CrowdStrike ContainHost

CrowdStrike ContainHost
Certified
Enterprise Edition
Network-contain CrowdStrike Falcon hosts

Isolates one or more hosts from the network (Falcon network containment), keeping only communication with the Falcon cloud. Use LiftContainment to release. Concurrent containment actions on the same host are last-write-wins, matching CrowdStrike's own API behavior.

yaml
type: io.kestra.plugin.ee.crowdstrike.hosts.ContainHost

Examples

Contain a compromised host

yaml
id: contain_host
namespace: company.team

tasks:
  - id: contain_host
    type: io.kestra.plugin.ee.crowdstrike.hosts.ContainHost
    clientId: "{{ secret('CROWDSTRIKE_CLIENT_ID') }}"
    clientSecret: "{{ secret('CROWDSTRIKE_CLIENT_SECRET') }}"
    aids:
      - "f4a1c9e2b3d4e5f6a7b8c9d0e1f2a3b4"

Properties

clientId *string

API client ID

Client ID of a CrowdStrike API client with the scopes required by the tasks and triggers being used.

clientSecret *string

API client secret

Client secret of the CrowdStrike API client. Exchanged for a short-lived OAuth2 Bearer token on every task run and trigger poll; never logged.

aids array

SubTypestring

Device IDs (AIDs)

Device IDs of the hosts to contain.

baseUrl string

Defaulthttps://api.crowdstrike.com

CrowdStrike API base URL

Base URL of the CrowdStrike Falcon API for your cloud region (for example: https://api.crowdstrike.com for US-1, https://api.us-2.crowdstrike.com for US-2, https://api.eu-1.crowdstrike.com for EU-1, or https://api.laggar.gcw.crowdstrike.com for US-GOV-1). Defaults to the US-1 endpoint. Using the wrong region for your tenant results in 403 Forbidden responses.

Outputs

affectedCount integer

Number of hosts CrowdStrike confirmed were affected by the containment request

errorCount integer

Number of hosts CrowdStrike reported as failed

Populated when the API returns a 2xx response with partial per-host failures (for example an already-offline host). See the task logs for the specific error messages.