New Alert

import { PipedreamClient } from "@pipedream/sdk"

const pd = new PipedreamClient({
  projectId: process.env.PIPEDREAM_PROJECT_ID!,
  clientId: process.env.PIPEDREAM_CLIENT_ID!,
  clientSecret: process.env.PIPEDREAM_CLIENT_SECRET!,
  projectEnvironment: "production",
})

const deployed = await pd.triggers.deploy({
  id: "crowdstrike_falcon-new-alert",
  externalUserId: "{external_user_id}", // any stable ID for this user in your system
  configuredProps: {
    crowdstrike_falcon: { authProvisionId: "apn_xxxxxxx" },
    timer: { "intervalSeconds": 900 },
    fqlFilter: "FQL Filter",
  },
  webhookUrl: "https://example.com/webhooks/crowdstrike-falcon",
})

console.log(deployed.id)

curl -X POST https://api.pipedream.com/v1/connect/{project_id}/triggers/deploy \
  -H "Content-Type: application/json" \
  -H "X-PD-Environment: production" \
  -H "Authorization: Bearer {access_token}" \
  -d '{
    "external_user_id": "{external_user_id}",
    "id": "crowdstrike_falcon-new-alert",
    "webhook_url": "https://example.com/webhooks/crowdstrike-falcon",
    "configured_props": {
      "crowdstrike_falcon": { "authProvisionId": "apn_xxxxxxx" },
      "timer": { "intervalSeconds": 900 },
      "fqlFilter": "FQL Filter"
    }
  }'

MCP servers expose CrowdStrike Falcon actions as on-demand tools.

New Alert is an event source, so your application deploys it
with the Connect SDK or API and then either receives each event at a
webhook URL or retrieves events on demand with the trigger events API.