crowdstrike-api

CrowdStrike Falcon Intelligence (Intel) API

This is reference documentation. The agent-invokable lookup skill is /lookup-crowdstrike; the runtime CLI is tools/clis/crowdstrike.py. Read this file when the lookup skill's options are not enough and you need to know which raw endpoint to hit, what fields a response carries, or how to construct an FQL query the CLI does not expose directly.

Source of truth: https://developer.crowdstrike.com/api-reference/collections/intel/

Base URL

OAuth2 base differs by cloud region. The Intel path prefix is /intel/.

Cloud	Base URL
US-1 (default)	https://api.crowdstrike.com
US-2	https://api.us-2.crowdstrike.com
EU-1	https://api.eu-1.crowdstrike.com
US-GovCloud	https://api.laggar.gcw.crowdstrike.com

Override with CROWDSTRIKE_BASE_URL (or --base-url). FalconPy also accepts the short names us-1, us-2, eu-1, usgov1.

Authentication

OAuth2 client-credentials flow:

1. POST /oauth2/token with form-encoded client_id and client_secret.
2. Response: {"access_token": "<jwt>", "expires_in": 1799, "token_type": "bearer"}.
3. All subsequent requests carry Authorization: Bearer <access_token>.

FalconPy performs this exchange and refresh automatically when given client_id= / client_secret=.

# Manual token exchange
TOKEN=$(curl -s -X POST "https://api.crowdstrike.com/oauth2/token" \
  -d "client_id=$CROWDSTRIKE_CLIENT_ID&client_secret=$CROWDSTRIKE_CLIENT_SECRET" | jq -r .access_token)

# Subsequent call
curl -s "https://api.crowdstrike.com/intel/combined/actors/v1?filter=origins.slug%3A%27ru%27&limit=10" \
  -H "Authorization: Bearer $TOKEN"

The API client needs the Intel scopes: Indicators (Falcon Intelligence): Read, Actors (Falcon Intelligence): Read, Reports (Falcon Intelligence): Read, and Rules (Falcon Intelligence): Read for rule-set endpoints. Create it in the Falcon console → Support and resources → API clients and keys. If the env vars are unset, inform the user to run /cti-setup or ./scripts/setup.sh.