Security & Identity · CONNECTIONRead CrowdStrike Falcon hosts, online state and alerts, and update alert status, comments and tags.
Explore 8 workflow actions for CrowdStrike Falcon, including account permissions and operation limits.
Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.
Append a comment to alerts.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Read alerts by composite ID.
Read whether hosts are online, offline or unknown.
Read up to 100 hosts by agent ID.
Find alert composite IDs with an FQL filter, newest first by default.
Search hosts by platform, hostname, IP or other FQL filters, with full device records.
Add a tag to alerts.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Set alerts to new, in progress, reopened or closed.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Use the account and permissions required for your process. Review the connection check before configuring a workflow action.
Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.
Inspect step outputs and confirm the result in CrowdStrike Falcon. A saved workflow is not a completed provider action.
