Cloud Security
Accessing and analyzing CrowdStrike Falcon cloud resources like Kubernetes & Containers Inventory, Images Vulnerabilities, Cloud Assets
API Scopes
Section titled “API Scopes”- Cloud Groups V2: READ
- Cloud Security API Assets: READ
- Cloud Security API Detections: READ
- Cloud Security API Risks: READ
- Cloud Security Policies: READ
- Falcon Container Image: READ
- Cloud Security Policies: WRITE
falcon_count_kubernetes_containers
Section titled “falcon_count_kubernetes_containers”Required scopes: Falcon Container Image: READ
Count Kubernetes containers matching filter criteria.
Use this for aggregate counts without returning full container details. Consult falcon://cloud/kubernetes-containers/fql-guide before constructing filter expressions. Returns the matching container count as an integer.
Example prompts:
- “How many containers are running in Azure?”
falcon_create_cspm_suppression_rule
Section titled “falcon_create_cspm_suppression_rule”Required scopes: Cloud Security Policies: READ, Cloud Security Policies: WRITE
Create a CSPM IOM suppression rule to hide matching findings.
Suppressed findings are still assessed but not surfaced in compliance scores. Requires at least one rule selection (rule_ids, rule_names, or rule_severities) and a suppression reason. Setting an expiration_date is strongly recommended to avoid permanent suppressions. Returns the created suppression rule object.
Example prompts:
- “Create a CSPM suppression rule for the S3 encryption finding in the dev account as accepted risk”
- “Suppress the IAM password policy IOM finding as a false positive, expiring in 30 days”
falcon_delete_cspm_suppression_rules
Section titled “falcon_delete_cspm_suppression_rules”Required scopes: Cloud Security Policies: WRITE
Delete CSPM IOM suppression rules by ID.
Deleting a suppression rule re-activates all findings that were previously suppressed by it. Use falcon_search_cspm_suppression_rules to find rule IDs first. Returns a confirmation response.
Example prompts:
- “Delete CSPM suppression rule abc-123”
- “Remove the CSPM IOM suppression rule for the S3 public access finding”
falcon_get_cloud_groups
Section titled “falcon_get_cloud_groups”Required scopes: Cloud Groups V2: READ
Get detailed information for cloud groups by ID.
Use when you already have specific cloud group IDs — for example, the cloud_groups
field returned by falcon_search_cloud_risks. Returns full group details including
name, selectors, business impact, and environment tags.
Example prompts:
- “Get the details for cloud group abc-123”
falcon_search_cloud_groups
Section titled “falcon_search_cloud_groups”Required scopes: Cloud Groups V2: READ
List cloud groups in your CrowdStrike environment.
Use this to discover available cloud groups before filtering risks by
cloud_group or groups.* FQL fields in falcon_search_cloud_risks.
Returns full group details including name, selectors, and tags.
Example prompts:
- “What cloud groups are configured in my environment?”
- “List all cloud groups tagged as production”
falcon_search_cloud_risks
Section titled “falcon_search_cloud_risks”Required scopes: Cloud Security API Risks: READ
Search for cloud risks in your CrowdStrike environment.
Use this to find risks by severity, status, cloud provider, account, asset, rule,
or threat actor. Cloud risks aggregate IOM and IOA findings into per-asset risk
records and include threat intelligence attribution. For individual compliance rule
violations on specific resources, use falcon_search_iom_findings instead. Consult
falcon://cloud/cloud-risks/fql-guide before constructing filter expressions.
Returns full risk details including severity, lifecycle status, asset context, and
threat intelligence attribution.
Responses include pagination.total (the total number of records matching the filter, or null when the API does not report a count) — use it to answer “how many” questions.
Example prompts:
- “Show me all open critical cloud risks in AWS”
- “Which account has the most unresolved critical risks?”
- “What new cloud risks appeared in the last 7 days?”
- “Show me risks for the production cloud group”
- “What cloud risks have been suppressed and why?”
falcon_search_cspm_assets
Section titled “falcon_search_cspm_assets”Required scopes: Cloud Security API Assets: READ
Search for cloud assets in your CrowdStrike CSPM inventory.
Use this to find cloud resources (EC2, VPCs, S3, etc.) by provider, region,
resource type, or tags. Consult falcon://cloud/cspm-assets/fql-guide before
constructing filter expressions. Returns slimmed asset details with security
posture context (IOM/IOA counts, exposure, severity).
Responses include pagination.total (the total number of records matching the filter, or null when the API does not report a count) — use it to answer “how many” questions. For cursor-based paging, use pagination.next as the after parameter on the next call.
Example prompts:
- “Find all AWS EC2 instances in my cloud inventory”
falcon_search_cspm_suppression_rules
Section titled “falcon_search_cspm_suppression_rules”Required scopes: Cloud Security Policies: READ
Search for CSPM IOM suppression rules.
Use this to review existing suppressions before creating new ones. Returns
suppression rule objects including scope, reason, and expiration details.
Returns an empty list if no rules exist.
Responses include pagination.total (the total number of records matching the filter, or null when the API does not report a count) — use it to answer “how many” questions.
Example prompts:
- “List all CSPM IOM suppression rules and their reasons”
- “Show me which CSPM findings are being suppressed and why”
falcon_search_images_vulnerabilities
Section titled “falcon_search_images_vulnerabilities”Required scopes: Falcon Container Image: READ
Search for container image vulnerabilities in CrowdStrike Image Assessments.
Use this to find CVEs affecting container images by severity, CVSS score, or
CVE ID. Consult falcon://cloud/images-vulnerabilities/fql-guide before constructing
filter expressions. Returns vulnerability details including CVE IDs, scores, and
impacted image counts.
Responses include pagination.total (the total number of records matching the filter, or null when the API does not report a count) — use it to answer “how many” questions.
Example prompts:
- “Find image vulnerabilities with CVSS score above 7”
falcon_search_iom_findings
Section titled “falcon_search_iom_findings”Required scopes: Cloud Security API Detections: READ
Search for CSPM Indicators of Misconfiguration (IOM) findings.
Use this to find specific compliance rule failures on individual cloud resources —
each IOM is a single rule-against-resource violation (e.g. “S3 bucket ACL allows
public write” on a named bucket). For aggregated risk posture combining multiple
IOMs and IOAs across assets, use falcon_search_cloud_risks instead. For runtime
behavioral threats, use falcon_search_detections. Consult
falcon://cloud/cspm-iom-findings/fql-guide before constructing filter expressions.
Returns IOM entities with cloud context, evaluation details, and resource information.
Responses include pagination.total (the total number of records matching the filter, or null when the API does not report a count) — use it to answer “how many” questions.
Example prompts:
- “Show me critical open CSPM misconfiguration findings in AWS”
- “Find IOM findings for S3 buckets with public access”
- “What CSPM IOM findings are suppressed as accepted risk?”
falcon_search_kubernetes_containers
Section titled “falcon_search_kubernetes_containers”Required scopes: Falcon Container Image: READ
Search for Kubernetes containers in your CrowdStrike container inventory.
Use this to find containers by cluster, namespace, image, or cloud provider. Consult falcon://cloud/kubernetes-containers/fql-guide before constructing filter expressions. Returns full container details including image, status, and vulnerabilities.
Example prompts:
- “Find all containers running in AWS clusters”
- “Show me containers in the prod cluster”
Resources
Section titled “Resources”falcon://cloud/kubernetes-containers/fql-guide: Contains the guide for thefilterparam of thefalcon_search_kubernetes_containersandfalcon_count_kubernetes_containerstools.falcon://cloud/images-vulnerabilities/fql-guide: Contains the guide for thefilterparam of thefalcon_search_images_vulnerabilitiestool.falcon://cloud/cspm-assets/fql-guide: Contains the guide for thefilterparam of thefalcon_search_cspm_assetstool.falcon://cloud/cspm-iom-findings/fql-guide: Contains the guide for thefilterparam of thefalcon_search_iom_findingstool.falcon://cloud/cloud-risks/fql-guide: Contains the guide for thefilterparam of thefalcon_search_cloud_riskstool.