Connect CrowdStrike Falcon

CrowdStrike Falcon is an endpoint detection and response platform. A lightweight sensor on each machine reports what is happening on it, Falcon decides what is a threat, and your analysts work the resulting alerts. Around that core it also covers cloud posture, containers and Kubernetes, identity protection, vulnerability and exposure management, and Real Time Response — a live remote shell into a managed endpoint. StackJack talks to Falcon through its documented REST API.

Connecting CrowdStrike Falcon to StackJack gives your AI assistant a family of falcon_ MCP tools — MCP (Model Context Protocol) tools are the standardized commands an AI assistant can call through StackJack. This is the second-largest connector StackJack ships, so the list below is what the tools are for rather than a roster. With them, your AI can:

• Work the alert queue — search alerts, read the full detection detail behind each one, and pull the aggregate counts that tell you whether today is unusual
• Report on the fleet — which machines have the sensor, which are stale or unhealthy, what version each one runs, and which policies actually apply to which group
• Answer "are we exposed to this?" — vulnerability findings per host, exposed assets Falcon discovered on your behalf, misconfiguration findings, and zero trust assessment scores
• Read threat intelligence — indicator, actor and report lookups, and the sandbox verdict for a file already submitted
• Audit cloud and containers — cloud posture findings across AWS, Azure, Google Cloud and OCI, container image vulnerabilities, and Kubernetes cluster inventory
• Review your own configuration — prevention and sensor update policies, exclusions, firewall rules, custom detection rules, users and their roles
• Contain and remediate (on Pro plans) — network-isolate a compromised machine and lift that containment again, move hosts between groups, and act on quarantined files
• Change protection (on Pro plans) — edit prevention, sensor update, response, device control and firewall policies, and manage the exclusions that tell the sensor what to ignore
• Run Real Time Response (on Pro plans) — open a live session to an endpoint and run commands on it
• Administer the platform (on Pro plans) — manage users, roles, API clients, installation tokens, and, for MSSPs, the customer groups behind Flight Control

How StackJack authenticates to CrowdStrike Falcon

Falcon uses an API client: a Client ID and a Client Secret that you create in the Falcon console. StackJack exchanges them for a short-lived access token, keeps that token fresh, and gets a new one automatically when it expires. There is no consent screen, nothing to reauthorize on a schedule, and no per-user sign-in — the connection acts as the API client you create, not as you.

Choose your cloud region first

This is the one decision to get right before anything else, and it is the single most common cause of a failed first connection.

CrowdStrike runs several independent clouds, and your account lives in exactly one of them. StackJack has no way to discover which — CrowdStrike does not publish one, and asking the wrong cloud does not produce a helpful answer. Credentials sent to the wrong region are rejected in a way that looks identical to a wrong secret. So a region mistake reads as a credential problem, and the natural response is to go and rotate a perfectly good key, which does not help.

For that reason StackJack refuses to guess. The region is a required choice on the connector form, and it starts empty rather than pre-selected. If you do not know yours, the address bar of your Falcon console shows it, and CrowdStrike support can confirm it.

Scopes are fixed when you create the key

Falcon API clients carry permissions per service area, with separate Read and Write ticks for each, and those are chosen when the client is created and cannot be changed afterward. Adding a scope later means issuing a new API client and re-entering the credentials in StackJack.

This is worth a few minutes of thought up front, because it is the most common source of confusion after setup. A key that is missing a scope is not broken — it works perfectly for everything it does cover, and refuses everything else. If your AI reports that Falcon refused one particular area while the rest of the connector works normally, that is a missing tick and not a fault.

Grant Read broadly across the areas you want visibility into, and Write only where you actually want StackJack to make changes. Withholding Write is a genuine safety boundary, and it costs you nothing on the reading side.

Steps

1. Sign in to the Falcon console as an administrator and open the API clients area under support and resources.
2. Create an API client. Give it a name that identifies StackJack, so it is obvious later what the key is for.
3. Choose its scopes. At minimum, tick Read on Hosts — StackJack uses that to test the connection. Then add Read for every area you want your AI to see, and Write only where you want it to act.
4. Copy the Client ID and Client Secret immediately. Falcon shows the secret exactly once. If you lose it you must create a new client.
5. Note your cloud region, as above.
6. Enter all three in StackJack. Open Connectors, choose CrowdStrike Falcon, and enter the Client ID, the Client Secret, and your region.
7. Run a Test Connection to confirm StackJack can reach Falcon.

If you are an MSSP using Flight Control

If your API client is a parent account that reaches customer accounts through Flight Control, there is one extra field: the customer's CID. Leave it empty and the connection works against your own parent account.

One StackJack connection covers one Falcon customer. If you manage several customers through Flight Control, add a separate connection for each, with that customer's CID. This is deliberate — it means a tool call can never quietly act on the wrong company, because the customer is fixed by the connection rather than chosen per request.

To add one: open Connectors → CrowdStrike Falcon → Add connection, name it after the customer, and enter that customer's CID. Run falcon_query_children on your parent connection to list the child CIDs first. Your AI then names the customer on each call, or you pin an endpoint to one. See Several connections of one connector.

What to know before your AI uses this connector

Some tools reach a live machine

Falcon is not only a reporting system, and several tools take real action on a real endpoint:

• Containment isolates a machine from the network. It is the correct response to a compromise and it is also disruptive: a contained machine stops talking to everything except Falcon. Lifting containment is a separate tool.
• Real Time Response is a remote shell. Opening a session dispatches a live channel to the endpoint, and the administrator variants run commands on it. Every Real Time Response tool is treated as an action that changes a customer environment, including the ones whose names sound like bookkeeping — opening a session and keeping it alive both reach the machine.
• Scans and detonations dispatch work. On-demand scans, network scans and sandbox submissions run against live systems and consume your CrowdStrike quota.
• Host deletion is permanent.

All of these require the Pro tier and are marked destructive. Whether your AI application asks you to confirm before running one depends on that application's own settings — see Destructive tools and confirmation. Review that setting, and grant only what you want an AI to reach.

Some tools change protection itself

Editing a prevention policy, adding an exclusion, or changing a firewall rule group changes what the sensor does on every machine in scope. Turning a protection off, or excluding a path, deliberately blinds the sensor — which is sometimes exactly right and is never routine. StackJack marks these as destructive for that reason, including the partial edits, and the same applies to suppression rules in cloud security: a suppressed finding disappears from the console and from every report.

Reordering rule precedence counts too. It changes which rule wins without changing any rule.

Reading is safe, and there is a lot of it

Roughly three in five tools only read. Searching, reporting, listing, and pulling detail are all available on the Free tier and none of them change anything. Your AI can investigate an incident end to end — alert, host, policy, vulnerabilities, related detections — without touching a single tool marked destructive. Those reads still return your customers' detection and vulnerability detail, so grant them deliberately.

A successful response can still contain failures

This is specific to Falcon and worth knowing, because it can mislead a person as easily as an assistant. When you ask about several items at once, Falcon can succeed at some and fail at others and report the whole call as successful, listing the failures in a separate part of the response. StackJack passes Falcon's response through exactly as received, so nothing is hidden — but "the call succeeded" and "everything you asked for worked" are different statements here. If a bulk result looks short, the explanation is usually in that part of the response.

Finding things, then reading them

Many Falcon searches return matching identifiers rather than records, and a second tool turns those identifiers into detail. Your AI handles this on its own; the reason to know is that a search reporting matches while showing no detail is normal and not an error.

Searches use CrowdStrike's own filter language, which your AI writes for you.

Plans and limits

Read tools are available on the Free tier. Everything that writes, contains, remediates, runs a command or changes a policy is Pro. Business reaches the same tools as Pro and differs by monthly call quota.

See the generated CrowdStrike Falcon tool reference for the current inventory, plan assignment, input schemas, and destructive-action labels.

Falcon limits how fast you can call it, and StackJack paces requests and backs off automatically if you are throttled, which usually makes a large report slower rather than failed. Pacing smooths a burst; it does not guarantee that every call arrives. Retries are bounded, so a wide enough read can still come back throttled or time out. Narrow the read, honour any retry delay the vendor sends, and check whether a write landed before repeating it — see Retrying a failed or timed-out write. Falcon also caps how deep you can page into a large result: past roughly ten thousand records a search must be narrowed rather than paged further. Your AI will say so if it reaches that point.

Troubleshooting

"CrowdStrike rejected the credentials" — check the region before you touch the key. A correct Client ID and Secret sent to the wrong cloud fails exactly like a wrong secret, and this is the most common first-connection problem. If the region is right, confirm the Client ID and Secret were copied completely, and remember that Falcon shows the secret only once — if it was not captured at creation, create a new API client.

Falcon accepted the key but refused one particular area — the API client is missing a scope. Scopes are fixed when the client is created, so this cannot be granted after the fact: create a new API client with the ticks you need and re-enter the credentials. The connection test will still pass, because it only needs Read on Hosts.

A Flight Control connection is reading the wrong company — check the customer CID on the connection. Empty means your own parent account, which is a legitimate setting and looks identical to a correctly configured one until you read the data.

A search returns matches but no records — that is the normal two-step pattern described above, not a failure.

A bulk operation reports success but did less than expected — read the failures listed in the response. Falcon reports partial batch failures inside an otherwise successful call.

A large report stops partway with a message about paging depth — Falcon limits how far into a result set you can page. Narrow the search, usually by date range, rather than trying to page further.

CrowdStrike Falcon tools

falcon_ · 1409 tools · Free 845 · Pro 564

Certificate Based Exclusions

Content Update Policies

Deployments

Device Content

Device Control Policies

Firewall Management

Firewall Policies

Host Groups

Host Migration

Hosts

Installation Tokens

IOA Exclusions

ML Exclusions

Mobile Enrollment

Prevention Policies

Profile Groups

Response Policies

Sensor Download

Sensor Update Policy

Sensor Usage

Sensor Visibility Exclusions

Alerts

Hunting

Correlation Rules

Correlation Rules Admin

Custom Indicators of Attack

Falcon Identity

Falcon Sandbox

Identity Protection

Intel

Intelligence Feeds

Intelligence Indicator Graph

Indicators of Compromise

Indicator Search

MalQuery

On-Demand Scans

Quarantine

Quick Scan

Quick Scan Pro

Recon

Sample Uploads

Tailored Intelligence

Threatgraph

Configuration Assessment

Configuration Assessment Evaluation Logic

Data Protection Configuration

Discover

Exposure Management

Falcon Complete Dashboard

FileVantage

Network Scan Global Configs

Network Scan Networks

Network Scan Scan Run Reports

Network Scan Scan Runs

Network Scan Scanners

Network Scan Scans

Network Scan Templates

Network Scan Zones

SaaS Security

Spotlight Evaluation Logic

Spotlight Vulnerabilities

Spotlight Vulnerability Metadata

Zero Trust Assessment

Agent Invocation

Agent Templates

Agent Versions

Custom Storage

Delivery Settings

Faas Execution

Foundry Logscale

Foundry Lookup Files

Falcon for IT

Knowledge Base Audit Events

Knowledge Base Files

Knowledge Bases

Models

Real Time Response

Real Time Response (Admin)

Real Time Response (Audit)

Report Executions

Scheduled Reports

Spans

Tools

Workflows

Application Security Posture

Cloud AWS Registration

Cloud Azure Registration

Cloud Connect AWS

Cloud Google Cloud Registration

Cloud OCI Registration

Cloud Policies

Cloud Security

Cloud Security Assets

Cloud Security Compliance

Cloud Security Detections

Cloud Security Registration Combined

Cloud Security Risks

Cloud Snapshots

Cloud Security Posture Registration

Cloud Registration (D4C)

Drift Indicators

Scanning Orchestrator

Serverless Exports

Serverless Vulnerabilities

Admission Control Policies

Container Alerts

Container Detections

Container Image Compliance

Container Images

Container Packages

Container Vulnerabilities

Falcon Container

Image Assessment Policies

Kubernetes Container Compliance

Kubernetes Protection

Unidentified Containers

Access Scopes

API Clients

API Integrations

Case Management

Federated Connections

Message Center

Flight Control (MSSP)

Next-Gen SIEM

User Management