CrowdStrike LiftContainment
CertifiedEnterprise EditionLift network containment on CrowdStrike Falcon hosts
CrowdStrike LiftContainment
Lift network containment on CrowdStrike Falcon hosts
Releases one or more hosts from Falcon network containment, restoring normal network access. Concurrent containment actions on the same host are last-write-wins, matching CrowdStrike's own API behavior.
type: io.kestra.plugin.ee.crowdstrike.hosts.LiftContainmentExamples
Release a host from containment after remediation
id: lift_containment
namespace: company.team
tasks:
- id: lift_containment
type: io.kestra.plugin.ee.crowdstrike.hosts.LiftContainment
clientId: "{{ secret('CROWDSTRIKE_CLIENT_ID') }}"
clientSecret: "{{ secret('CROWDSTRIKE_CLIENT_SECRET') }}"
aids:
- "f4a1c9e2b3d4e5f6a7b8c9d0e1f2a3b4"
Properties
clientId *Requiredstring
API client ID
Client ID of a CrowdStrike API client with the scopes required by the tasks and triggers being used.
clientSecret *Requiredstring
API client secret
Client secret of the CrowdStrike API client. Exchanged for a short-lived OAuth2 Bearer token on every task run and trigger poll; never logged.
aids array
Device IDs (AIDs)
Device IDs of the hosts to release from containment.
baseUrl string
https://api.crowdstrike.comCrowdStrike API base URL
Base URL of the CrowdStrike Falcon API for your cloud region (for example: https://api.crowdstrike.com for US-1, https://api.us-2.crowdstrike.com for US-2, https://api.eu-1.crowdstrike.com for EU-1, or https://api.laggar.gcw.crowdstrike.com for US-GOV-1). Defaults to the US-1 endpoint. Using the wrong region for your tenant results in 403 Forbidden responses.
Outputs
affectedCount integer
Number of hosts CrowdStrike confirmed were affected by the containment-lift request
errorCount integer
Number of hosts CrowdStrike reported as failed
Populated when the API returns a 2xx response with partial per-host failures. See the task logs for the specific error messages.
