---
title: "CrowdStrike"
description: "Reference for the Tracecat CrowdStrike integration: registered actions, required secrets, expected inputs, and example workflow usage."
---

{/* Auto-generated by scripts/generate_tool_docs.py; do not edit by hand. */}
## List alerts

Action ID: `tools.crowdstrike.list_alerts`

Query for Crowdstrike alerts via the Falcon SIEM API.

Reference: [https://falconpy.io/Service-Collections/Alerts.html#uber-class-example-7](https://falconpy.io/Service-Collections/Alerts.html#uber-class-example-7)

### Input fields

<ParamField path="end_time" type="string" required>

End time for the query (exclusive).

</ParamField>

<ParamField path="start_time" type="string" required>

Start time for the query (inclusive).

</ParamField>

<ParamField path="limit" type="integer">

Maximum number of alerts to return.

Default: `100`.

</ParamField>

<ParamField path="member_cid" type="string | null">

Crowdstrike member CID.

Default: `null`.

</ParamField>

<ParamField path="query" type="string | null">

Falcon Query Language (FQL) filter to apply to alerts. If specified, overrides `start_time` and `end_time`.

Default: `null`.

</ParamField>

## List detects

Action ID: `tools.crowdstrike.list_detects`

Query for CrowdStrike detects and summaries via the Falcon SIEM API.

Reference: [https://falconpy.io/Service-Collections/Detects.html](https://falconpy.io/Service-Collections/Detects.html)

### Input fields

<ParamField path="end_time" type="string" required>

End time for the query (exclusive).

</ParamField>

<ParamField path="start_time" type="string" required>

Start time for the query (inclusive).

</ParamField>

<ParamField path="limit" type="integer">

Maximum number of alerts to return.

Default: `100`.

</ParamField>

<ParamField path="member_cid" type="string | null">

Crowdstrike member CID.

Default: `null`.

</ParamField>

<ParamField path="query" type="string | null">

Falcon Query Language (FQL) filter to apply to alerts. If specified, overrides `start_time` and `end_time`.

Default: `null`.

</ParamField>

## List incidents

Action ID: `tools.crowdstrike.list_incidents`

Query for Crowdstrike incidents via the Falcon SIEM API.

Reference: [https://falconpy.io/Service-Collections/Incidents.html](https://falconpy.io/Service-Collections/Incidents.html)

### Input fields

<ParamField path="end_time" type="string" required>

End time for the query (exclusive).

</ParamField>

<ParamField path="start_time" type="string" required>

Start time for the query (inclusive).

</ParamField>

<ParamField path="limit" type="integer">

Maximum number of incidents to return.

Default: `100`.

</ParamField>

<ParamField path="member_cid" type="string | null">

Crowdstrike member CID.

Default: `null`.

</ParamField>

<ParamField path="query" type="string | null">

Falcon Query Language (FQL) filter to apply to cases. If specified, overrides `start_time` and `end_time`.

Default: `null`.

</ParamField>
