# CrowdStrike Falcon MCP for AI Agents AI Agent Connect

> CrowdStrike Falcon MCP connects your security tenant to your AI agent. It lets you query detections, manage incidents, and track vulnerabilities across your entire fleet without switching tabs. Use it to triage alerts, hunt for threats, and manage indicators of compromise (IOCs) using natural language.

## Overview
- **Category:** fort-knox
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_Uam95HEcDSo3obA4xKgBdXTFdUwShAgA5MEsKr32/ai-agent-connect
- **Tags:** endpoint-protection, threat-intelligence, edr, xdr, incident-response, cybersecurity

## Description

Managing a security posture at scale usually means jumping between dozens of tabs and squinting at telemetry logs. This Connector changes that by putting the power of your CrowdStrike Falcon tenant directly into your AI agent's hands. Instead of manually filtering for critical detections or hunting for specific host details, you can just ask your agent to find them. You can triage alerts, update incident statuses, and manage your indicators of compromise (IOCs) through a simple conversation. It handles the heavy lifting of navigating the platform's complex queries so you can focus on stopping threats. If you're looking for a way to move faster, Vinkius makes it easy to get this connected and ready to work. You can quickly pull vulnerability data, check sensor versions, and even contain devices when things get hairy. It's about getting to the root cause faster by letting the agent do the data gathering for you.

## Tools

### list_detections
Query detection alerts using FQL filters to see severity and MITRE mappings. This helps you prioritize which threats need immediate attention.

### update_detection
Change the status of an alert and add triage comments to the record. It keeps your team updated on the current state of an investigation.

### search_hosts
Search the device inventory to get full endpoint details and OS info. Use this to quickly identify the hardware and software on a target host.

### list_incidents
Filter and view security incidents by state, severity, or assigned user. This gives you a clear view of your active security posture.

### list_iocs
View your custom indicators of compromise including types, values, and actions. It lets you audit what threats you are currently tracking.

### create_ioc
Add new custom IOCs like SHA256 hashes, domains, or IP addresses to your list. This streamlines your threat intelligence ingestion.

### list_vulnerabilities
Query Spotlight vulnerability data to find CVEs and remediation statuses. Use this to identify the weakest links in your network.

### contain_device
Contain or lift containment on a specific host to stop a threat in its tracks. This is your primary tool for rapid incident response.

## Prompt Examples

**Prompt:** 
```
Find all critical detections from the last 24 hours.
```

**Response:** 
```
### Critical Detections (Last 24h)

| Hostname | Threat Type | MITRE Mapping | Severity |
| :--- | :--- | :--- | :--- |
| **WIN-SERVER-05** | CobaltStrike Beacon | T1059.001 | Critical |
| **DC-PROD-01** | Credential Dumping | T1003.001 | Critical |
| **WS-FIN-12** | Lateral Movement | T1021.002 | Critical |

**Recommendation:** I suggest using `contain_device` on **DC-PROD-01** immediately due to the high risk of credential theft.
```

**Prompt:** 
```
How many endpoints are running outdated sensors?
```

**Response:** 
```
### Fleet Health Summary

*   **Total Endpoints:** 2,847
*   **Up to Date:** 2,691 (94.5%) on v7.18
*   **One Version Behind:** 127 (4.5%) on v7.16
*   **Urgent Update Needed:** 29 (1.0%) on v7.14 or older

**Top Affected Departments:**
1. Finance (12)
2. Remote Workers (9)
3. Lab Servers (8)
```

**Prompt:** 
```
List all IOCs related to ransomware added this month.
```

**Response:** 
```
### Ransomware IOCs (Current Month)

I found **18** new IOCs added recently:
*   **SHA256 Hashes:** 8 (LockBit 3.0 variants)
*   **Domains:** 5 (C2 infrastructure)
*   **IP Addresses:** 3 (Data exfiltration endpoints)
*   **Mutex Names:** 2

**Sources:** CrowdStrike Intelligence (12), Custom (6). All are currently set to 'Detect' action.
```

## Capabilities

### Triage security alerts
Query and update detection statuses to clear your queue faster.

### Search endpoint inventory
Find specific host details and sensor versions across your fleet.

### Manage security incidents
List and investigate active security incidents using custom filters.

### Track indicators of compromise
Create and manage custom IOCs like hashes, domains, and IPs.

### Monitor fleet health
Query real-time device status and active sessions to spot anomalies.

### Review vulnerabilities
Spotlight CVEs and remediation statuses on your managed endpoints.

### Isolate compromised devices
Contain or lift containment on a specific host to stop a threat.

## Use Cases

### Triage a critical alert
A SOC analyst asks the agent to find all critical detections from the last hour and update the status of a Credential Dumping alert.

### Audit sensor health
An IT manager asks the agent to find all endpoints running outdated sensors and list the top 5 affected departments.

### Rapid response to a breach
A security engineer identifies a malicious IP and asks the agent to create a new IOC and contain the affected device immediately.

### Vulnerability assessment
A CISO asks the agent to summarize all critical vulnerabilities on finance department hosts that haven't been patched.

## Benefits

- Faster incident triage: Use list_detections and update_detection to clear your queue without manual page loads.
- Instant fleet visibility: Use search_hosts to get immediate OS and sensor info for any device in your inventory.
- Automated IOC management: Quickly add new threats with create_ioc and list_iocs to stay ahead of attackers.
- Proactive threat hunting: Use list_vulnerabilities to identify the weakest links in your network before they get exploited.
- Rapid containment: Use contain_device to isolate a compromised host the moment your agent flags a high-risk detection.
- Better situational awareness: Use list_incidents to get a clear view of your active security posture in one chat.

## How It Works

The bottom line is you get a conversational interface for your entire security operations center.

1. Connect your CrowdStrike Falcon API credentials to the Vinkius platform.
2. Link the Connector to your preferred AI client like Claude or Cursor.
3. Start asking your agent to query detections or manage incidents.

## Frequently Asked Questions

**Can I use the CrowdStrike Falcon MCP to triage alerts?**
Yes, it lets you query detections and update statuses directly. You can ask your agent to find specific alerts and then tell it to add triage comments or change the status.

**Does the CrowdStrike Falcon MCP support IOC management?**
Yes, it allows you to create and list custom indicators of compromise. You can quickly add new hashes, domains, or IPs to your threat intelligence list.

**Can I use this to see which devices are out of compliance?**
Yes, the Connector can search your host inventory for sensor versions and OS info. This makes it easy to identify which machines need software updates.

**How does the CrowdStrike Falcon MCP help with ransomware?**
It helps by allowing you to quickly list and create IOCs related to specific campaigns. You can also use it to isolate a compromised device immediately.

**Can I isolate a device using the CrowdStrike Falcon MCP?**
Yes, it includes a tool to contain or lift containment on specific hosts. This allows you to stop a threat in its tracks using only natural language commands.

**Does the CrowdStrike Falcon MCP show me my vulnerabilities?**
Yes, it can query your Spotlight vulnerability data to find CVEs and remediation statuses across your managed endpoints.

**What authentication does CrowdStrike use?**
CrowdStrike uses OAuth 2.0 Client Credentials. You create an API Client in the Falcon Console under Support > API Clients and Keys. The server automatically obtains and caches Bearer tokens using your Client ID and Secret.

**Which cloud regions are supported?**
All CrowdStrike commercial clouds: US-1 (api.crowdstrike.com), US-2 (api.us-2.crowdstrike.com), EU-1 (api.eu-1.crowdstrike.com), and US-GOV-1. Configure the Base URL credential to match your tenant region.

**Can it triage detections automatically?**
Yes. The list_detections tool returns severity, tactic, technique, and device context. An AI agent can use this to auto-triage low/medium detections and escalate critical ones, reducing SOC analyst workload by 60-80%.