-command/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | ---------------------------------------- | | `parameters.cloud_request_id` | string | Required | Parameters for the RTR CMD Result action | | `parameters.sequence_id` | number | Required | Parameters for the RTR CMD Result action | ### Input Example `{"parameters":{"cloud_request_id":"505891fe-2b81-4531-baf0-d4bfc8d38107","sequence_id":0}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | | `resources.session_id` | string | Unique identifier | | `resources.task_id` | string | Unique identifier | | `resources.complete` | boolean | Output field: resources.complete | | `resources.stdout` | string | Output field: resources.stdout | | `resources.stderr` | string | Output field: resources.stderr | | `resources.base_command` | string | Output field: resources.base\_command | | `errors` | array | Error message if any | | `errors.file_name` | string | Name of the resource | | `errors.file` | string | Error message if any | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Thu, 20 Oct 2022 18:34:29 GMT","Content-Type":"application/json","Content-Length":"875","Connection":"keep-alive","Content-Encoding":"gzip","X-Cs-Region":"us-1","X-Cs-Traceid":"7357b311-85cd-4d26-abdd-8e57e16f3dfb","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5995","Strict-Transport-Security":"max-age=31536000; includeSubDomains"},"reason":"OK","json_body":{"meta":{"query_time":0.321708212,"powered_by":"empower-api","trace_id...` ## Search Reports Locate and filter CrowdStrike Falcon report IDs by using a query with specific parameters to refine search results. ### Endpoint - **URL:** `reports/queries/scheduled-reports/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ---------------------------------------- | | `parameters.q` | string | Optional | Parameters for the Search Reports action | | `parameters.filter` | string | Optional | Parameters for the Search Reports action | | `parameters.sort` | string | Optional | Parameters for the Search Reports action | | `parameters.offset` | string | Optional | Parameters for the Search Reports action | | `parameters.limit` | number | Optional | Parameters for the Search Reports action | ### Input Example `{"parameters":{"q":"match query criteria","filter":"created_on:2010-05-15T14:55:21.892315096Z","sort":"created_on","offset":"0","limit":100}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Submit File Analysis Upload a file to CrowdStrike Falcon for sandbox analysis, specifying the environment using the 'sandbox' parameter. ### Endpoint - **URL:** `falconx/entities/submissions/v1` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | ---------------------------------- | | `sandbox` | array | Optional | Parameter for Submit File Analysis | | `sandbox.action_script` | string | Optional | Parameter for Submit File Analysis | | `sandbox.command_line` | string | Optional | Parameter for Submit File Analysis | | `sandbox.document_password` | string | Optional | Parameter for Submit File Analysis | | `sandbox.enable_tor` | boolean | Optional | Parameter for Submit File Analysis | | `sandbox.environment_id` | number | Required | Unique identifier | | `sandbox.network_settings` | string | Optional | Parameter for Submit File Analysis | | `sandbox.sha256` | string | Optional | Parameter for Submit File Analysis | | `sandbox.submit_name` | string | Optional | Name of the resource | | `sandbox.system_date` | string | Optional | Date value | | `sandbox.system_time` | string | Optional | Time value | | `sandbox.url` | string | Optional | URL endpoint for the request | | `send_email_notification` | boolean | Optional | Parameter for Submit File Analysis | | `user_tags` | array | Optional | Parameter for Submit File Analysis | ### Input Example `{"sandbox":[{"action_script":"string","command_line":"string","document_password":"string","enable_tor":true,"environment_id":123,"network_settings":"string","sha256":"string","submit_name":"Example Name","system_date":"string","system_time":"string","url":"https://example.com/api/resource"}],"send_email_notification":true,"user_tags":["string"]}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{}` ## Update Detection Update specified detections in CrowdStrike Falcon using a list of detection IDs provided in the JSON body. ### Endpoint - **URL:** `detects/entities/detects/v2` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | ------------------------------ | | `assigned_to_uuid` | string | Optional | Unique identifier | | `comment` | string | Optional | Parameter for Update Detection | | `ids` | array | Optional | Unique identifier | | `show_in_ui` | boolean | Optional | Parameter for Update Detection | | `status` | string | Optional | Status value | ### Input Example `{"json_body":{"assigned_to_uuid":"1234567891234567891","comment":"comment string","ids":["ldt:4e400866e4d8462a9d1824eb52ca2516:64431642420"],"show_in_ui":true,"status":"new"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.writes` | object | Output field: meta.writes | | `meta.writes.resources_affected` | number | Output field: meta.writes.resources\_affected | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.trace_id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Fri, 21 Oct 2022 16:56:04 GMT","Content-Type":"application/json","Content-Length":"165","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"c72a8e5b-d928-415f-9573-e88a469d075d","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5994"},"reason":"OK","json_body":{"meta":{"query_time":0.047651067...` ## Upload File Analysis Upload a file to CrowdStrike Falcon for sandbox analysis, requiring form data and data body inputs. ### Endpoint - **URL:** `samples/entities/samples/v2` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------- | | `form_data` | object | Required | Response data | | `form_data.sample` | array | Required | Content of the uploaded sample in binary format. | | `form_data.sample.file_name` | string | Required | Response data | | `form_data.sample.file` | string | Required | Response data | | `data_body` | object | Required | Response data | | `data_body.file_name` | string | Required | Name of the file. | | `data_body.is_confidential` | boolean | Optional | Defines visibility of this file in Falcon MalQuery, either via the API or the Falcon console. | | `data_body.comment` | string | Optional | A descriptive comment to identify the file for other users. | ### Input Example `{"form_data":{"sample":[{"file_name":"Example Name","file":"string"}]},"data_body":{"file_name":"Example Name","is_confidential":true,"comment":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------- | -------- | --------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `errors` | array | Error message if any | | `errors.code` | number | Error message if any | | `errors.id` | string | Unique identifier | | `errors.message` | string | Response message | | `meta` | object | Output field: meta | | `meta.pagination` | object | Output field: meta.pagination | | `meta.pagination.limit` | number | Output field: meta.pagination.limit | | `meta.pagination.offset` | number | Output field: meta.pagination.offset | | `meta.pagination.total` | number | Output field: meta.pagination.total | | `meta.powered_by` | string | Output field: meta.powered\_by | | `meta.query_time` | number | Time value | | `meta.trace_id` | string | Unique identifier | | `meta.writes` | object | Output field: meta.writes | | `meta.writes.resources_affected` | number | Output field: meta.writes.resources\_affected | | `resources` | array | Output field: resources | ### Output Example `{"status_code":200,"response_headers":{"Server":"nginx","Date":"Wed, 19 Oct 2022 19:53:29 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Content-Encoding":"gzip","Strict-Transport-Security":"max-age=15724800; includeSubDomains, max-age=31536000; includeSubDomains","X-Cs-Region":"us-1","X-Cs-Traceid":"1b07769e-66b4-41fb-a970-9d6a764206ac","X-Ratelimit-Limit":"6000","X-Ratelimit-Remaining":"5995"},"reason":"OK","json_body":{"errors":[{}],"meta":{"pa...` ## Upload RTR Put File Upload a new file to CrowdStrike Falcon for use with the Real Time Response 'put' command. This action requires an attachment. ### Endpoint - **URL:** `real-time-response/entities/put-files/v1` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------ | -------- | ------------ | --------------------------------- | | `attachments` | array | Required | Script to be uploaded | | `attachments.file` | string | Optional | Parameter for Upload RTR Put File | | `attachments.description` | string | Optional | Parameter for Upload RTR Put File | | `attachments.name` | string | Optional | Name of the resource | | `attachments.comments_for_audit_log` | string | Optional | Parameter for Upload RTR Put File | ### Input Example `{"attachments":[{"file":"string","description":"string","name":"Example Name","comments_for_audit_log":"string"}]}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | --------------- | | `data` | object | Response data | | `data.meta` | object | Response data | | `data.meta.query_time` | number | Response data | | `data.meta.writes` | object | Response data | | `data.meta.writes.resources_affected` | number | Response data | | `data.meta.powered_by` | string | Response data | | `data.meta.trace_id` | string | Response data | ### Output Example `{"data":{"meta":{"query_time":0.858507743,"writes":{},"powered_by":"empower","trace_id":"348c03bc-24de-4a17-aa8f-b4a5a2a4cd73"}}}` ## Upload Script Upload a new custom script to CrowdStrike Falcon for Real Time Response, requiring an attachment. ### Endpoint - **URL:** `/real-time-response/entities/scripts/v1` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------ | -------- | ------------ | --------------------------- | | `attachments` | array | Required | Script to be uploaded | | `attachments.file` | string | Optional | Parameter for Upload Script | | `attachments.description` | string | Optional | Parameter for Upload Script | | `attachments.name` | string | Optional | Name of the resource | | `attachments.comments_for_audit_log` | string | Optional | Parameter for Upload Script | | `attachments.permission_type` | string | Optional | Type of the resource | | `attachments.content` | string | Optional | Response content | | `attachments.platform` | array | Optional | Parameter for Upload Script | ### Input Example `{"attachments":[{"file":"string","description":"string","name":"Example Name","comments_for_audit_log":"string","permission_type":"string","content":"string","platform":["string"]}]}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `data` | object | Response data | | `data.meta` | object | Response data | | `data.meta.query_time` | number | Response data | | `data.meta.writes` | object | Response data | | `data.meta.writes.resources_affected` | number | Response data | | `data.meta.powered_by` | string | Response data | | `data.meta.trace_id` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Content-Type":"application/json","Content-Length":"192"},"data":{"meta":{"query_time":0.652933766,"writes":{},"powered_by":"empower","trace_id":"bf90adeb-8c5e-4c0a-928f-688d9c52a54b"}}}` ## Vertex Summary Retrieve a summary of connected edges and vertex data from CrowdStrike Falcon for a specified vertex type and IDs. ### Endpoint - **URL:** `/threatgraph/combined/{{vertex_type}}/summary/v1` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.scope` | string | Optional | Defines what scope you are querying for. For customer scope, use the value "customer". For device scope, use "device" (default). | | `parameters.ids` | string | Required | This represents the identifier of the actual object you're looking for. These IDs should be treated as opaque identifiers and can be retrieved from other ThreatGraph calls. This parameter can be provided up to 100 times to retrieve details on multiple vertices. | | `path_parameters.vertex_type` | string | Required | The vertex that you are looking for. | ### Input Example `{"parameters":{"ids":"mod:2d6c3ed75e024b317ccd855ce584ac01:1788db64ec645c3bd54a6645f956c28593545bcaa22ae4cd12546954a6911e53","scope":"device"},"path_parameters":{"vertex_type":"process"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------------------------- | -------- | ---------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `meta` | object | Output field: meta | | `meta.query_time` | number | Time value | | `meta.trace_id` | string | Unique identifier | | `resources` | array | Output field: resources | | `resources.id` | string | Unique identifier | | `resources.customer_id` | string | Unique identifier | | `resources.scope` | string | Output field: resources.scope | | `resources.device_id` | string | Unique identifier | | `resources.vertex_type` | string | Type of the resource | | `resources.object_id` | string | Unique identifier | | `resources.timestamp` | string | Output field: resources.timestamp | | `resources.properties` | object | Output field: resources.properties | | `resources.properties.ActivePrivilegeEscalationCount` | string | Count value | | `resources.properties.AsepWrittenCount` | string | Count value | | `resources.properties.AuthenticationId` | string | Unique identifier | | `resources.properties.BinaryExecutableWrittenCount` | string | Count value | | `resources.properties.CommandLine` | string | Output field: resources.properties.CommandLine | | `resources.properties.ConHostId` | string | Unique identifier | | `resources.properties.ConfigBuild` | string | Output field: resources.properties.ConfigBuild | | `resources.properties.DirectoryCreatedCount` | string | Count value | | `resources.properties.DnsRequestCount` | string | Count value | | `resources.properties.ExeAndServiceCount` | string | Count value | | `resources.properties.ExecutableDeletedCount` | string | Count value | ### Output Example `{"meta":{"query_time":123,"trace_id":"string"},"resources":[{"id":"12345678-1234-1234-1234-123456789abc","customer_id":"string","scope":"string","device_id":"string","vertex_type":"string","object_id":"string","timestamp":"2024-01-01T00:00:00Z","properties":{},"edges":{}}],"errors":[{"file_name":"Example Name","file":"string"}]}` # Response Headers | **Header** | **Description** | **Example** | | ------------------------- | ----------------------------------------------------------------- | ------------------------------------ | | Connection | HTTP response header: Connection | keep-alive | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | Content-Length | The length of the response body in bytes | 273 | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Tue, 22 Jul 2025 08:38:10 GMT | | Server | Information about the software used by the origin server | nginx | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000; includeSubDomains | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | X-Cs-Region | HTTP response header: X-Cs-Region | us-1 | | X-Cs-Traceid | HTTP response header: X-Cs-Traceid | b353da90-67d7-49f1-8805-21d76bc45c72 | | X-Ratelimit-Limit | The number of requests allowed in the current rate limit window | 6000 | | X-Ratelimit-Remaining | The number of requests remaining in the current rate limit window | 5999 |