Skip to content
CrowdStrike
Developer Center
Search
Ctrl
K
Cancel
SDK
Python
PowerShell
Go
TypeScript
Rust
Ruby
GitHub
Reddit
LinkedIn
Instagram
YouTube
API Reference
Overview
All Operations
Operations by Collection
Falcon Query Language
Collections
Admission Control Policies
Alerts
API Integrations
ASPM
CAO Hunting
Case Management
Certificate Based Exclusions
Cloud AWS Registration
Cloud Azure Registration
Cloud Connect AWS
Cloud GCP Registration
Cloud Google Cloud Registration
Cloud OCI Registration
Cloud Policies
Cloud Security
Cloud Security Assets
Cloud Security Compliance
Cloud Security Detections
Cloud Security Risks
Cloud Snapshots
Configuration Assessment
Configuration Assessment Evaluation Logic
Container Alerts
Container Detections
Container Image Compliance
Container Images
Container Packages
Container Vulnerabilities
Content Update Policies
Correlation Rules
Correlation Rules Admin
CSPM Registration
Custom IOA
Custom Storage
D4C Registration
Data Protection Configuration
Delivery Settings
Deployments
Detects
Device Content
Device Control Policies
Discover
Downloads
Drift Indicators
Event Streams
Exposure Management
FaaS Execution
Falcon Complete Dashboard
Falcon Container
Falconx Sandbox
FDR
Federated Connections
FileVantage
Firewall Management
Firewall Policies
Foundry LogScale
Host Group
Host Migration
Hosts
Identity Protection
Image Assessment Policies
Installation Tokens
Intel
Intelligence Feeds
Intelligence Indicator Graph
IOA Exclusions
IOC
IOCs
IT Automation
Knowledge Base Audit Events
Knowledge Base Files
Knowledge Bases
Kubernetes Container Compliance
Kubernetes Protection
MalQuery
Message Center
ML Exclusions
Mobile Enrollment
MSSP (Flight Control)
Network Scan Global Configs
Network Scan Networks
Network Scan Scan Run Reports
Network Scan Scan Runs
Network Scan Scanners
Network Scan Scans
Network Scan Templates
Network Scan Zones
NGSIEM
OAuth2
ODS (On Demand Scan)
Overwatch Dashboard
Prevention Policy
Quarantine
Quick Scan
Quick Scan Pro
Real Time Response
Real Time Response Admin
Real Time Response Audit
Recon
Report Executions
Response Policies
SaaS Security
Sample Uploads
Scheduled Reports
Sensor Download
Sensor Update Policy
Sensor Usage
Sensor Visibility Exclusions
Serverless Exports
Serverless Vulnerabilities
Spotlight Evaluation Logic
Spotlight Vulnerabilities
Spotlight Vulnerability Metadata
Tailored Intelligence
ThreatGraph
Unidentified Containers
User Management
Workflows
Zero Trust Assessment
Falcon Foundry
Understanding Foundry
Getting Started
Quickstart: Falcon Console
Quickstart: Foundry CLI
Samples
App Lifecycle
Creating Apps
Deploying Apps
Releasing Apps
App Catalog
Managing Apps
Import & Export
Versioning
Dependency Management
Authorization
About Authorization
Role-Based Access Control
API Scopes
Data
API Integrations
Collections
Queries
Experience
UI Extensions
UI Pages
Dashboards
UI Examples
Logic
Functions Overview
Functions: Foundry CLI
Functions: UI Editor
Workflow Templates
Workflow Debugging & Testing
RTR Scripts
Tutorials
Detection Enrichment App
Custom SOAR Action
Push Data Connector
Threat Hunting Dashboard
Deploy an App Template
Reference
CLI Reference
App Manifest Reference
UI Kit
App Documentation
Falcon MCP
Overview
Getting Started
Configuration
Credentials
Installation
Quickstart
Usage
Cli
Editor Integration
Flight Control
Transports
Modules
Module Overview
Case Management
Cloud Security
Correlation Rules
Custom IOA
Detections
Discover
Firewall Management
Hosts
Identity Protection
Intel
IOC
NGSIEM
Quarantine
Real Time Response
Scheduled Reports
Sensor Usage
Serverless
Shield
Spotlight
Deployment
Amazon Bedrock
Docker
Google Cloud
Development
E2E Testing
Integration Testing
Module Development
Resource Development
Examples
Basic Usage
Mcp Config
Changelog
Falcon Next-Gen SIEM
Overview
Parsing Standard (CPS)
Overview
CPS-Compliant Parsers
Parser Guidelines
Parser Template
Vendor Guidelines
Module Guidelines
observer.type Guidelines
Deprecated Parsers
Versions
Data Ingestion (HEC)
Correlation Rules
Fusion SOAR
Limits & Standards
Configuration as Code
Overview
Terraform Provider
Importing
Content Update Policy
Resources
content_update_policy
content_update_policy_attachment
content_update_policy_precedence
default_content_update_policy
Data Sources
content_category_versions
content_update_policies
Data Protection
Resources
data_protection_content_pattern
data_protection_sensitivity_label
Endpoint Security
Resources
custom_ioc
ioa_exclusion
ioa_rule_group
ml_certificate_exclusion
ml_file_path_exclusion
Falcon Cloud Security
Resources
cloud_aws_account
cloud_azure_tenant
cloud_azure_tenant_eventhub_settings
cloud_compliance_custom_framework
cloud_google_registration
cloud_google_registration_settings
cloud_group
cloud_security_custom_rule
cloud_security_iom_custom_rule
cloud_security_kac_custom_rule
cloud_security_kac_policy
cloud_security_kac_policy_precedence
cloud_security_suppression_rule
Data Sources
cloud_aws_account
cloud_aws_account_validation
cloud_compliance_framework_controls
cloud_risk_findings
cloud_security_rules
cloud_security_suppression_rules
FileVantage
Resources
filevantage_policy
filevantage_policy_attachment
filevantage_policy_precedence
filevantage_rule_group
Data Sources
filevantage_policies
Flight Control
Resources
user_group
Host Group
Resources
host_group
Data Sources
host_group
Host Setup and Management
Resources
cid_group
install_token
response_policy
response_policy_precedence
rtr_put_file
rtr_script
Data Sources
cid_group
rtr_put_file
rtr_script
IT Automation
Resources
it_automation_default_policy
it_automation_policy
it_automation_policy_precedence
it_automation_task
it_automation_task_group
Data Sources
it_automation_policies
it_automation_task_groups
it_automation_tasks
Prevention Policy
Resources
default_prevention_policy_linux
default_prevention_policy_mac
default_prevention_policy_windows
prevention_policy_attachment
prevention_policy_linux
prevention_policy_mac
prevention_policy_precedence
prevention_policy_windows
Data Sources
prevention_policies
Sensor Update Policy
Resources
default_sensor_update_policy
sensor_update_policy
sensor_update_policy_host_group_attachment
sensor_update_policy_precedence
Data Sources
sensor_update_policies
sensor_update_policy_builds
Sensor Visibility Exclusion
Resources
sensor_visibility_exclusion
sensor_visibility_exclusion_attachment
Data Sources
sensor_visibility_exclusions
Terraform Modules
AWS Cloud Registration
AWS SSM Distributor
Azure Cloud Registration
GCP Cloud Registration
Kubernetes
OCI Cloud Registration
Sensor Deployment
Overview
Ansible
Overview
Authentication
Roles
falcon_configure
falcon_install
falcon_uninstall
Modules
auth
cid_info
correlation_rule
correlation_rule_info
falconctl
falconctl_info
fctl_child_cid_info
host_contain
host_group
host_group_info
host_hide
host_info
hunting_rule_download
intel_rule_download
intel_rule_info
kernel_support_info
ngsiem_search
sensor_download
sensor_download_info
sensor_update_builds_info
sensor_update_policy
sensor_update_policy_info
Inventory Plugins
falcon_discover
falcon_hosts
Lookup Plugins
fctl_child_cids
host_ids
maintenance_token
Event Driven Ansible
Chef
Overview
Usage
Resources
Puppet
Overview
Usage
Reference
Scripts
Overview
Bash
Install / Uninstall
Migrate
Container Sensor Pull
PowerShell
Install / Uninstall
Migrate
SystemD
Docker
Podman
Software Development Kits
Overview
Python
Overview
Installation
Authentication
Configuration
Extensibility
Logging
Payloads
Responses
Service Classes
Uber Class
Terminology
Helpers
Colorize Text
HTTP Event Collector
Lookup API Operation
Random String
Wait Indicator
PowerShell
Overview
Installation
Authentication
Usage
Filtering
Go
Overview
Getting Started
TypeScript
Overview
Getting Started
Rust
Overview
Getting Started
Ruby
Overview
Getting Started
SDK
Python
PowerShell
Go
TypeScript
Rust
Ruby
GitHub
Reddit
LinkedIn
Instagram
YouTube
Falcon IaC
MD
