Manage Your Fleet

Fleet management at scale requires visibility into every endpoint, control over security policies, and the ability to act on thousands of devices at once. The Falcon platform gives you APIs to query your host population, organize devices into groups, enforce policies, and monitor sensor health.

Asset Inventory

Track every endpoint by OS, sensor version, last seen time, and containment status.

Policy Enforcement

Ensure prevention, firewall, and device control policies are applied consistently across your fleet.

Sensor Health

Monitor agent versions, RFM status, and deployment coverage across your environment.

Endpoint Triage

Contain compromised hosts, update sensor versions, suppress detections, and manage device state at scale.

Group Management

Organize hosts by business unit, location, or risk profile using Falcon Grouping Tags.

Compliance Reporting

Verify sensor deployment and policy coverage across your estate.

API Service Collections

Endpoint Security

The core APIs for querying and managing your fleet of endpoints.

• Hosts - Search for devices by platform, hostname, IP, sensor version, and dozens of other properties. Retrieve detailed device records and check online status.
• Alerts - Monitor alert volumes across your fleet to identify hosts generating the most security events.
• Sensor Download - Access sensor installers and CCID values for deployment automation.
• Host Group - Create, modify, and manage host groups for targeted policy application.

Policy & Configuration

Control the security policies that govern endpoint behavior across your environment.

• Prevention Policy - Manage prevention policies that control detection and blocking behavior.
• Device Control Policies - Control USB and peripheral device access on endpoints.
• Response Policies - Configure real-time response capabilities per policy group.
• Sensor Update Policy - Manage sensor update schedules, release groups, and deployment rings.
• Firewall Management - Configure and manage Falcon firewall rules.
• Firewall Policies - Assign firewall rule groups to host groups via policies.
• Content Update Policies - Control content update delivery to endpoints.
• Configuration Assessment - Evaluate endpoint configurations against security benchmarks.

Sensor Management

• Installation Tokens - Generate and manage tokens required for sensor installation.
• Sensor Usage - Track sensor license consumption and usage metrics.

Developer Resources

Falcon MCP

The Falcon MCP gives AI assistants direct access to your fleet data:

• Hosts module - query devices by platform, sensor version, containment status, and network segment. Manage Falcon Grouping Tags and check online state.
• Discover module - search assets across your environment including unmanaged devices
• Sensor Usage module - track sensor license consumption

For MSSP environments managing multiple tenants, the Flight Control documentation covers cross-tenant fleet operations.