API Reference
The CrowdStrike Falcon API puts the full power of the Falcon platform in your hands. Automate threat response across thousands of endpoints. Build custom detection pipelines. Integrate real-time security telemetry into your SIEM, SOAR, or data lake. Hunt adversaries programmatically with the same intelligence CrowdStrike analysts use every day.
Explore by Domain
Section titled “Explore by Domain”Endpoint Security
Section titled “Endpoint Security”Manage hosts, investigate detections, respond to incidents, and track sensors across your fleet.
Real-Time Response
Section titled “Real-Time Response”Execute commands on live endpoints, run scripts, contain compromised hosts, and manage RTR sessions at scale.
Threat Intelligence
Section titled “Threat Intelligence”Research adversaries, track indicators of compromise, query intelligence reports, and analyze malware.
Cloud & Container Security
Section titled “Cloud & Container Security”Register cloud accounts, monitor containers and Kubernetes workloads, assess cloud posture, and track image vulnerabilities.
Vulnerability Management
Section titled “Vulnerability Management”Pull CVE data, prioritize remediation with ExPRT ratings, and track exposure risk across your environment.
Identity & Access
Section titled “Identity & Access”Investigate entities, assess identity risk, manage users, and operate across multi-tenant MSSP environments.
Data Pipelines & SIEM
Section titled “Data Pipelines & SIEM”Stream events in real time, execute CQL queries against Next-Gen SIEM, and build data ingestion pipelines.
Policy & Configuration
Section titled “Policy & Configuration”Manage firewall rules, configure IOA exclusions, control sensor visibility, and customize detection behavior.
Workflows & Automation
Section titled “Workflows & Automation”Orchestrate security operations with scheduled reports, on-demand scans, and automated workflows.
Application Security
Section titled “Application Security”Manage application security posture, monitor SaaS integrations, and assess API risks.
Data Protection
Section titled “Data Protection”Configure data loss prevention policies and scan data at rest.
File Integrity & Change Monitoring
Section titled “File Integrity & Change Monitoring”Monitor file changes, manage policies, and track deviations across your environment.
Network Security
Section titled “Network Security”Scan networks, manage zones, discover assets, and report on scan results.
Case & Incident Management
Section titled “Case & Incident Management”Manage cases, track escalations, and coordinate response across your SOC.
Knowledge & AI
Section titled “Knowledge & AI”Manage knowledge bases, files, and audit events for AI-powered workflows.
Deployment & Updates
Section titled “Deployment & Updates”Manage deployments, releases, and serverless export jobs.
Integrate with Artificial Intelligence
Section titled “Integrate with Artificial Intelligence”The Falcon MCP Server gives AI assistants direct access to the CrowdStrike Falcon platform through the Model Context Protocol. Investigate threats, triage detections, query hosts, research adversaries, and automate security operations - all through natural language conversations with your AI tools.