Connect Your AI Agent with CrowdStrike Falcon for Slack
Integrate CrowdStrike Falcon MCP server into your Slack workspace for instant access to your AI agent.
Categories
Available Tools
Tools that your AI agent can use through this MCP server to interact with CrowdStrike Falcon
Search CrowdStrike Falcon hosts and return full device records via GET /devices/combined/devices/v1, including status (containment status), reduced_functionality_mode and other sensor-health fields. Use Get Host to retrieve a specific device by ID. See the documentation.
Search CrowdStrike Falcon alerts and return their IDs via GET /alerts/queries/alerts/v2. Detections are now delivered through the Alerts API (the legacy /detects/* collection was decommissioned), so filter on the alert product to retrieve endpoint detections. Use Get Alert to hydrate the returned IDs into full records. See the documentation.
Initiate a Real-Time Response (RTR) session on a host and execute a read-only responder command. Calls POST /real-time-response/entities/sessions/v1 to open the session, then POST /real-time-response/entities/command/v1 to run the command; returns the session_id and cloud_request_id. Use Get RTR Command Status with the returned cloud_request_id to fetch results. Requires an RTR entitlement. See the documentation.
Manage host containment on one or more CrowdStrike Falcon hosts via POST /devices/entities/devices-actions/v2 (action_name query param, ids body). Use Search Hosts or Get Host to find device IDs. See the documentation.
Retrieve the status and output of a Real-Time Response command via GET /real-time-response/entities/command/v1, returning stdout, stderr and completion status. Provide the cloud_request_id returned by Run RTR Command. Requires an RTR entitlement. See the documentation.
Retrieve full CrowdStrike Falcon device records for one or more device IDs via GET /devices/entities/devices/v2, including hostname, os_version, agent_version, status (containment status) and reduced_functionality_mode (sensor health). Use Search Hosts to find device IDs first. See the documentation.
Retrieve full CrowdStrike Falcon alert records for one or more alert composite IDs via GET /alerts/entities/alerts/v1 (max 1000 per request). Use Search Alerts to find alert IDs first. See the documentation.