CrowdStrike Falcon Extension

Connect your own CrowdStrike Falcon tenant by saving its cloud region and an OAuth2 API Client (Client ID + Secret), after checking they actually work.

Disconnect a CrowdStrike Falcon tenant: deletes the saved OAuth2 Client ID/Secret. Nothing in CrowdStrike itself is changed.

List the connected CrowdStrike Falcon tenants (region + masked Client ID).

List endpoints (hosts/sensors) in the connected Falcon tenant, optionally filtered by an FQL expression.

Read one endpoint (host/sensor) in full by its Falcon device id.

Network-contain one or more hosts -- isolates them from the network except for traffic to the Falcon cloud. The core incident-response 'stop the bleeding' action.

Lift network containment on one or more hosts, restoring normal network access.

Hide one or more hosts from the Falcon console (does not uninstall the sensor).

Unhide one or more previously hidden hosts.

List sensor-visibility Detections in the connected Falcon tenant, optionally filtered by an FQL expression (e.g. "status:'new'").

Read one Detection in full by its detection id.

Update a Detection's triage status (new/in_progress/true_positive/false_positive/ignored), optionally with a comment and/or assignee.

List correlated Incidents (CrowdScore groupings of related detections) in the connected Falcon tenant.

Read one Incident in full by its incident id.

Update an Incident's status and/or add a tag/comment.

List custom IOCs (Indicators of Compromise) configured on the connected Falcon tenant.

Create a new custom IOC (hash/domain/IP) with a detect/prevent/allow action applied fleet-wide (or to selected platforms).

Permanently delete a custom IOC. Cannot be undone.

List Prevention Policies configured on the connected Falcon tenant, optionally filtered by an FQL expression.

Read one Prevention Policy in full by its id.

Enable or disable a Prevention Policy without deleting it.

Start a Real Time Response (RTR) session on a host, for live read-only investigation (ls, ps, netstat, etc. via run_rtr_command).

Run a read-only RTR command (e.g. 'ls', 'ps', 'netstat', 'ifconfig') in an active RTR session and return its output.

List Spotlight Vulnerabilities (CVE exposure) across the fleet, optionally filtered by an FQL expression (e.g. "cve.severity:'CRITICAL'").

Build one aggregated health report across the connected Falcon tenant: stale hosts, open critical incidents, new detections, and disabled prevention policies.