falcon_search_serverless_vulnerabilities

What falcon_search_serverless_vulnerabilities does on CrowdStrike Falcon

AI agents call falcon_search_serverless_vulnerabilities to retrieve information from CrowdStrike Falcon without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why falcon_search_serverless_vulnerabilities is rated Low

This tool searches and retrieves vulnerability data from serverless functions, consistent with Read category operations (search, query, fetch). While the information retrieved could be sensitive security data that an adversary might exploit for reconnaissance, the tool itself performs no destructive, financial, or code-execution actions.

From the tool's definition Tool name includes 'search' and description states 'Search serverless function vulnerabilities' — retrieval-only operation with no modification, deletion, or execution of external systems.

The rule that runs falcon_search_serverless_vulnerabilities safely

PolicyLayer is an MCP gateway: it sits between your AI agents and CrowdStrike Falcon, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For falcon_search_serverless_vulnerabilities, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "falcon_search_serverless_vulnerabilities": {}
  }
}

Questions about falcon_search_serverless_vulnerabilities