CONNECT APP
Build with CrowdStrike Falcon
Security
- OAuth
MCP
Give your agent CrowdStrike Falcon tools
Every CrowdStrike Falcon action is exposed as an MCP tool on Pipedream's remote server. Point a client at it with your end user's ID and Connect resolves that user's CrowdStrike Falcon account for each tool call — you store no tokens.
// accessToken: mint a short-lived token with the Connect SDK — see the MCP guide
const transport = new StreamableHTTPClientTransport(
new URL("https://remote.mcp.pipedream.net/v3"),
{
requestInit: {
headers: {
Authorization: `Bearer ${accessToken}`,
"x-pd-project-id": "{project_id}",
"x-pd-environment": "production",
"x-pd-external-user-id": "{external_user_id}", // any stable ID for this user in your system
"x-pd-app-slug": "crowdstrike_falcon",
},
},
},
)
const mcp = new Client({ name: "my-agent", version: "1.0.0" })
await mcp.connect(transport)
const { tools } = await mcp.listTools()
// e.g. run Get Alert:
const result = await mcp.callTool({
name: "crowdstrike_falcon-get-alert",
arguments: {
alertIds: ["Alert IDs"],
includeHidden: true,
},
})# access_token: mint a short-lived token with the Connect SDK — see the MCP guide
headers = {
"Authorization": f"Bearer {access_token}",
"x-pd-project-id": "{project_id}",
"x-pd-environment": "production",
"x-pd-external-user-id": "{external_user_id}", # any stable ID for this user in your system
"x-pd-app-slug": "crowdstrike_falcon",
}
async with streamablehttp_client("https://remote.mcp.pipedream.net/v3", headers=headers) as (read, write, _):
async with ClientSession(read, write) as session:
await session.initialize()
tools = await session.list_tools()
# e.g. run Get Alert:
result = await session.call_tool("crowdstrike_falcon-get-alert", {
"alertIds": ["Alert IDs"],
"includeHidden": True,
})API PROXY
Call the CrowdStrike Falcon API directly
For an endpoint with no pre-built tool, the Connect proxy forwards your request to the CrowdStrike Falcon API with the connected user's credentials attached. You store no tokens and write no refresh logic.
const resp = await pd.proxy.get({
externalUserId: "{external_user_id}", // any stable ID for this user in your system
accountId: "apn_xxxxxxx",
url: "https://api.example.com/v1/me",
})
// Any allowed CrowdStrike Falcon endpoint works here. Pipedream attaches the
// connected account's credentials to the outgoing request.# The path segment is the target URL, URL-safe base64 encoded:
# https://api.example.com/v1/me
curl "https://api.pipedream.com/v1/connect/{project_id}/proxy/aHR0cHM6Ly9hcGkuZXhhbXBsZS5jb20vdjEvbWU?external_user_id={external_user_id}&account_id=apn_xxxxxxx" \
-H "Authorization: Bearer {access_token}" \
-H "x-pd-environment: production"SDK
Run CrowdStrike Falcon actions from your backend
Connect a user's CrowdStrike Falcon account once, then run Get Alert on their behalf from your own code — TypeScript, Python, or plain HTTP.
import { PipedreamClient } from "@pipedream/sdk"
const pd = new PipedreamClient({
projectId: process.env.PIPEDREAM_PROJECT_ID!,
clientId: process.env.PIPEDREAM_CLIENT_ID!,
clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
projectEnvironment: "production",
})
const result = await pd.actions.run({
id: "crowdstrike_falcon-get-alert",
externalUserId: "{external_user_id}", // any stable ID for this user in your system
configuredProps: {
crowdstrike_falcon: { authProvisionId: "apn_xxxxxxx" },
alertIds: ["Alert IDs"],
includeHidden: true,
},
})from pipedream import Pipedream
pd = Pipedream(
client_id="{oauth_client_id}",
client_secret="{oauth_client_secret}",
project_id="{project_id}",
project_environment="production",
)
result = pd.actions.run(
id="crowdstrike_falcon-get-alert",
external_user_id="{external_user_id}", # any stable ID for this user in your system
configured_props={
"crowdstrike_falcon": {"authProvisionId": "apn_xxxxxxx"},
"alertIds": ["Alert IDs"],
"includeHidden": True,
},
)curl -X POST https://api.pipedream.com/v1/connect/{project_id}/actions/run \
-H "Content-Type: application/json" \
-H "X-PD-Environment: production" \
-H "Authorization: Bearer {access_token}" \
-d '{
"external_user_id": "{external_user_id}",
"id": "crowdstrike_falcon-get-alert",
"configured_props": {
"crowdstrike_falcon": { "authProvisionId": "apn_xxxxxxx" },
"alertIds": ["Alert IDs"],
"includeHidden": true
}
}'TOOLS
CrowdStrike Falcon actions
On-demand operations your product or agent can configure and run on behalf of a connected user.
-
Get Alert
actionRetrieve full CrowdStrike Falcon alert records for one or more alert composite IDs via GET /alerts/entities/alerts/v1 (max 1000 per request). Use Search Alerts to find alert IDs first. See the documentation.Read-onlyv0.0.2 -
Get Host
actionRetrieve full CrowdStrike Falcon device records for one or more device IDs via GET /devices/entities/devices/v2, including hostname, os_version, agent_version, status (containment status) and reduced_functionality_mode (sensor health). Use Search Hosts to find device IDs first. See the documentation.Read-onlyv0.0.2 -
Get RTR Command Status
actionRetrieve the status and output of a Real-Time Response command via GET /real-time-response/entities/command/v1, returning stdout, stderr and completion status. Provide the cloud_request_id returned by Run RTR Command. Requires an RTR entitlement. See the documentation.Read-onlyv0.0.2 -
Manage Host Containment
actionManage host containment on one or more CrowdStrike Falcon hosts via POST /devices/entities/devices-actions/v2 (action_namequery param,idsbody). Use Search Hosts or Get Host to find device IDs. See the documentation.Writev0.0.2 -
Run RTR Command
actionInitiate a Real-Time Response (RTR) session on a host and execute a read-only responder command. Calls POST /real-time-response/entities/sessions/v1 to open the session, then POST /real-time-response/entities/command/v1 to run the command; returns the session_id and cloud_request_id. Use Get RTR Command Status with the returned cloud_request_id to fetch results. Requires an RTR entitlement. See the documentation.Writev0.0.2 -
Search Alerts
actionSearch CrowdStrike Falcon alerts and return their IDs via GET /alerts/queries/alerts/v2. Detections are now delivered through the Alerts API (the legacy /detects/* collection was decommissioned), so filter on the alert product to retrieve endpoint detections. Use Get Alert to hydrate the returned IDs into full records. See the documentation.Read-onlyv0.0.2 -
Search Hosts
actionSearch CrowdStrike Falcon hosts and return full device records via GET /devices/combined/devices/v1, includingstatus(containment status),reduced_functionality_modeand other sensor-health fields. Use Get Host to retrieve a specific device by ID. See the documentation.Read-onlyv0.0.2
EVENTS
CrowdStrike Falcon triggers
Event sources your backend can deploy for users and receive through a webhook.
-
Host Status Changed
triggerEmit new event for each host matching a user-supplied FQL filter that has not been emitted in a prior run. Polls GET /devices/combined/devices/v1 (returns full device records includingstatus/containment status and sensor-health fields) and deduplicates on adeviceId-modified_timestampcomposite so only genuinely changed hosts emit. Covers both sensor-health and containment-status scenarios via the filter prop. See the documentation.v0.0.1 -
New Alert
triggerEmit new event for each CrowdStrike Falcon alert created since the last run. Polls GET /alerts/queries/alerts/v1 (GetQueriesAlertsV2) for alert IDs newer than the storedcreated_timestampcheckpoint, then hydrates them via POST /alerts/entities/alerts/v1 (PostEntitiesAlertsV2, body fieldcomposite_ids). Use the optional FQL filter to narrow to specific alert products (e.g. legacy endpoint detections, now surfaced through the Alerts API). See the documentation.v0.0.1
REFERENCE
App details
Reference metadata for the CrowdStrike Falcon connector in the Pipedream registry.
- App slug
- crowdstrike_falcon
- Authentication
- OAuth
- Categories
- Security
- Actions
- 7
- Triggers
- 2
- API proxy
- Available