crowdstrike v1.0.0

The pack names a reference, never a secret. Installing a pack registers capabilities and makes them governable; registration is not connectivity. The credential is created at the provider and held in the client's own secret manager under the reference the pack names, and deployment testing is still required to show the credential path works and cannot be bypassed.

Reference

secret-ref-crowdstrike-oauth-token

Custody

customer_vault

Injection

header (Authorization)

An OAuth2 bearer access token for the customer's Falcon cloud, held in the client's own secret manager. The stored material must be the complete Authorization header value (scheme included): 'Bearer ' followed by the access token. CrowdStrike API authentication is an OAuth2 client-credentials flow: an external deployment process posts the API client's client_id and client_secret — two secret values, themselves stored under their own vault references — to the Falcon OAuth2 token endpoint and stores the returned access token under this reference; the injector injects the stored value verbatim and performs no token lifecycle itself, so refresh ownership sits entirely with that external process. Access tokens are short-lived and expire; an expired value fails closed. Deleting or disabling the API client in the Falcon console stops new token issuance, but any already-issued token should be treated as valid until it expires — stopping issuance is not token invalidation, so rotate on suspicion rather than relying on revocation. Least privilege: create the API client with only the scopes the registered capabilities need (Hosts read and Detections read for the reads; Hosts write and Detections write for containment and detection updates) and prefer separate clients for read-only versus response use, each under its own reference. Executor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack.

• crowdstrike-falcon-devices (api, pii): https://crowdstrike-api.invalid/devices
• crowdstrike-falcon-detections (api, internal): https://crowdstrike-api.invalid/detects

The endpoint host 'crowdstrike-api.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the customer's Falcon cloud base API host for their region before enabling, in every endpoint, in the resource locators and in every egress allowlist entry — the allowlist matches exactly, so all three must be substituted together, and substitution is a required deployment step. CrowdStrike operates several regional clouds, and the Falcon console host and the API base host are DISTINCT authorities: substitute the region-specific Falcon API base host for the tenant's cloud (shown alongside the API client in the console's API clients and keys page), not the console host itself. The pack does not create the API client or mint tokens: an external deployment process creates an OAuth2 API client in the Falcon console, exchanges the client id and secret for an access token at the Falcon OAuth2 token endpoint, and stores and renews the complete header value described in the credential note. Detection-state changes and host containment are registered as the privileged response actions they are: detections.update can mark detections false_positive and hide them from the console (a suppression that reduces analyst visibility) — a reversible status/visibility-only mutation, so it sits at the R2 update floor with the suppression risk stated in its description and bounded by policy — and hosts.contain severs a live endpoint's network connectivity, registered with the deploy action at the R3 floor as a response-action equivalent of deploy. AID values in request bodies are device ids the deployment binds at call time. Documented exclusions — this pack does not register: Real Time Response (RTR) session, command or script operations (live-response shells and arbitrary remote command execution on endpoints), host hiding and unhiding (hide_host / unhide_host actions on the devices-actions endpoint — made an enforceable exclusion by the pinned action_name query selector in the registered containment endpoints), host deletion, prevention-policy assignment or group actions (devices/entities/group-actions), indicator (IOC) management, and Falcon user or API-client management. Documentation caveat: CrowdStrike's full endpoint reference is served inside the Falcon console behind a customer login and could not be fetched in this review; this pack's endpoints and operation behavior were reviewed against CrowdStrike's public developer hub and the vendor-documented FalconPy SDK reference pages listed in sources, and a completing review should re-check each path against the in-console API documentation before this pack leaves draft.

Draft review record dated 2026-09-21 · Reviewer: aaes-eng (an opaque id that resolves internally to the responsible reviewer)

• https://developer.crowdstrike.com/ (retrieved 2026-09-21)
• https://www.falconpy.io/Usage/Authenticating-to-the-API.html (retrieved 2026-09-21)
• https://www.falconpy.io/Service-Collections/Hosts.html (retrieved 2026-09-21)
• https://www.falconpy.io/Service-Collections/Detects.html (retrieved 2026-09-21)

A pack review is not a vendor or examiner attestation. A retrieval date says when a source page was read; it does not by itself establish what the page said then. No pack is vendor-endorsed, and none has been connectivity-tested against a live vendor tenant.