CrowdStrike Falcon API

Name: CrowdStrike Falcon API
Brand: CrowdStrike Falcon API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityThreat Detectionoauth274 EndpointsREST

For Agents

Query endpoint alerts, investigate incidents, manage host containment, and retrieve threat intelligence from CrowdStrike Falcon's endpoint detection and response platform across multiple regional clouds.

Install Jentic One Beta

Connect the CrowdStrike Falcon API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the CrowdStrike Falcon API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with CrowdStrike Falcon API.

Query and triage endpoint security alerts with severity filtering and aggregate analytics

Investigate incidents by retrieving associated behaviors, host details, and timeline data

Contain compromised hosts or lift containment through device action commands

GET STARTED

Start building with CrowdStrike Falcon API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI specification for CrowdStrike Falcon API, keeping it validated and agent-ready. Detect, investigate, and respond to endpoint threats across 74 API endpoints covering host management, alert triage, incident response, IOC management, and real-time response sessions. The Falcon platform provides access to threat intelligence feeds, prevention policy configuration, spotlight vulnerability data, and event streaming for security operations centers managing thousands of endpoints. OAuth 2.0 authentication with regional cloud support (US-1, US-2, EU-1) ensures secure, multi-tenant access.

Use Cases

Patterns agents use CrowdStrike Falcon API for, with concrete tasks.

★ AI Agent Threat Triage

An AI agent uses the CrowdStrike Falcon API through Jentic to automatically triage endpoint alerts by querying aggregate alert data, retrieving incident details, and correlating behaviors across affected hosts. The agent prioritizes critical alerts, checks host containment status, and can trigger containment actions — all without manually configuring OAuth 2.0 client credentials or discovering the correct regional API endpoint.

Query POST /alerts/aggregates/alerts/v2 to get a count of critical alerts in the last 24 hours, then retrieve the top 5 alert details via POST /alerts/entities/alerts/v3

Automated Incident Investigation

Investigate security incidents programmatically by querying the incidents API for behavior details, affected host information, and timeline sequences. The Falcon API provides full incident context including process trees, network connections, and file modifications associated with each detection, enabling security teams to build automated investigation playbooks that reduce mean-time-to-respond from hours to minutes.

Retrieve an incident via POST /incidents/entities/incidents/GET/v1 using an incident ID, then fetch associated behaviors via POST /incidents/entities/behaviors/GET/v1

Host Containment and Response

Isolate compromised endpoints from the network through the device actions API while maintaining Falcon sensor connectivity for continued investigation. The containment workflow queries host details, applies network containment to stop lateral movement, and initiates real-time response sessions for forensic collection — all achievable through API calls that execute in seconds versus manual console operations.

Look up a host by hostname via GET /devices/queries/devices/v1, verify its online state via GET /devices/entities/online-state/v1, then contain it via POST /devices/entities/devices-actions/v2 with action_name 'contain'

Real-Time Event Streaming for SIEM

Stream detection events, authentication events, and platform audit logs from the Falcon platform into SIEM systems for centralized security monitoring. The Event Streams API provides a continuous feed of security-relevant events that can trigger automated response playbooks, populate threat dashboards, and satisfy compliance requirements for log retention and real-time monitoring across all managed endpoints.

Discover available event streams via GET /sensors/entities/datafeed/v2 and consume detection events from the returned stream URL

Key Endpoints

74 endpoints — jentic publishes the only available openapi specification for crowdstrike falcon api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/alerts/entities/alerts/v3

Retrieve detailed alert entities by composite IDs

POST

/alerts/aggregates/alerts/v2

Aggregate alert statistics with filtering

POST

/incidents/entities/incidents/GET/v1

Retrieve incident details by IDs

POST

/devices/entities/devices-actions/v2

Perform actions on devices (contain, lift containment)

GET

/devices/queries/devices/v1

Search for device IDs by filter criteria

GET

/devices/entities/online-state/v1

Check device online/offline state

POST

/incidents/entities/behaviors/GET/v1

Retrieve behavior details for incidents

GET

/intel/combined/indicators/v1

Query threat intelligence indicators

POST

/alerts/entities/alerts/v3

Retrieve detailed alert entities by composite IDs

POST

/alerts/aggregates/alerts/v2

Aggregate alert statistics with filtering

POST

/incidents/entities/incidents/GET/v1

Retrieve incident details by IDs

POST

/devices/entities/devices-actions/v2

Perform actions on devices (contain, lift containment)

GET

/devices/queries/devices/v1

Search for device IDs by filter criteria

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

CrowdStrike OAuth 2.0 client credentials are stored encrypted in the Jentic vault (MAXsystem). Agents receive scoped bearer tokens — raw client_id and client_secret values never enter the agent's context window.

Intent-based discovery

Agents search by intent (e.g., 'contain a compromised endpoint') and Jentic returns matching Falcon API operations with their input schemas, so the agent can call the right endpoint without navigating CrowdStrike's documentation or determining the correct regional cloud.

Time to first call

Direct CrowdStrike integration: 3-5 days for OAuth setup, regional endpoint discovery, and pagination handling. Through Jentic: under 1 hour — search, load schema, execute.

FAQs

Specific to using CrowdStrike Falcon API through Jentic.

Why is there no official OpenAPI spec for CrowdStrike Falcon API?

CrowdStrike does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call CrowdStrike Falcon API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the CrowdStrike Falcon API use?

The Falcon API uses OAuth 2.0 client credentials flow. You exchange a client_id and client_secret at POST /oauth2/token for a bearer token. Through Jentic, your OAuth credentials are stored encrypted in the MAXsystem vault and agents receive scoped bearer tokens without raw secrets entering agent context.

Can I contain a compromised endpoint with the Falcon API?

Yes. Use POST /devices/entities/devices-actions/v2 with action_name set to 'contain' and provide the device ID. This isolates the host from the network while maintaining Falcon sensor connectivity. To lift containment later, use the same endpoint with action_name 'lift_containment'.

What are the rate limits for the CrowdStrike Falcon API?

CrowdStrike applies per-endpoint rate limits that vary by operation type. Alert queries and device lookups typically allow several hundred requests per minute. The API returns 429 status codes when limits are exceeded, with Retry-After headers indicating when to resume requests.

How do I query alerts for a specific severity level through Jentic?

Search Jentic for 'check endpoint alerts by severity', which returns the POST /alerts/aggregates/alerts/v2 and POST /alerts/entities/alerts/v3 operations. Use aggregates to count alerts by severity bucket, then retrieve full alert details filtered by severity. Install with pip install jentic and sign up at https://app.jentic.com/sign-up.

Which regional cloud endpoints does the Falcon API support?

The Falcon API supports multiple regional clouds: US-1 (api.crowdstrike.com), US-2 (api.us-2.crowdstrike.com), and EU-1 (api.eu-1.crowdstrike.com). Your OAuth credentials determine which cloud your tenant resides in. All endpoints function identically across regions.

Can I stream detection events in real time from the Falcon API?

Yes. Use the Event Streams endpoints to discover available data feeds via GET /sensors/entities/datafeed/v2, then consume events from the returned streaming URL. Events include detections, authentication activity, and platform audit logs suitable for SIEM ingestion.

CrowdStrike Falcon API

Connect the CrowdStrike Falcon API to your agent

Capabilities

Start building with CrowdStrike Falcon API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs