CrowdStrike

Manage hosts, detections, incidents, and threat intelligence via CrowdStrike Falcon.

Detail	Value
Category	Security
Base URL	https://api.crowdstrike.com
Authentication	OAuth2 Client Credentials
Endpoints	5
Connector key	crowdstrike

Using CrowdStrike in a workflow

1. Go to Connections and click New Connection.
2. Pick CrowdStrike from the marketplace.
3. Enter your credentials (see Authentication above for what's expected).
4. In a workflow, drop an API Call node and select this connection.
5. Pick the operation you need from the Operation dropdown — the full list is below.

Available endpoints

Endpoint	Summary
GET /devices/queries/devices/v1	Search for hosts
GET /detects/queries/detects/v1	Search detections
GET /incidents/queries/incidents/v1	Search incidents
GET /intel/queries/actors/v1	Search threat actors
GET /policy/queries/prevention/v1	Search prevention policies

Each endpoint is documented in full below. Use the outline on the right to jump to one.

GET /devices/queries/devices/v1

Search for hosts

Detail	Value
Operation ID	security.queryDevices
Method	GET
Path	/devices/queries/devices/v1

Parameters

Name	Location	Type	Required
filter	query	string	No

Using this endpoint in a workflow

1. Add an API Call node to your workflow.
2. Pick your CrowdStrike connection from the Connection dropdown.
3. In the Operation dropdown, select security.queryDevices.
4. Fill in the parameter fields that appear. Use {{...}} to reference upstream values.

What it returns

The API Call node writes the response to the workflow context:

{
  status: 200,
  success: true,
  data: { ...response body from the API... },
  latencyMs: 142
}

Reference response fields downstream as {{nodeId.data.path}}. The exact response shape is documented on the upstream CrowdStrike API reference.

GET /detects/queries/detects/v1

Search detections

Detail	Value
Operation ID	security.queryDetections
Method	GET
Path	/detects/queries/detects/v1

Parameters

No parameters.

Using this endpoint in a workflow

1. Add an API Call node to your workflow.
2. Pick your CrowdStrike connection from the Connection dropdown.
3. In the Operation dropdown, select security.queryDetections.
4. Fill in the parameter fields that appear. Use {{...}} to reference upstream values.

What it returns

The API Call node writes the response to the workflow context:

{
  status: 200,
  success: true,
  data: { ...response body from the API... },
  latencyMs: 142
}

Reference response fields downstream as {{nodeId.data.path}}. The exact response shape is documented on the upstream CrowdStrike API reference.

GET /incidents/queries/incidents/v1

Search incidents

Detail	Value
Operation ID	security.queryIncidents
Method	GET
Path	/incidents/queries/incidents/v1

Parameters

No parameters.

Using this endpoint in a workflow

1. Add an API Call node to your workflow.
2. Pick your CrowdStrike connection from the Connection dropdown.
3. In the Operation dropdown, select security.queryIncidents.
4. Fill in the parameter fields that appear. Use {{...}} to reference upstream values.

What it returns

The API Call node writes the response to the workflow context:

{
  status: 200,
  success: true,
  data: { ...response body from the API... },
  latencyMs: 142
}

Reference response fields downstream as {{nodeId.data.path}}. The exact response shape is documented on the upstream CrowdStrike API reference.

GET /intel/queries/actors/v1

Search threat actors

Detail	Value
Operation ID	security.queryActors
Method	GET
Path	/intel/queries/actors/v1

Parameters

No parameters.

Using this endpoint in a workflow

1. Add an API Call node to your workflow.
2. Pick your CrowdStrike connection from the Connection dropdown.
3. In the Operation dropdown, select security.queryActors.
4. Fill in the parameter fields that appear. Use {{...}} to reference upstream values.

What it returns

The API Call node writes the response to the workflow context:

{
  status: 200,
  success: true,
  data: { ...response body from the API... },
  latencyMs: 142
}

Reference response fields downstream as {{nodeId.data.path}}. The exact response shape is documented on the upstream CrowdStrike API reference.

GET /policy/queries/prevention/v1

Search prevention policies

Detail	Value
Operation ID	security.queryPolicies
Method	GET
Path	/policy/queries/prevention/v1

Parameters

No parameters.

Using this endpoint in a workflow

1. Add an API Call node to your workflow.
2. Pick your CrowdStrike connection from the Connection dropdown.
3. In the Operation dropdown, select security.queryPolicies.
4. Fill in the parameter fields that appear. Use {{...}} to reference upstream values.

What it returns

The API Call node writes the response to the workflow context:

{
  status: 200,
  success: true,
  data: { ...response body from the API... },
  latencyMs: 142
}

Reference response fields downstream as {{nodeId.data.path}}. The exact response shape is documented on the upstream CrowdStrike API reference.