• THREAT DETECTION
  • HOST ISOLATION
  • HUMAN REVIEW
  • AUDIT TRAIL

How to isolate compromised hosts with your AI

Connect CrowdStrike Falcon to your agent to turn chat commands into immediate containment actions.

Ask AI about this page

Short answer

How can I isolate a host using my AI?

You can pull a list of active detections and trigger device containment through your chat interface. This lets you move from seeing a threat to isolating a machine without leaving your AI client. Here is how the process works.

The outcomes

Containment results

What happens after you run a command.

THREAT DETECTION

Identify active threats

Your agent pulls current security events from Falcon. You get a clear view of what is happening on your network.

HOST ISOLATION

Contain infected devices

The AI executes a command to cut off a specific host. This stops lateral movement immediately.

HUMAN REVIEW

Verify the action

You decide which hosts are safe to isolate. The AI waits for your confirmation before taking destructive steps.

AUDIT TRAIL

Log the response

Every command sent through the agent is recorded. You maintain a clear history of what was contained and when.

The workflow

What your AI does when a threat is detected.

The AI handles the heavy lifting of data retrieval and command execution.

  1. Scan for threats

    Your agent looks through your Falcon environment to find recent security alerts.

    list_detections

  2. Analyze the target

    The agent reviews the specific host details associated with the detection to ensure you have the right ID.

    list_detections

  3. Execute containment

    Once you confirm, the agent tells Falcon to isolate the machine from the network.

    contain_device

  4. Confirm isolation

    The agent checks that the command was sent successfully to the target host.

    contain_device

Try it

Copy these to start.

Use these prompts to begin your investigation.

Starting points

Replace the bracketed text with your specific host names or detection IDs.

CrowdStrike Falcon Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_Uam95HEcDSo3obA4xKgBdXTFdUwShAgA5MEsKr32/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — CrowdStrike Falcon capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "crowdstrike-falcon-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_Uam95HEcDSo3obA4xKgBdXTFdUwShAgA5MEsKr32/mcp"
    }
  }
}
Copy into chat04

  • List all recent detections in CrowdStrike Falcon.

  • Find the host ID for the detection involving the workstation named 'Finance-PC-01'.

  • Isolate the device with ID 'host-12345' immediately.

  • Show me the details for the most recent detection on the 'Web-Server-Prod' host.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect CrowdStrike Falcon once, then ask.

Just enter your credentials once. Your connection stays encrypted and ready for your next command.

Connect CrowdStrike Falcon to your AI

FAQ

How this task behaves

  • 01

    Can the AI automatically isolate hosts without me asking?

    No. The AI only performs actions when you explicitly give it a command in your chat client.

  • 02

    Can the AI delete security logs?

    No. The available tools only allow for listing detections and containing devices.

  • 03

    Does the AI need my Falcon password every time?

    No. You connect the MCP once, and your credentials are managed securely by Vinkius.

  • 04

    Can I use this to uninstall software?

    No. This specific connection is limited to detection retrieval and device containment.

  • 05

    Will the AI isolate my entire network if I make a mistake?

    No. You must specify the target device or detection for the containment command to work.

  • More questions about CrowdStrike Falcon? The Connector page answers them. See everything the CrowdStrike Falcon Connector can do

Connect CrowdStrike Falcon to Claude, Cursor, ChatGPT & more