Marketplace for trusted AI agent skills

Investigate CrowdStrike Falcon alerts and telemetry through falcon-mcp

Skill Detail

Investigate CrowdStrike Falcon alerts and telemetry through falcon-mcp

<p>Use falcon-mcp when an agent needs CrowdStrike Falcon detections, incidents, behaviors, threat intel, or read-only response context to triage a security event without leaving an MCP workflow.</p>

Security & VerificationMCP

<p>Use falcon-mcp when an agent needs CrowdStrike Falcon detections, incidents, behaviors, threat intel, or read-only response context to triage a security event without leaving an MCP workflow.</p>

Security & Verification MCP Published
INSTALL WITH ANY AGENT
npx skills add agentskillexchange/skills --skill investigate-crowdstrike-falcon-alerts-and-telemetry-through-falcon-mcp Copy
View source Documentation
Tools required
Python 3.10+ with uv or pip; CrowdStrike Falcon API credentials with the scopes required for the enabled modules; an MCP-compatible client such as Claude Code, Claude Desktop, Cursor, or OpenClaw.
Install & setup
<p>Install with <code>uv tool install falcon-mcp</code> or <code>pip install falcon-mcp</code>, set the required Falcon API credentials in your environment or <code>.env</code> file, then run <code>falcon-mcp</code> for stdio transport or add flags like <code>–transport sse</code> or <code>–transport streamable-http</code> when you need a networked deployment.</p>
Author
CrowdStrike
Publisher
Company

falcon-mcp gives an MCP-compatible agent a bounded CrowdStrike investigation workflow. It can pull detections and incidents, inspect host and identity telemetry, query threat intelligence, and use modules like Real Time Response for read-oriented triage steps before an analyst escalates or contains an issue. That makes it useful when the job is understanding what happened in Falcon and gathering the right evidence quickly.

The scope boundary is clear enough to be skill-shaped: this is not a generic CrowdStrike product listing or a broad SecOps platform card. Invoke it when the agent needs Falcon-native investigation and telemetry retrieval inside an MCP session, not when the user just wants to browse Falcon normally or adopt a general-purpose security stack.