CrowdStrike API

The common use is maintenance: before or after work on a server, the agent confirms the server shows in Falcon, is online and checked in recently, and runs the newest sensor the MSP’s policy allows. The same reads let a scheduled agent compare a customer’s Falcon hosts with the RMM’s devices and list what is missing on each side.

Automatically enabled when you configure CrowdStrike permissions in your agent workflow.

What It Does

Work in the ticket company’s own Flight Control child CID, from the company mapping, or in your one CID
Find a host by name, IP, serial or MAC, with its last check-in, online state, sensor version and policies
Read the sensor builds and the host’s sensor update policy, and move a host onto a current one
Read, update and close alerts and incidents; release or delete quarantined files
Contain or release a host, and run Real Time Response commands
Read and change policies, host groups, exclusions, IOCs and custom IOA rules
Read Spotlight vulnerabilities, intelligence, Identity Protection, cloud security and the rest of the Falcon API

Permission Groups

Group	Covers
Hosts and Host Groups	Hosts, host groups, asset inventory, containment
Sensor Versions, Installers and Update Policies	Sensor builds and installers, sensor update policies, installation tokens
Alerts, Incidents and Detections	Alerts, incidents, quarantine, on-demand scans, cases, Falcon Complete
Real Time Response	RTR sessions and commands
Prevention, Device Control, Firewall and Other Policies	Every policy family except sensor update, and its host group assignments
Exclusions, IOCs and Custom IOA Rules	Exclusions, IOCs, custom IOA rules, containment allowlists, detection suppression
Spotlight Vulnerabilities and Exposure Management	Vulnerabilities and remediations, configuration assessment, external exposure, network scans
Event Search, Threat Hunting and NG-SIEM	Event search, NG-SIEM, ThreatGraph, hunting guides, correlation rules, audit logs
Threat Intelligence and Sandbox	Intelligence, the Falcon sandbox, MalQuery, Recon
Identity Protection	Identity sensors, policy rules, the GraphQL API
Cloud, Container, SaaS and Browser Security	Cloud security posture, containers, Kubernetes, application security, SaaS security, the enterprise browser
Fusion SOAR Workflows, IT Automation and Foundry	Workflows, IT Automation tasks, Foundry functions and collections
Users, Roles, API Clients and Flight Control	Console users and roles, API clients without their secrets, child CIDs and CID groups

Access Profiles

Profile	What runs on its own	What asks a technician
Read Only	Every read	No write is allowed
Helpdesk	Every read, and every change in the Alerts, Incidents and Detections group: alerts and incidents, quarantined file release or delete, on-demand scans and cases	Host and sensor update changes; no other write is allowed
IT Admin	Every read and write outside the three groups on the right and Safety Controls	Changes in the Exclusions, IOCs and Custom IOA Rules, the Prevention, Device Control, Firewall and Other Policies, and the Users, Roles, API Clients and Flight Control groups, and the changes in Safety Controls
Full Automation	Every read and write outside Safety Controls	The changes in Safety Controls

Safety Controls

Control	Behavior
One CID per call	With Flight Control, Neo gets a token for the child CID a call names, so the call acts in that child CID only
The ticket’s customer only	On a Flight Control connection, on a run for a ticket, Neo sends a call only into the child CID the ticket’s company is mapped to: none for an unmapped company, and no Flight Control call
Always asks a technician	Deleting or hiding a host in the console; a sensor update policy change that turns uninstall protection off; resetting a console user’s password or 2FA; a host action Neo cannot read; and an Identity Protection GraphQL change
Refused	Calls that return or reset a secret (a new API client’s secret, a host’s uninstall token, an event stream session, registry credentials, ingest tokens), certificates for cloud onboarding, and file downloads and download links (installers, cloud security tools, samples, files from hosts, case attachments, scripts, exports, PDF and CSV reports), and file uploads; RTR runs a script inline instead of an uploaded one
Files	An answer that is a file rather than data (a CSV or PDF report, an archive, raw bytes) is refused whatever the call; the technician downloads it in the Falcon console
Secrets	Fields that carry a credential, such as a cloud account’s private key, a client secret or an installation token’s value, are removed from every answer; a technician reads a token in the Falcon console
Detection suppression	Suppressing a host’s detections follows the Exclusions, IOCs and Custom IOA Rules group, as an exclusion does

Getting started

Core

Triggered & Scheduled Agents

Chat Agents

Integrations

Product

Workflows

Customizing Neo

What It Does

Permission Groups

Access Profiles

Safety Controls

​What It Does

​Permission Groups

​Access Profiles

​Safety Controls

What It Does

Permission Groups

Access Profiles

Safety Controls