Functions: UI Editor

The Foundry UI Editor lets you write, test, and deploy Python functions directly in the Falcon console — no CLI installation required.

Watch: Deploy, edit, test, and debug a Python function in the Falcon Foundry functions editor.

Editor layout

The editor has three main areas:

• File list (left) — Navigate between function files
• Code editor (center) — Write Python code with syntax highlighting
• Tabs (top) — Function code, Handlers, Runtime config, Test

Writing a handler

Create a new function from the App Builder:

1. Go to Functions in the App Builder.
2. Click Create function.
3. Select Python as the language.
4. The editor opens with a sample handler.

Templates

The editor provides starter templates for common patterns. Click Templates to browse and insert a template into your function.

Handler registration

After writing your handler function, register it in the Handlers tab:

1. Click the Handlers tab.
2. Click Add handler.
3. Provide the handler name and map it to your Python function.
4. Toggle Share with workflows if you want the function callable from Fusion SOAR workflows.

Testing functions

Functions must be deployed before they can be tested in the UI Editor. Functions that use FalconPy require the app to be installed (not just deployed) because FalconPy’s context-aware authentication needs a real app installation to generate credentials.

1. Deploy your app by clicking Deploy in the App Builder toolbar.
2. Switch to the Test tab in the editor.
3. Provide test input as JSON.
4. Click Run.
5. Review the response output.

Function logs

The editor provides a Function logs button in the toolbar that opens Advanced Event Search with a pre-populated query for your function. To write log output, add a logger parameter to your handler signature:

from logging import Logger
from typing import Dict, Optional
from crowdstrike.foundry.function import Function, Request, Response

FUNC = Function.instance()

@FUNC.handler(method="POST", path="/my-handler")
def on_post(request: Request, _config: Optional[Dict[str, object]], logger: Logger) -> Response:
    logger.info(f"Processing request: {request.body}")
    # ... function logic
    return Response(body={"status": "ok"}, code=200)

The FDK injects the logger automatically. Log output appears in Advanced Event Search after execution.

API scope auto-detection

The Runtime Config tab shows the API scopes your function requires. The editor automatically detects scopes based on FalconPy service class imports in your code.

For example, importing from falconpy import Hosts automatically adds the Devices: READ (aka. Hosts: READ) scope with origin “Code derived.” You can manually add or remove scopes in the Runtime Config tab if the auto-detection doesn’t cover your use case.

Limitations

The UI Editor supports Python only. For Go functions, use the Foundry CLI.

The browser editor does not support:

• Local testing (functions must be deployed to test)
• Custom dependencies beyond FalconPy and the standard library
• Multi-file functions with shared utility modules

For these scenarios, use the Foundry CLI.