Integration

CrowdStrike Falcon integration

CrowdStrike Falcon platform API for detection and response automation: search and triage endpoint detection alerts, enumerate and inspect managed hosts, contain or release a host, manage custom indicators of compromise, and read Spotlight vulnerability findings. Falcon runs one API host per cloud region, so the host is part of the credential. Access uses an API client id and secret exchanged for a short-lived bearer token.

Connect CrowdStrike Falcon How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in CrowdStrike Falcon.Built from the 18 CrowdStrike Falcon tools below, on the connection you add once.

Common CrowdStrike Falcon use cases

blocking every hash extracted from a phishing campaign
finding every machine that executed a malicious binary
auditing which custom indicators are currently blocking
removing indicators that turned out to be false positives
exporting the full managed endpoint inventory for an audit
isolating a compromised laptop the moment a detection fires
pulling new high severity detections into a triage workflow
deciding whether a suspicious hash is isolated or widespread
enriching an alert identifier with the full detection context
listing open critical vulnerabilities for a patching workflow

What you can do with CrowdStrike Falcon

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Indicator, 7 operations

create_iocsCreate iocsPOSTAdds custom indicators so Falcon detects or blocks the given hashes, domains or addresses.
delete_iocsDelete iocsDELETERemoves custom Falcon indicators so they stop being enforced.
get_ioc_device_countGet ioc device countGETReturns how many managed hosts have seen a specific indicator value.
get_iocsGet iocsGETReturns the full definition of each requested custom Falcon indicator.
list_devices_for_iocList devices for iocGETReturns the agent identifiers of every host that has seen a specific indicator value.
list_ioc_idsList ioc idsGETSearches custom Falcon indicators and returns the identifiers of the matches.
update_iocsUpdate iocsPATCHChanges the action, severity, expiration or scope of existing custom indicators.

Device, 5 operations

get_devicesGet devicesGETReturns the full inventory record of each requested Falcon host.
list_device_idsList device idsGETSearches Falcon managed hosts with a filter and returns matching agent identifiers.
list_devices_detailedList devices detailedGETSearches Falcon hosts and returns their full inventory records without a second lookup.
perform_device_actionPerform device actionPOSTNetwork contains a host or lifts containment, and hides or unhides hosts in the console.
update_device_tagsUpdate device tagsPATCHAdds or removes Falcon grouping tags across a list of hosts.

Alert, 3 operations

get_alertsGet alertsPOSTTurns composite alert identifiers into full Falcon alert records.
list_alert_idsList alert idsGETSearches Falcon alerts with a Falcon Query Language filter and returns matching alert identifiers.
update_alertsUpdate alertsPATCHChanges the status, assignee, tags or comments of one or more Falcon alerts.

Vulnerability, 3 operations

get_vulnerabilitiesGet vulnerabilitiesGETReturns the full detail of each requested Spotlight vulnerability finding.
list_vulnerabilities_detailedList vulnerabilities detailedGETSearches Spotlight vulnerabilities and returns full findings without a second lookup.
list_vulnerability_idsList vulnerability idsGETSearches Falcon Spotlight vulnerability findings and returns matching identifiers.

Use CrowdStrike Falcon from Claude Code, Cursor or Codex

Connect CrowdStrike Falcon in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its CrowdStrike Falcon operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect CrowdStrike Falcon

Create your workspace
Sign up free. Nothing to install.
Connect CrowdStrike Falcon once
Add your CrowdStrike Falcon connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

CrowdStrike Falcon integration FAQ

What can you do with the CrowdStrike Falcon integration?

LiveContext exposes 18 operations on CrowdStrike Falcon, covering indicator, device, alert and vulnerability. Common uses include blocking every hash extracted from a phishing campaign, finding every machine that executed a malicious binary and auditing which custom indicators are currently blocking.