What can I automate with CrowdStrike Falcon?

Start a workflow or agent when New Alert happens in CrowdStrike Falcon, then List Devices, List Device Entities or Start Scan, alongside 200+ other apps.

Can an AI agent update CrowdStrike Falcon?

Yes, when you add CrowdStrike Falcon actions to its tools. You can pin fields, limit values and require approval before it acts, and every action is recorded in the Event Logs.

Do I need to write code?

No. Pick a trigger and actions in the builder, or describe what you want and Copilot sets it up.

What if the CrowdStrike Falcon action I need isn't listed?

Call the CrowdStrike Falcon API from any REST API step. On the Enterprise plan, talk to us about adding it.

IT & Development

CrowdStrike Falcon integration

Start workflows and AI agents from CrowdStrike Falcon events, and let agents act in CrowdStrike Falcon within the limits you set.

1 trigger
17 actions
MCP server

Book a demo Start free

CrowdStrike Falcon triggers and actions

Every CrowdStrike Falcon trigger and action you can use in Konnectify workflows and AI agents.

Trigger: New Alert Checked on a schedule
Polls CrowdStrike Alerts using the created_timestamp FQL range and emits full alert entities created between since and till.
Action: List Devices
Returns a page of device AIDs using GET /devices/queries/devices/v1.
Action: List Device Entities
Retrieves full device records using GET /devices/entities/devices/v2.
Action: Start Scan
Starts an ODS scan on explicitly selected hosts or host groups.
Action: Schedule Scan
Creates a Falcon ODS scheduled scan targeting the specified host groups.
Action: Get Scan Results
Retrieves scan entities including status, file counts, and severity using /ods/entities/scans/v2.
Action: Cancel Scan
Cancels ODS scan runs. Enable Delete Schedule to remove future scheduled scans by schedule ID.
Action: Contain Host
Requests Falcon network containment for the specified host AIDs.
Action: Lift Containment
Requests removal of Falcon network containment for the specified host AIDs.
Action: List Host Groups
Returns a page of host groups with their details and pagination metadata.
Action: Add Hosts to Group
Adds the specified host AIDs to a static host group.
Action: Remove Hosts from Group
Removes the specified host AIDs from a static host group.
Action: List Prevention Policies
Returns a page of prevention policies and their settings.
Action: Assign Policy to Group
Adds a host group to a prevention policy using the add-host-group action.
Action: List Sensor Installers
Lists sensor installer metadata, including SHA256 IDs used for downloads.
Action: Get Installation Details
Retrieves the customer ID with checksum for installation and optionally the current sensor details for host AIDs.
Action: Get Alerts by Composites
Retrieves CrowdStrike alerts for the supplied composite IDs using POST /alerts/entities/alerts/v2.
Action: List All Alerts
Queries CrowdStrike alert composite IDs and then retrieves the full alert entities for those IDs.

Showing 12 of 18

Use CrowdStrike Falcon in an AI agent

Add any CrowdStrike Falcon action to an agent as a tool. The agent decides when to use it; you set the limits. Pin fields it can't change, limit fields to allowed values, and require approval before it acts. Every action is recorded in the Event Logs.

How AI agents work

Connect CrowdStrike Falcon with other apps

See what you can automate between CrowdStrike Falcon and another app, with workflows and AI agents.

Which app do you want to connect with CrowdStrike Falcon?

CrowdStrike Falcon

Pick any of 201 apps to see what it can do with CrowdStrike Falcon.

Popular with CrowdStrike Falcon

CrowdStrike Falcon and AI

Add AI steps to CrowdStrike Falcon workflows
Summarise, classify or draft with ChatGPT, Claude or Gemini inside a workflow.CrowdStrike Falcon + ChatGPT CrowdStrike Falcon + Claude CrowdStrike Falcon + Gemini
Use CrowdStrike Falcon actions from Claude or ChatGPT
Expose the CrowdStrike Falcon actions you choose to Claude, ChatGPT or another MCP client through an MCP server you control.
Set up an MCP server

FAQ

Got questions?

If you can't find what you're looking for, talk to our team.

Yes. Konnectify connects to CrowdStrike Falcon with 1 trigger and 17 actions, which you can use in workflows, AI workflows and AI agents.

Connect CrowdStrike Falcon and run your first workflow

Start on the Free plan with a 14-day trial of paid features, or book a demo and we'll build it with you.