CrowdStrike Falcon
Cloud-native cybersecurity platform
Comece grátisCompatível com
IA Compatível
Ferramentas
Get Alert
Retrieve full CrowdStrike Falcon alert records for one or more alert composite IDs via GET /alerts/entities/alerts/v1 (max 1000 per request). Use **Search Alerts** to find alert IDs first. See the documentation.
Get Host
Retrieve full CrowdStrike Falcon device records for one or more device IDs via GET /devices/entities/devices/v2, including hostname, os_version, agent_version, status (containment status) and reduced_functionality_mode (sensor health). Use **Search Hosts** to find device IDs first. See the documentation.
Get RTR Command Status
Retrieve the status and output of a Real-Time Response command via GET /real-time-response/entities/command/v1, returning stdout, stderr and completion status. Provide the cloud_request_id returned by **Run RTR Command**. Requires an RTR entitlement. See the documentation.
Manage Host Containment
Manage host containment on one or more CrowdStrike Falcon hosts via POST /devices/entities/devices-actions/v2 (action_name query param, ids body). Use **Search Hosts** or **Get Host** to find device IDs. See the documentation.
Run RTR Command
Initiate a Real-Time Response (RTR) session on a host and execute a read-only responder command. Calls POST /real-time-response/entities/sessions/v1 to open the session, then POST /real-time-response/entities/command/v1 to run the command; returns the session_id and cloud_request_id. Use **Get RTR Command Status** with the returned cloud_request_id to fetch results. Requires an RTR entitlement. See the documentation.
Search Alerts
Search CrowdStrike Falcon alerts and return their IDs via GET /alerts/queries/alerts/v2. Detections are now delivered through the Alerts API (the legacy /detects/* collection was decommissioned), so filter on the alert product to retrieve endpoint detections. Use **Get Alert** to hydrate the returned IDs into full records. See the documentation.
Search Hosts
Search CrowdStrike Falcon hosts and return full device records via GET /devices/combined/devices/v1, including status (containment status), reduced_functionality_mode and other sensor-health fields. Use **Get Host** to retrieve a specific device by ID. See the documentation.