• NEW DATA
  • AUDIT
  • HUMAN
  • REPORT

How to manage custom indicators with your AI

Connect CrowdStrike Falcon to your AI client to handle indicator management. You can push new threats to your environment or audit what's already there.

Ask AI about this page

Short answer

How do I manage custom indicators with my AI?

You can use your AI to create new indicators of compromise like IPs and hashes or pull a list of what is currently active in CrowdStrike Falcon. This lets you update your detection rules through a chat interface. You'll get immediate visibility into your threat data.

The outcomes of indicator management.

Where your data goes.

Your AI handles the heavy lifting of data entry and retrieval.

NEW DATA

Instant indicator creation

The AI sends specific hashes or IPs to Falcon. You get confirmation that the new indicator is live.

AUDIT

Review existing lists

Your agent pulls the current set of indicators. You can then ask it to find specific patterns or duplicates.

HUMAN

Manual rule tuning

The AI cannot rewrite complex detection logic or delete indicators. You still control the high-level security policy.

REPORT

Summarized threat lists

The AI organizes the raw data from Falcon into a readable format. You get a clean view of your current threat landscape.

The workflow

What your AI does when you request indicator updates.

The AI acts as the bridge between your chat and the Falcon console.

  1. Fetch current indicators

    Your agent pulls the existing list of indicators from your Falcon environment to give you context.

    list_iocs

  2. Analyze for gaps

    The AI compares your new threat intelligence against the current list to see if anything is already covered.

    list_iocs

  3. Submit new threats

    When you identify a new hash or IP, the AI pushes that data directly into your Falcon instance.

    create_ioc

  4. Confirm deployment

    The AI verifies the action was successful by checking the updated list.

    list_iocs

Try it

Copy these to start.

Use these prompts to trigger actions in CrowdStrike Falcon.

Starting points

Replace the bracketed text with your actual data, like a specific IP address or a file hash.

CrowdStrike Falcon Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_Uam95HEcDSo3obA4xKgBdXTFdUwShAgA5MEsKr32/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — CrowdStrike Falcon capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "crowdstrike-falcon-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_Uam95HEcDSo3obA4xKgBdXTFdUwShAgA5MEsKr32/mcp"
    }
  }
}
Copy into chat04

  • List all the current indicators of compromise in my Falcon environment.

  • Add this IP address 192.168.1.100 as a new indicator of compromise.

  • Check if the hash d41d8cd98f00b204e9800998ecf8427e is already in my list.

  • Show me all the indicators currently active in my CrowdStrike instance.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect CrowdStrike Falcon once, then ask.

Just provide your credentials once. Vinkius keeps your connection secure and encrypted, so you can focus on your security work.

Connect CrowdStrike Falcon to your AI

FAQ

How this task behaves.

  • 01

    Can the AI delete existing indicators?

    No. The current tools only allow for listing and creating indicators. Deletions must be handled manually in the Falcon console.

  • 02

    Can the AI change my detection rules?

    No. The AI can only add specific indicators like IPs and hashes. It cannot modify the underlying logic of your detection rules.

  • 03

    What kind of indicators can I add?

    You can add specific indicators of compromise, such as file hashes and IP addresses.

  • 04

    Does the AI see all my Falcon data?

    The AI only sees the data it needs to perform the specific tasks you request, such as the list of indicators.

  • 05

    Can I use this with any AI client?

    Yes, you can use this with any MCP-compatible client like Claude, Cursor, or VS Code.

  • More questions about CrowdStrike Falcon? The Connector page answers them. See everything the CrowdStrike Falcon Connector can do

Connect CrowdStrike Falcon to Claude, Cursor, ChatGPT & more