{ "schema": "aaes/capability-pack/1", "provider": "crowdstrike", "version": "1.1.0", "description": "CrowdStrike Falcon platform API: read hosts and alerts, view device login history, update alert state and tags, and contain or lift containment on hosts.", "notes": "The endpoint host 'crowdstrike-api.invalid' is a reserved non-production placeholder (an RFC 2606 reserved TLD): substitute the customer's Falcon cloud base API host for their region before enabling, in every endpoint, in the resource locators and in every egress allowlist entry — the allowlist matches exactly, so all three must be substituted together, and substitution is a required deployment step. CrowdStrike operates several regional clouds, and the Falcon console host and the API base host are distinct authorities: substitute the region-specific Falcon API base host for the tenant's cloud (shown alongside the API client in the console's API clients and keys page), not the console host itself.\n\nThe pack does not create the API client or mint tokens: an external deployment process creates an OAuth2 API client in the Falcon console, exchanges the client id and secret for an access token at the Falcon OAuth2 token endpoint, and stores and renews the complete header value described in the credential note.\n\nAlert-state changes and host containment are registered as the privileged response actions they are: alerts.update can change alert status and hide alerts from the console (a suppression that reduces analyst visibility) — a reversible status/visibility-only mutation, so it sits at the minimum R2 tier for update with the suppression risk stated in its description and bounded by policy — and hosts.contain severs a live endpoint's network connectivity, registered with the deploy action at the minimum R3 tier as a response-action equivalent of deploy. AID values in request bodies are device ids the deployment binds at call time.\n\nExcluded operations: Real Time Response (RTR) session, command or script operations (live-response shells and arbitrary remote command execution on endpoints), host hiding and unhiding (hide_host / unhide_host actions on the devices-actions endpoint — made an enforceable exclusion by the pinned action_name query selector in the registered containment endpoints), host deletion, prevention-policy assignment or group actions (devices/entities/group-actions), indicator (IOC) management, and Falcon user or API-client management.\n\nDocumentation caveat: CrowdStrike's full endpoint reference is served inside the Falcon console behind a customer login and could not be fetched in this review; this pack's endpoints and operation behavior were reviewed against CrowdStrike's public developer hub and the vendor-documented FalconPy SDK reference pages listed in sources, and the tenant deployment review must confirm each path against the in-console API documentation before enabling this reviewed package.\n\nVendor lifecycle: CrowdStrike decommissioned the Detects service collection on 2025-09-30 and directs developers to the Alerts service collection. Pack version 1.1.0 therefore registers alert search (GET /alerts/queries/alerts/v2) and alert update (PATCH /alerts/entities/alerts/v3) as crowdstrike.alerts.read and crowdstrike.alerts.update, and no longer registers crowdstrike.detections.read or crowdstrike.detections.update; a deployment that installed those 1.0.0 capabilities should retire them. The Alerts operations were checked against CrowdStrike's developer hub API reference for the Alerts collection, retrieved 2026-10-22.", "credential": { "secret_ref_id": "secret-ref-crowdstrike-oauth-token", "custody": "customer_vault", "inject": "header", "inject_name": "Authorization", "note": "An OAuth2 bearer access token for the customer's Falcon cloud, held in the client's own secret manager. The stored material must be the complete Authorization header value (scheme included): 'Bearer ' followed by the access token. CrowdStrike API authentication is an OAuth2 client-credentials flow: an external deployment process posts the API client's client_id and client_secret — two secret values, themselves stored under their own vault references — to the Falcon OAuth2 token endpoint and stores the returned access token under this reference; the injector injects the stored value verbatim and performs no token lifecycle itself, so refresh ownership sits entirely with that external process.\n\nAccess tokens are short-lived and expire; an expired value fails closed. Deleting or disabling the API client in the Falcon console stops new token issuance, but any already-issued token should be treated as valid until it expires — stopping issuance is not token invalidation, so rotate on suspicion rather than relying on revocation.\n\nLeast privilege: create the API client with only the scopes the registered capabilities need (Hosts read and Alerts read for the reads; Hosts write for containment and tags, and Alerts write for alert updates) and prefer separate clients for read-only versus response use, each under its own reference.\n\nExecutor hygiene: the value must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must not appear in crash dumps; a deployment that cannot meet that bar must not enable the pack." }, "capabilities": [ { "capability_id": "crowdstrike.hosts.read", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "crowdstrike-api.invalid" ], "endpoint": "https://crowdstrike-api.invalid/devices/combined/devices/v1", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-crowdstrike-oauth-token", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "crowdstrike-falcon-devices", "description": "Search hosts and return full device records: hostnames, IPs, platform, agent and containment status. Operation and route verified against the retrieved vendor SDK reference (FalconPy Hosts collection: CombinedDevicesByFilter, GET /devices/combined/devices/v1, 'Search for hosts. Returns full device records.', Hosts: READ scope, retrieved 2026-09-21). Registered as the collection read; single-id detail reads (devices/entities/devices) are not registered. Requires the Hosts read scope.\n\nThe host is a reserved placeholder: substitute the customer's Falcon base API host before enabling.", "requires_review": true }, { "capability_id": "crowdstrike.device_login_history.read", "version": "1.0.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "pii", "egress_allowlist": [ "crowdstrike-api.invalid" ], "endpoint": "https://crowdstrike-api.invalid/devices/combined/devices/login-history/v2", "method": "POST", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-crowdstrike-oauth-token", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "crowdstrike-falcon-devices", "description": "Retrieve recent login sessions for a set of device ids; the response names the users who logged in, so the read is classified as pii (personal data). The operation is a POST with a read-only effect (ids in the request body; the retrieved vendor SDK reference documents no maximum on the ids array — the documented 100 cap applies to the result limit, default 10) and requires the Hosts read scope.\n\nThe host is a reserved placeholder: substitute before enabling.", "requires_review": true }, { "capability_id": "crowdstrike.alerts.read", "version": "1.1.0", "kind": "tool", "risk_tier": "R0", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "crowdstrike-api.invalid" ], "endpoint": "https://crowdstrike-api.invalid/alerts/queries/alerts/v2", "method": "GET", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-crowdstrike-oauth-token", "inject": "header", "inject_name": "Authorization", "actions": [ "read" ], "resource_id": "crowdstrike-falcon-alerts", "description": "Search alert ids matching an FQL filter, with offset pagination, sort and an optional include_hidden flag (CrowdStrike Alerts collection, GetQueriesAlertsV2, GET /alerts/queries/alerts/v2, 'Retrieves all Alerts ids that match a given query'; the limit defaults to 100, maximum 10000). Registered as the query read; alert detail retrieval (PostEntitiesAlertsV2), aggregates and the deprecated v1 query are not registered. Requires the Alerts read scope. This capability replaces crowdstrike.detections.read@1.0.0, which used the Detects collection that CrowdStrike decommissioned on 2025-09-30.\n\nThe host is a reserved placeholder: substitute before enabling.", "requires_review": true }, { "capability_id": "crowdstrike.alerts.update", "version": "1.1.0", "kind": "tool", "risk_tier": "R2", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "crowdstrike-api.invalid" ], "endpoint": "https://crowdstrike-api.invalid/alerts/entities/alerts/v3", "method": "PATCH", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-crowdstrike-oauth-token", "inject": "header", "inject_name": "Authorization", "actions": [ "update" ], "resource_id": "crowdstrike-falcon-alerts", "description": "Modify one or more alerts by composite id (PatchEntitiesAlertsV3, PATCH /alerts/entities/alerts/v3): status through update_status, assignment and unassignment, appended comments, tags, and visibility — show_in_ui false hides the alert from the console. Changing status or hiding alerts suppresses analyst visibility of possible intrusion activity; the change is reversible, so the capability sits at the minimum R2 tier for update with the suppression risk stated here and bounded by policy. The request body names the composite ids and action parameters, and this registration does not restrict which alerts or which parameters a caller sends.\n\nRequires the Alerts write scope. This capability replaces crowdstrike.detections.update@1.0.0, which used the Detects collection that CrowdStrike decommissioned on 2025-09-30.\n\nThe host is a reserved placeholder: substitute before enabling.", "requires_review": true }, { "capability_id": "crowdstrike.hosts.contain", "version": "1.0.0", "kind": "tool", "risk_tier": "R3", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "crowdstrike-api.invalid" ], "endpoint": "https://crowdstrike-api.invalid/devices/entities/devices-actions/v2?action_name=contain", "method": "POST", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-crowdstrike-oauth-token", "inject": "header", "inject_name": "Authorization", "actions": [ "deploy" ], "resource_id": "crowdstrike-falcon-devices", "description": "Network-contain one or more hosts (action_name 'contain' with the host AIDs in the request body, maximum 100 per call). Containment immediately severs the endpoint's network connectivity except to the Falcon cloud, which can interrupt live production workloads and cannot be presumed consequence-free even though lift_containment exists — it is registered with the deploy action at the minimum R3 tier as a response-action equivalent of deploy, and deploy is one of the designated actions requiring human approval for floor purposes.\n\nThe action_name selector is pinned in this registration's endpoint query string (action_name=contain) — the retrieved vendor SDK reference documents action_name as a query parameter of this operation — and the caller cannot alter it, because a caller names a capability, never a destination; the same operation with other action names (hide_host, unhide_host, detection_suppress) is therefore not reachable through this registration. Requires the Hosts write scope.\n\nThe host is a reserved placeholder: substitute before enabling.\n\nOn supported AAES-mediated execution paths, the declared irreversible actions require an authorized person’s approval. Observation-only and bypass calls cannot be stopped by this control.", "requires_review": true }, { "capability_id": "crowdstrike.hosts.lift_containment", "version": "1.0.0", "kind": "tool", "risk_tier": "R3", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "crowdstrike-api.invalid" ], "endpoint": "https://crowdstrike-api.invalid/devices/entities/devices-actions/v2?action_name=lift_containment", "method": "POST", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-crowdstrike-oauth-token", "inject": "header", "inject_name": "Authorization", "actions": [ "update", "deploy" ], "resource_id": "crowdstrike-falcon-devices", "description": "Lift network containment on one or more hosts (the action_name=lift_containment selector is pinned in this registration's endpoint query string, with the host AIDs in the request body, maximum 100 per call), restoring normal connectivity. Lifting containment changes live endpoint state and re-exposes the network if the host is still compromised, so it declares update and deploy at the minimum R3 tier as a response-action equivalent of deploy — it is not an ordinary reversible edit, and deploy is one of the designated actions requiring human approval.\n\nOn supported AAES-mediated execution paths, irreversible actions require approval by an authorized person; this does not prevent calls through bypass or observation-only paths. Requires the Hosts write scope.\n\nThe host is a reserved placeholder: substitute before enabling.", "requires_review": true }, { "capability_id": "crowdstrike.device_tags.update", "version": "1.0.0", "kind": "tool", "risk_tier": "R3", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN", "data_class": "internal", "egress_allowlist": [ "crowdstrike-api.invalid" ], "endpoint": "https://crowdstrike-api.invalid/devices/entities/devices/tags/v1", "method": "PATCH", "connector": "http", "custody": "customer_vault", "secret_ref_id": "secret-ref-crowdstrike-oauth-token", "inject": "header", "inject_name": "Authorization", "actions": [ "update", "deploy" ], "resource_id": "crowdstrike-falcon-devices", "description": "Append or remove Falcon grouping tags on one or more hosts (action_name add or remove with tags and AIDs in the request body). Grouping tags can drive dynamic host-group membership, which prevention policies may target, so a tag change can indirectly change a host's effective prevention-policy assignment — a live policy-enforcement change, so the capability declares update and deploy at the minimum R3 tier; review downstream group rules before enabling.\n\nNote: the retrieved vendor SDK reference documents this operation's action_name (add or remove) as a request-BODY field, so the add/remove choice is not restricted by this registration — the tier declaration covers both. Requires the Hosts write scope.\n\nThe host is a reserved placeholder: substitute before enabling.\n\nOn supported AAES-mediated execution paths, the declared irreversible actions require an authorized person’s approval. Observation-only and bypass calls cannot be stopped by this control.", "requires_review": true } ], "resources": [ { "resource_id": "crowdstrike-falcon-devices", "kind": "api", "locator": "https://crowdstrike-api.invalid/devices", "data_class": "pii", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN" }, { "resource_id": "crowdstrike-falcon-alerts", "kind": "api", "locator": "https://crowdstrike-api.invalid/alerts", "data_class": "internal", "owner": "REPLACE-WITH-ACCOUNTABLE-HUMAN" } ], "review": { "state": "library", "date": "2026-10-22", "sources": [ "https://developer.crowdstrike.com/ (retrieved 2026-09-21)", "https://www.falconpy.io/Usage/Authenticating-to-the-API.html (retrieved 2026-09-21)", "https://www.falconpy.io/Service-Collections/Hosts.html (retrieved 2026-09-21)", "https://www.falconpy.io/Service-Collections/Detects.html (retrieved 2026-09-21)", "https://developer.crowdstrike.com/api-reference/collections/alerts/ (retrieved 2026-10-22)", "https://developer.crowdstrike.com/api-reference/collections/detects/ (retrieved 2026-10-22)" ], "reviewer_id": "owner-delegated" } }