falcon_search_scheduled_reports

What falcon_search_scheduled_reports does on CrowdStrike Falcon

AI agents call falcon_search_scheduled_reports to retrieve information from CrowdStrike Falcon without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why falcon_search_scheduled_reports is rated Low

This tool queries or retrieves information about scheduled reports without creating, modifying, deleting, or executing actions. It is a read-only operation that returns matching report metadata. The low severity reflects that searching reports has minimal blast radius—an AI agent misusing this would at worst access information about existing reports, not alter systems or data.

From the tool's definition Tool name contains 'search' and description states 'Search for scheduled reports', indicating data retrieval without modification or execution.

The rule that runs falcon_search_scheduled_reports safely

PolicyLayer is an MCP gateway: it sits between your AI agents and CrowdStrike Falcon, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For falcon_search_scheduled_reports, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "falcon_search_scheduled_reports": {}
  }
}

Questions about falcon_search_scheduled_reports