From fe04e27e45c10cc3896d01647804690f5568ba1b Mon Sep 17 00:00:00 2001 From: leet-c1 <264029741+leet-c1@users.noreply.github.com> Date: Thu, 20 Aug 2026 18:18:17 +0000 Subject: [PATCH 1/4] docs(crowdstrike): document the API scopes each tool group needs The page told admins to grant "Read access to Detections, Incidents, and Hosts", which does not map to the tools C1 actually exposes and leaves the most confusing case undocumented. Adds a Choose API scopes section mapping each tool group to its Falcon API scope, covering hosts, alerts, incidents, indicators of compromise, device control policies, Spotlight vulnerabilities, Falcon Intelligence, Zero Trust Assessment, Falcon Discover, and cloud misconfigurations. Calls out the trap behind a real support question: the cloud misconfiguration tools need CSPM registration, not Cloud Security API Detections. The two scopes authorize different Falcon APIs, so an admin who enables the latter sees 403s on those tools while everything else works. Also documents the write scopes the response tools need (Hosts and IOC Manager), since the previous text implied Read was sufficient for the whole surface, and notes that a read-only API client is a deliberate way to keep response actions unavailable. Scope edits apply on the next token request, so admins do not need to re-register the server. --- product/admin/mcp-server/crowdstrike.mdx | 40 ++++++++++++++++++++++-- 1 file changed, 38 insertions(+), 2 deletions(-) diff --git a/product/admin/mcp-server/crowdstrike.mdx b/product/admin/mcp-server/crowdstrike.mdx index 6a7745d5..fa879dc5 100644 --- a/product/admin/mcp-server/crowdstrike.mdx +++ b/product/admin/mcp-server/crowdstrike.mdx @@ -42,7 +42,7 @@ In the Falcon console, go to **Support and resources** > **API clients and keys* {/* REVIEWER NOTE — needs a verified docs link for generating credentials */} -Give the client a recognizable name such as `C1`, then grant only the **API scopes** you need, such as **Read** access to Detections, Incidents, and Hosts. +Give the client a recognizable name such as `C1`, then grant **Read** on the API scopes covering the tools you want. See [Choose API scopes](#choose-api-scopes) for the mapping. Select **Create**, then copy the **Client ID** and **Client Secret**. CrowdStrike shows the secret only once. @@ -56,6 +56,42 @@ Note your Falcon cloud's API base URL, such as `https://api.crowdstrike.com` or For a shared production setup, use a dedicated API client so activity is attributable to C1 rather than a person. +## Choose API scopes + +The API client's scopes determine which tools return data. C1 exposes tools across several Falcon products, and each needs its own scope. **Read** covers every list tool: + +| Tools | Falcon API scope | +|---|---| +| Hosts | Hosts | +| Alerts | Alerts | +| Incidents | Incidents | +| Indicators of compromise | IOC Manager | +| Device control policies | Device control policies | +| Vulnerabilities and remediations | Vulnerabilities (Falcon Spotlight) | +| Threat actors, indicators, and reports | Falcon Intelligence | +| Zero Trust Assessment | Zero Trust Assessment | +| Applications | Falcon Discover | +| Cloud misconfigurations (IOM) | CSPM registration | + +{/* REVIEWER NOTE — confirm the exact Falcon console labels for each scope row */} + +Grant only the scopes for the tools you plan to use. A tool whose scope is missing returns CrowdStrike's authorization error rather than an empty result, so an unexpected 403 usually means the scope is absent from the API client. + +The response tools need **Write** in addition to Read: + +| Tools | Falcon API scope | +|---|---| +| Contain, lift containment, hide host | Hosts (Write) | +| Create indicator of compromise | IOC Manager (Write) | + +Leave these scopes off the API client if you want a read-only connection. The tools then return CrowdStrike's authorization error, so a read-only client is a deliberate way to keep response actions unavailable. + + +The cloud misconfiguration tools need **CSPM registration**, not **Cloud Security API Detections**. The two scopes cover different Falcon APIs, and Cloud Security API Detections does not authorize the tools C1 exposes. If `crowdstrike_list_ioms` returns 403 while your other tools work, add CSPM registration to the API client. + + +Scope changes take effect the next time C1 requests a token, so you don't need to re-register the server or reconnect after editing the API client. + ## How CrowdStrike credentials are shared The API client authenticates every user as one shared Falcon identity, so CrowdStrike sees a single identity for all tool calls. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage). For a shared setup, use a dedicated API client so activity is attributable to C1 rather than a person. @@ -96,4 +132,4 @@ Tool discovery runs even if your credentials are incorrect, so seeing discovered ## Manage your CrowdStrike credentials - **Rotate the client secret** by resetting it on the API client in the Falcon console, then update the secret on the server's authentication settings in C1. -- **Adjust access** by editing the API scopes granted to the API client in CrowdStrike. +- **Adjust access** by editing the API scopes granted to the API client in CrowdStrike. See [Choose API scopes](#choose-api-scopes). From 18afd590da8527d8391e4c0424dad8f8793fbf4a Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Thu, 20 Aug 2026 14:33:14 -0700 Subject: [PATCH 2/4] docs: apply style guide fixes Co-Authored-By: Claude Sonnet 5 --- product/admin/mcp-server/crowdstrike.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/product/admin/mcp-server/crowdstrike.mdx b/product/admin/mcp-server/crowdstrike.mdx index fa879dc5..d0e8194d 100644 --- a/product/admin/mcp-server/crowdstrike.mdx +++ b/product/admin/mcp-server/crowdstrike.mdx @@ -86,9 +86,9 @@ The response tools need **Write** in addition to Read: Leave these scopes off the API client if you want a read-only connection. The tools then return CrowdStrike's authorization error, so a read-only client is a deliberate way to keep response actions unavailable. - + The cloud misconfiguration tools need **CSPM registration**, not **Cloud Security API Detections**. The two scopes cover different Falcon APIs, and Cloud Security API Detections does not authorize the tools C1 exposes. If `crowdstrike_list_ioms` returns 403 while your other tools work, add CSPM registration to the API client. - + Scope changes take effect the next time C1 requests a token, so you don't need to re-register the server or reconnect after editing the API client. From 9bbba5ef5f93590a0058f5c1beaddd7dfd2e8f33 Mon Sep 17 00:00:00 2001 From: leet-c1 <264029741+leet-c1@users.noreply.github.com> Date: Mon, 24 Aug 2026 19:47:39 +0000 Subject: [PATCH 3/4] docs(crowdstrike): name the actual tools in the scope table MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The scope tables labelled their rows with invented category names — "Cloud misconfigurations (IOM)", "Threat actors, indicators, and reports", "Indicators of compromise" — none of which appear in the product, the server's tool list, or the Falcon console. A reader with 14 tools in front of them had no way to match a row to a tool, which is the one thing the table exists to do. Rows are now the tool names the server actually exposes, taken from the impl's own surface: list_hosts, list_alerts, list_incidents, list_ioc_indicators, list_device_control_policies, list_vulnerabilities, list_remediations, list_intel_actors, list_intel_indicators, list_intel_reports, list_zero_trust_assessments, list_discover_applications, list_ioms, list_iom_details, and the four write tools contain_host, lift_containment, hide_host and create_ioc_indicator. All 14 read tools are covered. The groupings are not editorial: they follow the CrowdStrike spec's own operation tags, so list_vulnerabilities and list_remediations share a row because both endpoints are tagged spotlight_vulnerabilities, and the three intel tools share one because all three are tagged intel. The note said the IOM tools need CSPM registration "not Cloud Security API Detections", naming a console string I had not verified, and referred to the tool as crowdstrike_list_ioms — a prefix this server does not apply. It now names list_ioms and list_iom_details and says what is actually checkable: the Cloud Security scope covers cloud groups and cloud risks, endpoints C1 does not expose, so it cannot make these two tools work. The CSPM registration mapping itself is evidence-based — both IOM endpoints are tagged cspm_registration in the spec. The reviewer note now says exactly which column is verified and which is not: the tool names are exact, the Falcon console scope labels still need a check against a real tenant. --- product/admin/mcp-server/crowdstrike.mdx | 36 +++++++++++------------- 1 file changed, 17 insertions(+), 19 deletions(-) diff --git a/product/admin/mcp-server/crowdstrike.mdx b/product/admin/mcp-server/crowdstrike.mdx index d0e8194d..a10877b5 100644 --- a/product/admin/mcp-server/crowdstrike.mdx +++ b/product/admin/mcp-server/crowdstrike.mdx @@ -58,36 +58,34 @@ For a shared production setup, use a dedicated API client so activity is attribu ## Choose API scopes -The API client's scopes determine which tools return data. C1 exposes tools across several Falcon products, and each needs its own scope. **Read** covers every list tool: +Each tool reads a different Falcon API, and each API has its own scope. Grant **Read** on the scopes for the tools you want. A tool whose scope is missing returns CrowdStrike's authorization error rather than an empty result, so an unexpected 403 usually means the scope is absent from the API client. | Tools | Falcon API scope | |---|---| -| Hosts | Hosts | -| Alerts | Alerts | -| Incidents | Incidents | -| Indicators of compromise | IOC Manager | -| Device control policies | Device control policies | -| Vulnerabilities and remediations | Vulnerabilities (Falcon Spotlight) | -| Threat actors, indicators, and reports | Falcon Intelligence | -| Zero Trust Assessment | Zero Trust Assessment | -| Applications | Falcon Discover | -| Cloud misconfigurations (IOM) | CSPM registration | +| `list_hosts` | Hosts | +| `list_alerts` | Alerts | +| `list_incidents` | Incidents | +| `list_ioc_indicators` | IOC Manager | +| `list_device_control_policies` | Device control policies | +| `list_vulnerabilities`, `list_remediations` | Vulnerabilities (Falcon Spotlight) | +| `list_intel_actors`, `list_intel_indicators`, `list_intel_reports` | Falcon Intelligence | +| `list_zero_trust_assessments` | Zero Trust Assessment | +| `list_discover_applications` | Falcon Discover | +| `list_ioms`, `list_iom_details` | CSPM registration | -{/* REVIEWER NOTE — confirm the exact Falcon console labels for each scope row */} +{/* REVIEWER NOTE — the tool names are exact, taken from the server's own tool list. The right-hand column needs a check against the Falcon console's own scope labels, which I could not verify without a tenant. */} -Grant only the scopes for the tools you plan to use. A tool whose scope is missing returns CrowdStrike's authorization error rather than an empty result, so an unexpected 403 usually means the scope is absent from the API client. - -The response tools need **Write** in addition to Read: +Four tools take action in CrowdStrike and need **Write** as well: | Tools | Falcon API scope | |---|---| -| Contain, lift containment, hide host | Hosts (Write) | -| Create indicator of compromise | IOC Manager (Write) | +| `contain_host`, `lift_containment`, `hide_host` | Hosts (Write) | +| `create_ioc_indicator` | IOC Manager (Write) | -Leave these scopes off the API client if you want a read-only connection. The tools then return CrowdStrike's authorization error, so a read-only client is a deliberate way to keep response actions unavailable. +Leaving Write off the API client is a deliberate way to keep the connection read-only: those four tools then return CrowdStrike's authorization error, and the rest keep working. -The cloud misconfiguration tools need **CSPM registration**, not **Cloud Security API Detections**. The two scopes cover different Falcon APIs, and Cloud Security API Detections does not authorize the tools C1 exposes. If `crowdstrike_list_ioms` returns 403 while your other tools work, add CSPM registration to the API client. +`list_ioms` and `list_iom_details` need the **CSPM registration** scope. CrowdStrike also offers a Cloud Security scope, and it is easy to reach for by name — but it covers a different set of endpoints (cloud groups and cloud risks) that C1 does not expose, so it will not make these two tools work. If `list_ioms` returns 403 while your other tools return data, add CSPM registration to the API client. Scope changes take effect the next time C1 requests a token, so you don't need to re-register the server or reconnect after editing the API client. From b46a83aff67cd4e030e0b86f0d6d6a6404dccf95 Mon Sep 17 00:00:00 2001 From: Melinda Moreland Date: Tue, 25 Aug 2026 17:00:47 -0700 Subject: [PATCH 4/4] docs: apply style guide fixes Co-Authored-By: Claude Sonnet 4.6 --- product/admin/mcp-server/crowdstrike.mdx | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/product/admin/mcp-server/crowdstrike.mdx b/product/admin/mcp-server/crowdstrike.mdx index a10877b5..363bf6b6 100644 --- a/product/admin/mcp-server/crowdstrike.mdx +++ b/product/admin/mcp-server/crowdstrike.mdx @@ -37,15 +37,21 @@ CrowdStrike issues a client ID and client secret to an API client, which C1 exch -In the Falcon console, go to **Support and resources** > **API clients and keys** and select **Add new API client**. +In the Falcon console, go to **Support and resources** > **API clients and keys**. {/* REVIEWER NOTE — needs a verified docs link for generating credentials */} +Select **Add new API client**. + + Give the client a recognizable name such as `C1`, then grant **Read** on the API scopes covering the tools you want. See [Choose API scopes](#choose-api-scopes) for the mapping. -Select **Create**, then copy the **Client ID** and **Client Secret**. CrowdStrike shows the secret only once. +Select **Create**. + + +Copy the **Client ID** and **Client Secret**. CrowdStrike shows the secret only once. Note your Falcon cloud's API base URL, such as `https://api.crowdstrike.com` or your region-specific endpoint. @@ -54,6 +60,8 @@ Note your Falcon cloud's API base URL, such as `https://api.crowdstrike.com` or +You now have a client ID, client secret, and base URL to enter when you register the server in C1. + For a shared production setup, use a dedicated API client so activity is attributable to C1 rather than a person. ## Choose API scopes