# CrowdStrike Falcon — Pipedream Connect

> Cloud-native cybersecurity platform

- API slug: `crowdstrike_falcon` (use in MCP headers and tool keys)
- Auth: OAuth (Pipedream-managed)
- Categories: Security
- Website: https://www.crowdstrike.com/en-us/platform/
- This page (HTML): https://pipedream.com/apps/crowdstrike-falcon
- Tools: 7 actions · 2 triggers

## Connect via MCP (recommended)

- Endpoint: `https://remote.mcp.pipedream.net/v3`
- Headers: `Authorization: Bearer <token>` · `x-pd-project-id` · `x-pd-environment` · `x-pd-external-user-id` · `x-pd-app-slug: crowdstrike_falcon`

```ts
import { Client } from "@modelcontextprotocol/sdk/client/index.js"
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js"
import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const accessToken = await pd.rawAccessToken

const transport = new StreamableHTTPClientTransport(
  new URL("https://remote.mcp.pipedream.net/v3"),
  {
    requestInit: {
      headers: {
        Authorization: `Bearer ${accessToken}`,
        "x-pd-project-id": process.env.PIPEDREAM_PROJECT_ID!,
        "x-pd-environment": "production",
        "x-pd-external-user-id": "{external_user_id}", // any stable ID for this user in your system
        "x-pd-app-slug": "crowdstrike_falcon",
      },
    },
  },
)

const mcp = new Client({ name: "my-agent", version: "1.0.0" })
await mcp.connect(transport)

const { tools } = await mcp.listTools()

// e.g. run Get Alert:
const result = await mcp.callTool({
  name: "crowdstrike_falcon-get-alert",
  arguments: {
    alertIds: ["Alert IDs"],
    includeHidden: true,
  },
})
```

Docs: [MCP guide](https://pipedream.com/docs/connect/mcp/developers.md)

## API proxy

For a CrowdStrike Falcon endpoint with no pre-built tool, the proxy forwards your request with the connected user's credentials attached.

```bash
# The path segment is the target URL, URL-safe base64 encoded:
# https://api.example.com/v1/me

curl "https://api.pipedream.com/v1/connect/{project_id}/proxy/aHR0cHM6Ly9hcGkuZXhhbXBsZS5jb20vdjEvbWU?external_user_id={external_user_id}&account_id=apn_xxxxxxx" \
  -H "Authorization: Bearer {access_token}" \
  -H "x-pd-environment: production"
```

Docs: [API proxy guide](https://pipedream.com/docs/connect/api-proxy.md)

## SDK

```ts
import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const result = await pd.actions.run({
  id: "crowdstrike_falcon-get-alert",
  externalUserId: "{external_user_id}", // any stable ID for this user in your system
  configuredProps: {
    crowdstrike_falcon: { authProvisionId: "apn_xxxxxxx" },
    alertIds: ["Alert IDs"],
    includeHidden: true,
  },
})
```

Docs: [Managed auth guide](https://pipedream.com/docs/connect/managed-auth/quickstart.md) · [Tools guide](https://pipedream.com/docs/connect/components.md)

## Actions (7)

### `crowdstrike_falcon-get-alert` — Get Alert (Read-only)

Retrieve full CrowdStrike Falcon alert records for one or more alert composite IDs via GET /alerts/entities/alerts/v1 (max 1000 per request). Use Search Alerts to find alert IDs first. See the documentation.

Full schema: https://pipedream.com/apps/crowdstrike-falcon/actions/get-alert.md

### `crowdstrike_falcon-get-host` — Get Host (Read-only)

Retrieve full CrowdStrike Falcon device records for one or more device IDs via GET /devices/entities/devices/v2, including hostname, os_version, agent_version, status (containment status) and reduced_functionality_mode (sensor health). Use Search Hosts to find device IDs first. See the…

Full schema: https://pipedream.com/apps/crowdstrike-falcon/actions/get-host.md

### `crowdstrike_falcon-get-rtr-command-status` — Get RTR Command Status (Read-only)

Retrieve the status and output of a Real-Time Response command via GET /real-time-response/entities/command/v1, returning stdout, stderr and completion status. Provide the cloud_request_id returned by Run RTR Command. Requires an RTR entitlement. See the documentation.

Full schema: https://pipedream.com/apps/crowdstrike-falcon/actions/get-rtr-command-status.md

### `crowdstrike_falcon-manage-host-containment` — Manage Host Containment (Write)

Manage host containment on one or more CrowdStrike Falcon hosts via POST /devices/entities/devices-actions/v2 (action_name query param, ids body). Use Search Hosts or Get Host to find device IDs. See the documentation.

Full schema: https://pipedream.com/apps/crowdstrike-falcon/actions/manage-host-containment.md

### `crowdstrike_falcon-run-rtr-command` — Run RTR Command (Write)

Initiate a Real-Time Response (RTR) session on a host and execute a read-only responder command. Calls POST /real-time-response/entities/sessions/v1 to open the session, then POST /real-time-response/entities/command/v1 to run the command; returns the session_id and cloud_request_id. Use Get RTR…

Full schema: https://pipedream.com/apps/crowdstrike-falcon/actions/run-rtr-command.md

### `crowdstrike_falcon-search-alerts` — Search Alerts (Read-only)

Search CrowdStrike Falcon alerts and return their IDs via GET /alerts/queries/alerts/v2. Detections are now delivered through the Alerts API (the legacy /detects/* collection was decommissioned), so filter on the alert product to retrieve endpoint detections. Use Get Alert to hydrate the returned…

Full schema: https://pipedream.com/apps/crowdstrike-falcon/actions/search-alerts.md

### `crowdstrike_falcon-search-hosts` — Search Hosts (Read-only)

Search CrowdStrike Falcon hosts and return full device records via GET /devices/combined/devices/v1, including status (containment status), reduced_functionality_mode and other sensor-health fields. Use Get Host to retrieve a specific device by ID. See the documentation.

Full schema: https://pipedream.com/apps/crowdstrike-falcon/actions/search-hosts.md

## Triggers (2)

### `crowdstrike_falcon-host-status-changed` — Host Status Changed (Polling)

Emit new event for each host matching a user-supplied FQL filter that has not been emitted in a prior run. Polls GET /devices/combined/devices/v1 (returns full device records including status/containment status and sensor-health fields) and deduplicates on a deviceId-modified_timestamp composite so…

Full schema: https://pipedream.com/apps/crowdstrike-falcon/triggers/host-status-changed.md

### `crowdstrike_falcon-new-alert` — New Alert (Polling)

Emit new event for each CrowdStrike Falcon alert created since the last run. Polls GET /alerts/queries/alerts/v1 (GetQueriesAlertsV2) for alert IDs newer than the stored created_timestamp checkpoint, then hydrates them via POST /alerts/entities/alerts/v1 (PostEntitiesAlertsV2, body field…

Full schema: https://pipedream.com/apps/crowdstrike-falcon/triggers/new-alert.md

---

- All apps: https://pipedream.com/apps — index: https://pipedream.com/llms.txt
- Pipedream docs for agents: https://pipedream.com/docs/llms.txt