CrowdStrike package v1.1.0

Search hosts and return full device records: hostnames, IPs, platform, agent and containment status. Operation and route verified against the retrieved vendor SDK reference (FalconPy Hosts collection: CombinedDevicesByFilter, GET /devices/combined/devices/v1, 'Search for hosts. Returns full device records.', Hosts: READ scope, retrieved 2026-09-21). Registered as the collection read; single-id detail reads (devices/entities/devices) are not registered. Requires the Hosts read scope.

The host is a reserved placeholder: substitute the customer's Falcon base API host before enabling.

Retrieve recent login sessions for a set of device ids; the response names the users who logged in, so the read is classified as pii (personal data). The operation is a POST with a read-only effect (ids in the request body; the retrieved vendor SDK reference documents no maximum on the ids array — the documented 100 cap applies to the result limit, default 10) and requires the Hosts read scope.

The host is a reserved placeholder: substitute before enabling.

Search alert ids matching an FQL filter, with offset pagination, sort and an optional include_hidden flag (CrowdStrike Alerts collection, GetQueriesAlertsV2, GET /alerts/queries/alerts/v2, 'Retrieves all Alerts ids that match a given query'; the limit defaults to 100, maximum 10000). Registered as the query read; alert detail retrieval (PostEntitiesAlertsV2), aggregates and the deprecated v1 query are not registered. Requires the Alerts read scope. This capability replaces crowdstrike.detections.read@1.0.0, which used the Detects collection that CrowdStrike decommissioned on 2025-09-30.

The host is a reserved placeholder: substitute before enabling.

Modify one or more alerts by composite id (PatchEntitiesAlertsV3, PATCH /alerts/entities/alerts/v3): status through update_status, assignment and unassignment, appended comments, tags, and visibility — show_in_ui false hides the alert from the console. Changing status or hiding alerts suppresses analyst visibility of possible intrusion activity; the change is reversible, so the capability sits at the minimum R2 tier for update with the suppression risk stated here and bounded by policy. The request body names the composite ids and action parameters, and this registration does not restrict which alerts or which parameters a caller sends.

Requires the Alerts write scope. This capability replaces crowdstrike.detections.update@1.0.0, which used the Detects collection that CrowdStrike decommissioned on 2025-09-30.

The host is a reserved placeholder: substitute before enabling.

Network-contain one or more hosts (action_name 'contain' with the host AIDs in the request body, maximum 100 per call). Containment immediately severs the endpoint's network connectivity except to the Falcon cloud, which can interrupt live production workloads and cannot be presumed consequence-free even though lift_containment exists — it is registered with the deploy action at the minimum R3 tier as a response-action equivalent of deploy, and deploy is one of the designated actions requiring human approval for floor purposes.

The action_name selector is pinned in this registration's endpoint query string (action_name=contain) — the retrieved vendor SDK reference documents action_name as a query parameter of this operation — and the caller cannot alter it, because a caller names a capability, never a destination; the same operation with other action names (hide_host, unhide_host, detection_suppress) is therefore not reachable through this registration. Requires the Hosts write scope.

The host is a reserved placeholder: substitute before enabling.

On supported execution paths mediated by AAES Govern, the declared irreversible actions require an authorized person’s approval. Observation-only and bypass calls cannot be stopped by this control.

Lift network containment on one or more hosts (the action_name=lift_containment selector is pinned in this registration's endpoint query string, with the host AIDs in the request body, maximum 100 per call), restoring normal connectivity. Lifting containment changes live endpoint state and re-exposes the network if the host is still compromised, so it declares update and deploy at the minimum R3 tier as a response-action equivalent of deploy — it is not an ordinary reversible edit, and deploy is one of the designated actions requiring human approval.

On supported execution paths mediated by AAES Govern, irreversible actions require approval by an authorized person; this does not prevent calls through bypass or observation-only paths. Requires the Hosts write scope.

The host is a reserved placeholder: substitute before enabling.

Append or remove Falcon grouping tags on one or more hosts (action_name add or remove with tags and AIDs in the request body). Grouping tags can drive dynamic host-group membership, which prevention policies may target, so a tag change can indirectly change a host's effective prevention-policy assignment — a live policy-enforcement change, so the capability declares update and deploy at the minimum R3 tier; review downstream group rules before enabling.

Note: the retrieved vendor SDK reference documents this operation's action_name (add or remove) as a request-body field, so the add/remove choice is not restricted by this registration — the tier declaration covers both. Requires the Hosts write scope.

The host is a reserved placeholder: substitute before enabling.

On supported execution paths mediated by AAES Govern, the declared irreversible actions require an authorized person’s approval. Observation-only and bypass calls cannot be stopped by this control.