falcon

CrowdStrike Falcon Agent Configuration

Overview

The Falcon agent enables Warren to query CrowdStrike Falcon for security incidents, alerts, behaviors, CrowdScores, and EDR telemetry events. This is a read-only agent — it does not modify any data in your Falcon environment.

Prerequisites

Create API Client Credentials

1. Log in to the CrowdStrike Falcon Console
2. Navigate to Support and resources > Resources and tools > API clients and keys
3. Click Create API client
4. Configure the following:
   • Client Name: A descriptive name (e.g., warren-readonly)
   • API Scopes: Select the scopes listed below
5. Click Create
6. Copy and securely store the Client ID and Client Secret (the secret cannot be retrieved later)

Required API Scopes

Note: The NGSIEM scope requires both Read and Write permissions because the Search API uses Write to create query jobs and Read to retrieve results. Despite requiring Write permission, this agent only performs read operations (search queries) — it does not modify any data.

Cloud Regions

CrowdStrike operates in multiple cloud regions. Set the base URL matching your Falcon tenant region:

You can find your region by checking the domain in your Falcon console URL (e.g., falcon.us-2.crowdstrike.com means US-2).

Deployment

Environment Variables

export WARREN_AGENT_FALCON_CLIENT_ID="your-client-id"
export WARREN_AGENT_FALCON_CLIENT_SECRET="your-client-secret"
export WARREN_AGENT_FALCON_BASE_URL="https://api.crowdstrike.com"  # Optional, defaults to US-1

CLI Flags

warren serve \
  --agent-falcon-client-id=your-client-id \
  --agent-falcon-client-secret=your-client-secret \
  --agent-falcon-base-url=https://api.crowdstrike.com

Cloud Run

gcloud run services update warren \
  --set-env-vars="WARREN_AGENT_FALCON_CLIENT_ID=your-client-id" \
  --set-env-vars="WARREN_AGENT_FALCON_CLIENT_SECRET=your-client-secret" \
  --set-env-vars="WARREN_AGENT_FALCON_BASE_URL=https://api.crowdstrike.com"

Security Note: For production, use Secret Manager for the client secret rather than plain environment variables:

gcloud run services update warren \
  --set-secrets="WARREN_AGENT_FALCON_CLIENT_SECRET=falcon-secret:latest"

Authentication

The agent uses OAuth2 Client Credentials Flow to authenticate with the CrowdStrike API:

1. Sends client_id and client_secret to POST /oauth2/token
2. Receives a bearer token (valid for 30 minutes)
3. Automatically refreshes the token before expiry

No manual token management is required.

Available Tools

The agent exposes the following read-only tools to the LLM:

Incidents

Alerts

Behaviors

CrowdScores

Events (EDR Telemetry)

Note: Event search uses the Next-Gen SIEM Search API, which runs queries asynchronously. The tool handles job creation and polling internally — results are returned once the search completes.

Troubleshooting

Agent not appearing in available tools

Verify that both WARREN_AGENT_FALCON_CLIENT_ID and WARREN_AGENT_FALCON_CLIENT_SECRET are set. The agent is skipped if either is empty.

401 Unauthorized errors

• Verify your Client ID and Client Secret are correct
• Check that the API client has not been revoked in the Falcon console
• Ensure the base URL matches your Falcon tenant region

403 Forbidden errors

• Verify the API client has the required scopes (Incidents: Read, Alerts: Read, NGSIEM: Read + Write)
• Check that the API client is active and not expired

Empty results

• Verify FQL filter syntax (values must be quoted, e.g., status:'new' not status:new)
• For event search, verify CQL syntax (e.g., aid=abc123, #event_simpleName=ProcessRollup2)
• Check the time range — CrowdStrike may have data retention limits
• Use simpler filters first, then refine