falcon_search_iocs

What falcon_search_iocs does on CrowdStrike Falcon

AI agents call falcon_search_iocs to retrieve information from CrowdStrike Falcon without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why falcon_search_iocs is rated Low

This tool retrieves or queries indicator of compromise (IOC) data from the CrowdStrike Falcon platform using FQL query syntax. It performs a search operation without creating, modifying, deleting, or executing any actions. The blast radius of misuse is minimal—an agent could retrieve excessive data or sensitive IOC information, but cannot modify threat intelligence or trigger security responses.

From the tool's definition Tool name 'falcon_search_iocs' combined with description 'Search custom IOCs using FQL' indicates a query/search operation. The verb 'search' and use of FQL (a query language) confirm this is a read-only retrieval action with no side effects.

The rule that runs falcon_search_iocs safely

PolicyLayer is an MCP gateway: it sits between your AI agents and CrowdStrike Falcon, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For falcon_search_iocs, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "falcon_search_iocs": {}
  }
}

Questions about falcon_search_iocs