Cloud Security
Accessing and analyzing CrowdStrike Falcon cloud resources like Kubernetes & Containers Inventory, Images Vulnerabilities, Cloud Assets
API Scopes
Section titled “API Scopes”Cloud Security API Assets:readFalcon Container Image:read
falcon_count_kubernetes_containers
Section titled “falcon_count_kubernetes_containers”Required scopes: Falcon Container Image:read
Count kubernetes containers in your CrowdStrike Kubernetes & Containers Inventory
Example prompts:
- “How many containers are running in Azure?”
falcon_search_cspm_assets
Section titled “falcon_search_cspm_assets”Required scopes: Cloud Security API Assets:read
Search for cloud assets in your CrowdStrike CSPM Asset Inventory.
This tool queries cloud resources (EC2 instances, VPCs, subnets, load balancers, etc.) managed by CrowdStrike CSPM. Supports comprehensive FQL filtering including:
- Cloud provider and resource type filtering
- Tag-based filtering (AWS/Azure/GCP tags)
- Security posture (publicly exposed, severity, IOM/IOA counts)
- Compliance status and benchmarks
- Temporal filtering (creation time, last updated)
Example prompts:
- “Find all AWS EC2 instances in my cloud inventory”
falcon_search_images_vulnerabilities
Section titled “falcon_search_images_vulnerabilities”Required scopes: Falcon Container Image:read
Search for images vulnerabilities in your CrowdStrike Image Assessments
Example prompts:
- “Find image vulnerabilities with CVSS score above 7”
falcon_search_kubernetes_containers
Section titled “falcon_search_kubernetes_containers”Required scopes: Falcon Container Image:read
Search for kubernetes containers in your CrowdStrike Kubernetes & Containers Inventory
Example prompts:
- “Find all containers running in AWS clusters”
- “Show me containers in the prod cluster”
Resources
Section titled “Resources”falcon://cloud/kubernetes-containers/fql-guide: Contains the guide for thefilterparam of thefalcon_search_kubernetes_containersandfalcon_count_kubernetes_containerstools.falcon://cloud/images-vulnerabilities/fql-guide: Contains the guide for thefilterparam of thefalcon_search_images_vulnerabilitiestool.falcon://cloud/cspm-assets/fql-guide: Contains the guide for thefilterparam of thefalcon_search_cspm_assetstool.