> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# CrowdStrike API

> Work CrowdStrike Falcon from the ticket: check a computer and its sensor, audit Falcon against the RMM, work alerts, contain hosts

The common use is maintenance: before or after work on a server, the agent confirms the server shows in Falcon, is online and checked in recently, and runs the newest sensor the MSP's policy allows. The same reads let a scheduled agent compare a customer's Falcon hosts with the RMM's devices and list what is missing on each side.

> [!NOTE]
>
> Automatically enabled when you configure CrowdStrike permissions in your agent workflow.

## What It Does

* Work in the ticket company's own Flight Control child CID, from the company mapping, or in your one CID
* Find a host by name, IP, serial or MAC, with its last check-in, online state, sensor version and policies
* Read the sensor builds and the host's sensor update policy, and move a host onto a current one
* Read, update and close alerts and incidents; release or delete quarantined files
* Contain or release a host, and run Real Time Response commands
* Read and change policies, host groups, exclusions, IOCs and custom IOA rules
* Read Spotlight vulnerabilities, intelligence, Identity Protection, cloud security and the rest of the Falcon API

## Permission Groups

| Group | Covers |
| - | - |
| Hosts and Host Groups | Hosts, host groups, asset inventory, containment |
| Sensor Versions, Installers and Update Policies | Sensor builds and installers, sensor update policies, installation tokens |
| Alerts, Incidents and Detections | Alerts, incidents, quarantine, on-demand scans, cases, Falcon Complete |
| Real Time Response | RTR sessions and commands |
| Prevention, Device Control, Firewall and Other Policies | Every policy family except sensor update, and its host group assignments |
| Exclusions, IOCs and Custom IOA Rules | Exclusions, IOCs, custom IOA rules, containment allowlists, detection suppression |
| Spotlight Vulnerabilities and Exposure Management | Vulnerabilities and remediations, configuration assessment, external exposure, network scans |
| Event Search, Threat Hunting and NG-SIEM | Event search, NG-SIEM, ThreatGraph, hunting guides, correlation rules, audit logs |
| Threat Intelligence and Sandbox | Intelligence, the Falcon sandbox, MalQuery, Recon |
| Identity Protection | Identity sensors, policy rules, the GraphQL API |
| Cloud, Container, SaaS and Browser Security | Cloud security posture, containers, Kubernetes, application security, SaaS security, the enterprise browser |
| Fusion SOAR Workflows, IT Automation and Foundry | Workflows, IT Automation tasks, Foundry functions and collections |
| Users, Roles, API Clients and Flight Control | Console users and roles, API clients without their secrets, child CIDs and CID groups |

## Access Profiles

| Profile | What runs on its own | What asks a technician |
| - | - | - |
| **Read Only** | Every read | No write is allowed |
| **Helpdesk** | Every read, and every change in the Alerts, Incidents and Detections group: alerts and incidents, quarantined file release or delete, on-demand scans and cases | Host and sensor update changes; no other write is allowed |
| **IT Admin** | Every read and write outside the three groups on the right and Safety Controls | Changes in the Exclusions, IOCs and Custom IOA Rules, the Prevention, Device Control, Firewall and Other Policies, and the Users, Roles, API Clients and Flight Control groups, and the changes in Safety Controls |
| **Full Automation** | Every read and write outside Safety Controls | The changes in Safety Controls |

## Safety Controls

| Control | Behavior |
| - | - |
| **One CID per call** | With Flight Control, Neo gets a token for the child CID a call names, so the call acts in that child CID only |
| **The ticket's customer only** | On a Flight Control connection, on a run for a ticket, Neo sends a call only into the child CID the ticket's company is mapped to: none for an unmapped company, and no Flight Control call |
| **Always asks a technician** | Deleting or hiding a host in the console; a sensor update policy change that turns uninstall protection off; resetting a console user's password or 2FA; a host action Neo cannot read; and an Identity Protection GraphQL change |
| **Refused** | Calls that return or reset a secret (a new API client's secret, a host's uninstall token, an event stream session, registry credentials, ingest tokens), certificates for cloud onboarding, and file downloads and download links (installers, cloud security tools, samples, files from hosts, case attachments, scripts, exports, PDF and CSV reports), and file uploads; RTR runs a script inline instead of an uploaded one |
| **Files** | An answer that is a file rather than data (a CSV or PDF report, an archive, raw bytes) is refused whatever the call; the technician downloads it in the Falcon console |
| **Secrets** | Fields that carry a credential, such as a cloud account's private key, a client secret or an installation token's value, are removed from every answer; a technician reads a token in the Falcon console |
| **Detection suppression** | Suppressing a host's detections follows the Exclusions, IOCs and Custom IOA Rules group, as an exclusion does |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.