Security
CrowdStrike Falcon
EDR — query detections, list hosts, and contain compromised endpoints.
Command it in chat
Ask the Orbit Assistant about your CrowdStrike Falcon data in plain English — it plans the API calls and answers clearly, not with raw JSON.
Automate it with skills
Put CrowdStrike Falcon inside autonomous skills and playbooks that run on schedules, webhooks, or events — and chain it with your other tools.
Governed by default
Set action policies and member access, require approvals where needed, and review recorded activity. Supported autonomy modes depend on your plan.
15 built-in actions
Explore fictional results in workspace Simulated mode before connecting credentials. Real actions follow workspace approval policies; validate the actions you need with your own account.
List Detections
list_detections
Get Detection
get_detection
Update Detection
update_detection
List Hosts
list_hosts
Get Host Details
get_host_details
Contain Host
contain_host
Lift Containment
lift_containment
Hide Host
hide_host
List Incidents
list_incidents
List IOCs
list_iocs
Create IOC
create_ioc
Delete IOC
delete_ioc
List Vulnerabilities
list_vulnerabilities
Run Real-Time Response Command
run_rtr_command
Search Hosts
search_hosts
Explore before you connect
Explore CrowdStrike Falcon in a workspace with fictional sample data before adding credentials. Workspace simulations may use AI Power; signup may require a beta invite.
Explore in a workspace