What is the current status of falcon-mcp?
It is in **public preview** under active development. Features may change before the stable 1.0 release, so production deployments are not recommended.
Crowdstrike Falcon MCP Server
@CrowdStrike
基本情報
Crowdstrike Falcon MCP Server について
Connects AI agents with the CrowdStrike Falcon platform for intelligent security analysis, providing programmatic access to detections, incidents, behaviors, threat intelligence, hosts, vulnerabilities, and identity protection capabilities.
Crowdstrike Falcon MCP Server の設定
以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。
{
"mcpServers": {
"falcon-mcp": {
"command": "uvx",
"args": [
"falcon-mcp"
],
"env": {
"FALCON_CLIENT_ID": "your-client-id",
"FALCON_CLIENT_SECRET": "your-client-secret",
"FALCON_BASE_URL": "https://api.crowdstrike.com"
}
}
}
}Crowdstrike Falcon MCP Server のツール
ツール一覧はまだありません
この掲載には表示できるツール一覧がまだありません。サーバーにツールがないという意味ではありません。対応機能はプロジェクトのドキュメントをご確認ください。
上のボタンで一時的なサンドボックスでこのサーバーを実行し、ツール一覧を取得できます。
概要
What is Crowdstrike Falcon?
Crowdstrike Falcon is a Model Context Protocol (MCP) server that connects AI agents with the CrowdStrike Falcon platform for security analysis. It provides programmatic access to detections, incidents, behaviors, threat intelligence, and other security capabilities.
How to use Crowdstrike Falcon?
Install the server with pip install falcon-mcp (requires Python 3.11+). Configure CrowdStrike API credentials via environment variables (FALCON_CLIENT_ID, FALCON_CLIENT_SECRET), then run falcon-mcp on the command line or integrate with an MCP client like Claude Desktop. Modules can be enabled or disabled using command-line flags.
Key features of Crowdstrike Falcon
- Detection search and analysis
- Incident investigation and CrowdScore monitoring
- Threat actor and IOC intelligence research
- Host/device inventory and management
- Vulnerability search and management
- Identity protection entity investigation
Use cases of Crowdstrike Falcon
- Threat hunting: Search detections to uncover malicious activity.
- Incident response: Analyze incidents, behaviors, and CrowdScore.
- Threat intelligence: Research adversaries, indicators, and reports.
- Asset management: Query host inventory and device details.
- Vulnerability management: Search and assess vulnerabilities.
よくある質問
What API scopes are required?
Scopes depend on the modules you enable. For example, Detections needs `Alerts:read`, Incidents needs `Incidents:read`, and Intel needs multiple Falcon Intelligence scopes. See the README for the full list.
Can I trust AI-generated FQL queries?
FQL has nuanced syntax. AI-generated filters should be tested and validated before production use. Start with simple queries and gradually build complexity.
How do I install and configure falcon-mcp?
Install via `pip install falcon-mcp` with Python 3.11+. Copy `.env.example` to `.env` and set `FALCON_CLIENT_ID` and `FALCON_CLIENT_SECRET` from your CrowdStrike API credentials.
「その他」の他のコンテンツ
🚀 Model Context Protocol (MCP) Curriculum for Beginners
microsoftThis open-source curriculum introduces the fundamentals of Model Context Protocol (MCP) through real-world, cross-language examples in .NET, Java, TypeScript, JavaScript, Rust and Python. Designed for developers, it focuses on practical techniques for building modular, scalable,
16.7K
ICSS
chokcoco不止于 CSS
20.7K
Codelf
unbugA search tool helps dev to solve the naming things problem.
14.2K
Soar Flight Booking MCP
Soar Flight Booking MCP is a remote MCP server available at https://mcp.soar.flights.
Klarix Intelligence Engine
KlarixB2B competitive intelligence, live sales battlecards, 5-axis ICP prospect fit scoring, and tech stack teardowns over MCP and REST with cited public-web evidence.
コメント