Integration · Security and identity
AI agents for CrowdStrike Falcon
Investigate and respond in CrowdStrike Falcon: search the hosts the Falcon sensor protects and read their details, network-contain a compromised host or lift containment, search and read alerts.
- Actions
- 8
- Read
- 5
- Write
- 3
Actions
What your agents can do in CrowdStrike Falcon
Investigate and respond in CrowdStrike Falcon: search the hosts the Falcon sensor protects and read their details, network-contain a compromised host or lift containment, search and read alerts (detections), update an alert's status, assignee, tags or comments, and find open vulnerabilities (Falcon Spotlight). Uses a Falcon API client.
Read 5
Look things up. Nothing changes.
Search hosts
Finds hosts with a Falcon Query Language filter (hostname:'LAPTOP-7*', platform_name:'Windows', local_ip:'10.0.0.5', external_ip:'203.0.113.7', status:'contained', last_seen:>'2026-10-01'…
Get hosts
Reads up to 100 hosts by agent ID (device_id), with every field Search hosts returns plus policies, device_policies, groups, system_manufacturer, system_product_name.
Search alerts
Finds alerts (endpoint detections, identity and cloud alerts), newest first unless sort says otherwise, with a Falcon Query Language filter.
Get alerts
Reads alerts by composite ID with every field: process tree details, parent_details, grandparent_details, ioc_type and ioc_value, quarantined_files, pattern_disposition_description, comments and tags.
Search vulnerabilities
Finds vulnerabilities on hosts with Falcon Spotlight.
Write 3
Create, change or send.
Network-contain hostsDeletes data
Cuts hosts off the network (by agent ID), except for the CrowdStrike cloud and the addresses the containment policy allows, so a compromised machine cannot spread or exfiltrate.
Lift containment
Gives contained hosts (by agent ID) their normal network access back.
Update alerts
Changes alerts by composite ID: set status (new, in_progress, closed, reopened), assign them to a Falcon user (assign_to_user_id, their email), add a comment shown in Falcon, or add a tag.
A person can approve first
Any write action can be set to wait for a person's approval before it runs, so an agent asks before it changes anything. Actions that delete data ask first by default.
Connection
How it connects
Connect it once in the console, then give it to the agents and workflows that need it.
Paste the client ID and secret of an app your organization registered with CrowdStrike Falcon. The platform fetches its tokens itself (OAuth client credentials).
Settings
- Falcon cloud
Kept safe
- Credentials are stored encrypted with your organization's own keys.
- They are opened only by the process that makes the call, at the moment it runs, and never go into a prompt or the browser.
- Calls go only to the tool's own servers.
Ideas
Ideas to start with
Starting points made only from the actions above. Mix them with any other tool your agents can use.
- 01
Ask about your CrowdStrike Falcon data
Ask a question in plain words. The agent can search hosts, get hosts or search alerts in CrowdStrike Falcon, then answers with what it found.
- 02
Let an agent update CrowdStrike Falcon
Have the agent update alerts in CrowdStrike Falcon as part of a larger task. Turn on approval and a person signs off on each change first.
- 03
Share what it finds in Slack
Give one agent CrowdStrike Falcon and Slack: it can search hosts in CrowdStrike Falcon and post a summary to a Slack channel in the same run.
Works well with
More Security and identity tools
- Okta14 actionsFind people and read their groups, apps, MFA factors and sign-in history in Okta, list groups and members, and run joiner and leaver steps.
- Microsoft Entra ID10 actionsFind people and groups in Microsoft Entra ID (formerly Azure Active Directory), read a person's group and role memberships and their sign-in log, add or remove group members, and run leaver and incident steps.
- Google Workspace Admin9 actionsManage people and groups in a Google Workspace domain.
- Wiz7 actionsWork cloud security issues in Wiz: list open issues by severity or type, read one issue with the affected resource and its notes, move it to in progress, resolve or reject it with a reason, add a note.
- Vanta8 actionsTrack compliance in Vanta: see which automated tests are failing and the exact resources (users, buckets, laptops, repos) causing it, progress on each framework.
- 1Password4 actionsWatch a 1Password Business account's security activity through the Events API.
FAQ
CrowdStrike Falcon and MyDeepAgents
Can MyDeepAgents connect to CrowdStrike Falcon?
Yes. The CrowdStrike Falcon connector has 8 actions: 5 read and 3 make changes. Your agents can call them as tools, and your workflows can run them as steps.
How do I connect CrowdStrike Falcon?
Paste the client ID and secret of an app your organization registered with CrowdStrike Falcon. The platform fetches its tokens itself (OAuth client credentials). The connection also asks for: Falcon cloud. Credentials are stored encrypted with your organization's own keys and are opened only at the moment of a call.
Can an agent change data in CrowdStrike Falcon without asking?
Only if you let it. Each of the 3 actions that change data can be set to wait for a person's approval before it runs, and the one that deletes data asks first by default.
Can I use CrowdStrike Falcon in workflows as well as agents?
Yes. Every CrowdStrike Falcon action also works as a step in a workflow, and the same connection serves your agents and your workflows.
Early access
Put CrowdStrike Falcon to work
Connect it in a few minutes, give an agent the actions it needs, and decide which changes wait for a person.