canonical: https://jentic.com/apis/crowdstrike.com/crowdstrike # CrowdStrike Falcon API Jentic publishes the only available OpenAPI specification for CrowdStrike Falcon API, keeping it validated and agent-ready. Detect, investigate, and respond to endpoint threats across 74 API endpoints covering host management, alert triage, incident response, IOC management, and real-time response sessions. The Falcon platform provides access to threat intelligence feeds, prevention policy configuration, spotlight vulnerability data, and event streaming for security operations centers managing thousands of endpoints. OAuth 2.0 authentication with regional cloud support (US-1, US-2, EU-1) ensures secure, multi-tenant access. ## For AI agents Query endpoint alerts, investigate incidents, manage host containment, and retrieve threat intelligence from CrowdStrike Falcon's endpoint detection and response platform across multiple regional clouds. ## Scope Does not handle network traffic inspection, email security, or cloud workload protection - use for endpoint detection, response, and host management only. ## Capabilities - Query and triage endpoint security alerts with severity filtering and aggregate analytics - Investigate incidents by retrieving associated behaviors, host details, and timeline data - Contain compromised hosts or lift containment through device action commands - Search and scroll through managed endpoints with filtering by hostname, OS, and online state - Push custom indicators of compromise (IOCs) for detection and blocking across the fleet - Initiate real-time response sessions to collect forensic artifacts from live endpoints - Stream security events in real-time for SIEM ingestion and automated response workflows ## Use cases ### AI Agent Threat Triage An AI agent uses the CrowdStrike Falcon API through Jentic to automatically triage endpoint alerts by querying aggregate alert data, retrieving incident details, and correlating behaviors across affected hosts. The agent prioritizes critical alerts, checks host containment status, and can trigger containment actions - all without manually configuring OAuth 2.0 client credentials or discovering the correct regional API endpoint. Example prompt: Query POST /alerts/aggregates/alerts/v2 to get a count of critical alerts in the last 24 hours, then retrieve the top 5 alert details via POST /alerts/entities/alerts/v3 ### Automated Incident Investigation Investigate security incidents programmatically by querying the incidents API for behavior details, affected host information, and timeline sequences. The Falcon API provides full incident context including process trees, network connections, and file modifications associated with each detection, enabling security teams to build automated investigation playbooks that reduce mean-time-to-respond from hours to minutes. Example prompt: Retrieve an incident via POST /incidents/entities/incidents/GET/v1 using an incident ID, then fetch associated behaviors via POST /incidents/entities/behaviors/GET/v1 ### Host Containment and Response Isolate compromised endpoints from the network through the device actions API while maintaining Falcon sensor connectivity for continued investigation. The containment workflow queries host details, applies network containment to stop lateral movement, and initiates real-time response sessions for forensic collection - all achievable through API calls that execute in seconds versus manual console operations. Example prompt: Look up a host by hostname via GET /devices/queries/devices/v1, verify its online state via GET /devices/entities/online-state/v1, then contain it via POST /devices/entities/devices-actions/v2 with action_name 'contain' ### Real-Time Event Streaming for SIEM Stream detection events, authentication events, and platform audit logs from the Falcon platform into SIEM systems for centralized security monitoring. The Event Streams API provides a continuous feed of security-relevant events that can trigger automated response playbooks, populate threat dashboards, and satisfy compliance requirements for log retention and real-time monitoring across all managed endpoints. Example prompt: Discover available event streams via GET /sensors/entities/datafeed/v2 and consume detection events from the returned stream URL ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | /alerts/entities/alerts/v3 | Retrieve detailed alert entities by composite IDs | | POST | /alerts/aggregates/alerts/v2 | Aggregate alert statistics with filtering | | POST | /incidents/entities/incidents/GET/v1 | Retrieve incident details by IDs | | POST | /devices/entities/devices-actions/v2 | Perform actions on devices (contain, lift containment) | | GET | /devices/queries/devices/v1 | Search for device IDs by filter criteria | | GET | /devices/entities/online-state/v1 | Check device online/offline state | | POST | /incidents/entities/behaviors/GET/v1 | Retrieve behavior details for incidents | | GET | /intel/combined/indicators/v1 | Query threat intelligence indicators | ## Key resources - **Alerts** — Query, aggregate, and update endpoint security alerts with severity and tactic metadata - **Incidents** — Retrieve and manage security incidents with associated host behaviors and timelines - **Devices** — Search, query, and perform actions on managed endpoints including containment - **IOC** — Create and manage custom indicators of compromise for detection and prevention - **Event Streams** — Subscribe to real-time detection and audit event feeds - **Intel** — Access CrowdStrike threat intelligence indicators and actor profiles ## Why Jentic - **Setup:** Wiring CrowdStrike Falcon by hand means running its OAuth 2.0 client-credentials exchange, choosing the correct regional cloud (US-1, US-2, EU-1, or US-GOV-1), and refreshing bearer tokens yourself. Through Jentic you install once, import CrowdStrike Falcon from the API Directory, store the client id and secret once, and your agent calls it. - **Permission scoping:** Falcon passes alert, incident, and device identifiers in request bodies rather than the URL path, so limit the agent to the operations it needs, such as querying devices or reading incident behaviors. You choose the operations it may call, so a device containment action is not included unless you add it. - **Credential handling:** Your CrowdStrike client id and secret are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'contain a compromised endpoint' or 'list open incidents', and Jentic returns the matching Falcon operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **Cortex XSOAR API** — SOAR platform for orchestrating response playbooks that can ingest CrowdStrike detections - **Splunk API** — SIEM platform for correlating CrowdStrike events with other security data sources - **Snyk API** — Vulnerability scanning for code dependencies, complementing CrowdStrike's runtime endpoint protection ## FAQ ### Why is there no official OpenAPI spec for CrowdStrike Falcon API? CrowdStrike does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call CrowdStrike Falcon API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the CrowdStrike Falcon API use? The Falcon API uses OAuth 2.0 client credentials flow. You exchange a client_id and client_secret at POST /oauth2/token for a bearer token. Through Jentic, your OAuth credentials are stored encrypted in your Jentic One instance and agents receive scoped bearer tokens without raw secrets entering agent context. ### Can I contain a compromised endpoint with the Falcon API? Yes. Use POST /devices/entities/devices-actions/v2 with action_name set to 'contain' and provide the device ID. This isolates the host from the network while maintaining Falcon sensor connectivity. To lift containment later, use the same endpoint with action_name 'lift_containment'. ### What are the rate limits for the CrowdStrike Falcon API? CrowdStrike applies per-endpoint rate limits that vary by operation type. Alert queries and device lookups typically allow several hundred requests per minute. The API returns 429 status codes when limits are exceeded, with Retry-After headers indicating when to resume requests. ### How do I query alerts for a specific severity level through Jentic? Search Jentic for 'check endpoint alerts by severity', which returns the POST /alerts/aggregates/alerts/v2 and POST /alerts/entities/alerts/v3 operations. Use aggregates to count alerts by severity bucket, then retrieve full alert details filtered by severity. Install with pip install jentic and run it through Jentic One, the self-hosted execution layer. ### Which regional cloud endpoints does the Falcon API support? The Falcon API supports multiple regional clouds: US-1 (api.crowdstrike.com), US-2 (api.us-2.crowdstrike.com), and EU-1 (api.eu-1.crowdstrike.com). Your OAuth credentials determine which cloud your tenant resides in. All endpoints function identically across regions. ### Can I stream detection events in real time from the Falcon API? Yes. Use the Event Streams endpoints to discover available data feeds via GET /sensors/entities/datafeed/v2, then consume events from the returned streaming URL. Events include detections, authentication activity, and platform audit logs suitable for SIEM ingestion. ### Can I limit what my agent is allowed to do with the CrowdStrike Falcon API? Yes. Jentic One is self-hosted by you, so your own rules decide which Falcon operations and credentials the agent may use. Because Falcon passes alert, incident, and device identifiers in request bodies rather than the URL path, you scope the agent to only the operations it needs, such as querying devices via GET /devices/queries/devices/v1 or reading incident behaviors via POST /incidents/entities/behaviors/GET/v1. A device containment action like POST /devices/entities/devices-actions/v2 is not available to the agent unless you explicitly add it.