How to use the CrowdStrike plugin

This plugin lets you query, fetch, and update CrowdStrike Falcon (EDR/XDR) alerts, hosts, indicators of compromise, Spotlight vulnerabilities, and threat intelligence.

Authentication

Every task and trigger authenticates with a CrowdStrike Falcon OAuth2 API client:

• clientId (required) — client ID of a CrowdStrike API client scoped to the operations being used.
• clientSecret (required, secret) — client secret of that API client.
• baseUrl (optional) — API base URL for your cloud region, defaults to https://api.crowdstrike.com (US-1). Use https://api.us-2.crowdstrike.com (US-2), https://api.eu-1.crowdstrike.com (EU-1), or https://api.laggar.gcw.crowdstrike.com (US-GOV-1) as appropriate — a mismatched region returns 403 Forbidden.

Store clientId and clientSecret as Kestra secrets or set them once via plugin defaults if every task in a namespace shares the same API client. A Bearer token is acquired once per task run (or trigger poll), never cached across executions, and revoked when the run completes.

Tasks

Every task exposes a filter property using the CrowdStrike Falcon Query Language (FQL). Omitting filter matches every record visible to the API client (no error is thrown) — except spotlight.SearchVulnerabilities, whose underlying endpoint requires filter to be set.

Alerts (io.kestra.plugin.ee.crowdstrike.alerts)

• QueryAlerts — searches alert composite IDs with FQL.
• GetAlerts — fetches full alert details for a list of composite IDs.
• UpdateAlert — bulk-updates status, assignment, and/or adds a comment on one or more alerts.

Hosts (io.kestra.plugin.ee.crowdstrike.hosts)

• SearchHosts — searches device IDs (AIDs) with FQL.
• GetHost — fetches the full device record for a single host.
• ContainHost / LiftContainment — network-isolates or releases one or more hosts. Concurrent containment actions on the same host are last-write-wins, matching CrowdStrike's own API behavior.
• UpdateHostTags — adds and/or removes grouping tags on one or more hosts.

IOC (io.kestra.plugin.ee.crowdstrike.ioc)

• CreateIOC / UpdateIOC / DeleteIOC — manage custom indicators of compromise (domains, IPs, file hashes). CreateIOC applies the indicator globally by default (appliedGlobally: true) — this task does not yet support scoping an indicator to specific host groups. expirationDays is a day-count convenience input, converted to the RFC-3339 expiration timestamp the API expects.
• SearchIOCs — searches custom IOCs with FQL.

Spotlight (io.kestra.plugin.ee.crowdstrike.spotlight)

• SearchVulnerabilities — searches vulnerabilities with FQL and pages through every matching result using cursor-based (after) pagination. Unlike most other CrowdStrike search endpoints, filter is required here. Supports fetchType: FETCH_ONE, FETCH, or STORE (recommended for large result sets — streams results to internal storage instead of the execution output).

Intel (io.kestra.plugin.ee.crowdstrike.intel)

• SearchActors / SearchReports / SearchIndicators — search threat intelligence with FQL. Always requests the full record (fields=__full__) since the combined endpoints' default field set is not documented as complete.
• GetReportPDF — downloads a report's PDF rendition to Kestra's internal storage. The response is validated as a real PDF before being persisted, so a report-not-found or other error response is never stored as a corrupt file.

Triggers

alerts.Trigger and spotlight.Trigger poll their matching search task at the configured interval and fire one execution per newly discovered item (oldest first, one per poll cycle), so a burst of new items is delivered over successive polls rather than skipped. Each trigger persists a watermark (the newest delivered item's creation timestamp, plus the IDs already delivered at that exact instant) in the flow's namespace KV Store to avoid re-firing. On the first poll, only the baseline is recorded — no execution is fired — to avoid flooding on initial activation.