Praxivara
Chrome extension
CrowdStrike Falcon
Your AI assistant for CrowdStrike Falcon. Watch what is happening to your computers. Ask in plain words and it does the CrowdStrike Falcon steps for you.
7-day free trial on every plan.
Ask in plain words. It does the CrowdStrike Falcon steps.
Create a new caseGet info about a roleUpdate the ML exclusions
No setup per taskConnect CrowdStrike Falcon once and it’s ready for every request.
You choose what it may doPick the actions it can use when you connect.
Disconnect anytimeIt stops right away. Nothing in the app is deleted.
Things you can ask in CrowdStrike Falcon
Type it, text it or say it on a call. It picks the right CrowdStrike Falcon steps and shows you what it did.
Actions
327You never pick an action. Say what you need and it chooses the right one. Here is everything it can do in CrowdStrike Falcon.
Create and addNew records and entries, from a plain-words ask.
Create new Certificate Based ExclusionsCreate the exclusions, with ancestor fieldsCreate a report of Self Service IOA ExclusionsCreate new Self Service IOA ExclusionsSubmit an uploaded file or a URL for sandbox analysisLaunch an indicators report creation jobCreate indicatorsAdd an activity to caseUpload an attachment for the caseCreate a new caseCreate the IOA exclusionsCreate the ML exclusionsCreate the sensor visibility exclusionsUpload a new put-file to use for the RTR `put` commandUpload a new custom-script to use for the RTRCreate a new userCreate new API ClientCreate host groupsCreate a report of ML exclusions scopedCreate a tokenCreate content update policiesCreate device control policiesCreate or clone a device control policy (USBCreate firewall policiesCreate prevention policiesCreate response policiesCreate sensor update policiesUpload a new scripts to replace
Find and readLook anything up without opening CrowdStrike Falcon.
Retrieve all Alerts that match a particular FQLGet all available scopes for customerSearch for hidden hosts in your environmentRetrieve details about recent login sessionsRetrieve details about recent interactive loginRetrieve history of IP and MAC addresses of devicesSearch for hosts in your environment by platformSearch for Host Groups in your environmentGet the online status for one or more hostsGet Self Service IOA Exclusion aggregatesGet all exclusionsRetrieve certificate signing information for a fileGet Self Service IOA Exclusions rules for matchedGet defaults for Self Service IOA ExclusionsSearch for cert-based exclusionsSearch for exclusions, with ancestor fieldsSearch for self service IOA exclusionsDownload IOC packs, PCAP files, memory dumpsGet extracted strings from a memory dumpGet hex view of a memory dumpGet memory dump content, as binaryGet a short summary version of a sandbox reportGet a full sandbox reportCheck the status of a sandbox analysisRetrieve full details for one or more adversaryExport Mitre ATT&CK information for a given malwareExport Mitre ATT&CK information for a given actorDownload earlier rule setsDownload the latest rule setGet vulnerabilitiesSearch for adversary incidents using FQL criteriaGet the number of devices the indicator has runGet combined for indicatorsQuery actionsGet the number of processes the indicator has runSearch for indicatorsQuery IOC typesQuery platformsQuery severitiesRetrieve message center casesSearch for members of a Content Update PolicySearch for members of a Device Control PolicySearch for Firewall Policies in your environmentSearch for Prevention Policies in your environmentSearch for Response Policies in your environmentSearch for Sensor Update Policies with additionalRetrieve a set of Content Update PoliciesRetrieve the configuration for a Default DeviceRetrieve a set of Device Control PoliciesGet device control policies for the given filterRetrieve a set of Sensor Update PoliciesGet a set of Sensor Visibility ExclusionsSearch for content versions available for pinningSearch for IOA exclusionsSearch for ML exclusionsSearch for sensor visibility exclusionsGet all the RTR sessions created for a customerGet aggregates on session dataGet status of an executed active-responder commandGet status of an executed RTR administrator commandGet status of an executed command on a single hostGet a list of files for the specified RTR sessionRetrieve a list with SHA256 of samples that existDiscover all event streams in your environmentSearch for evaluation logic in your environmentSearch for Vulnerabilities in your environmentGet info about a roleGet info about users including their name, UIDGet Zero Trust Assessment data for one or more hostsList access scopes by IDQuery Access Scopes and returns IDsRetrieve aggregate values for Alerts across all CIDsRetrieve all AlertsRetrieve all Alerts IDs that match a given queryGet API clientsGet All API client IDs for customerSearch for members of a Host GroupGet details on one or more hostsRetrieve a set of Host GroupsRetrieve hidden hostsGet exclusion aggregatesFind all exclusion IDs matching the query with filterGet the exclusions by ID, with ancestor fieldsGet the Self Service IOA Exclusions rules by IDFind sandbox reportsFind submission IDs for uploaded filesGet the details of one or more audit events by IDCheck current installation token settingsGet the details of one or more tokens by IDSearch for audit eventsSearch for tokensGet info about actorsGet info about indicatorsGet malware entitiesGet info about reportsRetrieve specific actors using their actor IDsRetrieve specific indicators using their indicator IDsGet malware entities for specified IDsRetrieve report and observable IDs associatedRetrieve specific reports using their report IDsRetrieve details for rule sets for the specified IDsGet actor IDsGet indicators IDsGet malware family namesGet MITRE tactics and techniquesGet report IDsSearch for rule IDsGet vulnerabilities IDsGet Indicators aggregatesGet actions by IDsGet indicators by IDsGet the IDs of devices the indicator has runRetrieve aggregate case valuesRetrieve activities for given IDsRetrieve an attachment for the caseRetrieve activities IDs for a caseRetrieve case IDsSearch for content update policiesSearch for device control policiesSearch for members of a Firewall PolicySearch for members of a Prevention PolicySearch for members of a Response policyRetrieve available builds for use with Sensor UpdateRetrieve kernel compatibility info for Sensor UpdateSearch for members of a Sensor Update PolicySearch for sensor update policiesGet default device control settings (USBRetrieve a set of Firewall PoliciesGet a set of IOA ExclusionsGet a set of ML ExclusionsRetrieve a set of Prevention PoliciesRetrieve a set of Response PoliciesGet quarantine file aggregatesGet quarantine file metadata for specified IDsGet quarantine file IDsRetrieve the status of the specified batch getGet RTR extracted file contentsGet Falcon scripts with metadata and content of scriptGet RTR put file contents for a given file IDGet put-filesGet queued session metadata by session IDGet custom-scriptsGet session metadata by session IDGet a list of Falcon script IDs availableGet a list of put-file ID's that are availableGet a list of custom-script ID's that are availableGet a list of session IDsRetrieve the file associated with the given IDGet details on evaluation logic itemsGet details on remediationsGet details on vulnerabilitiesGet event body for the provided event IDGet events entities for specified IDsGet events IDsGet rules entities for specified IDsGet rules IDsGet host aggregatesGet user grantsShow role IDs for all roles availableList user IDs for all users in your customer accountShow role IDsGet info about a userList the usernamesList user IDs for all usersGet a user's IDGet the Zero Trust Assessment audit report
Update and organizeKeep things current as they change.
Update existing Certificate Based ExclusionsUpdate indicatorsSet the precedence of Content Update PoliciesUpdate the configuration for a Default DeviceUpdate the configuration for Default Device ControlSet the precedence of Device Control PoliciesSet the precedence of Firewall PoliciesUpdate the IOA exclusionsUpdate the ML exclusionsSet the precedence of Prevention PoliciesSet the precedence of Response PoliciesSet the precedence of Sensor Update PoliciesUpdate the sensor visibility exclusionsApply quarantine file actions by queryApply actions to one or more UserUpdate existing API ClientUpdate host groupsUpdate the exclusions by ID, with ancestor fieldsUpdate the Self Service IOA Exclusions rule by IDUpdate installation token settingsUpdate one or more tokensUpdate content update policiesUpdate device control policy's classes (USBUpdate device control policiesUpdate device control policy base (USB and Bluetooth)Update firewall policiesUpdate prevention policiesUpdate response policiesUpdate sensor update policiesApply action by quarantine file IDsAssign one
Clean upClear out what you’re done with.
Delete a set of Content Update PoliciesDelete a set of Device Control PoliciesDelete an RTR session fileDelete a queued session commandDelete a sessionRemove a sample, including file, metaDelete a user permanentlyDelete existing API ClientsDelete a set of Host GroupsDelete the exclusions by IDDelete the exclusions by ID, with ancestor fieldsDelete the Self Service IOA Exclusions rule by IDDelete reportDelete a token immediatelyDelete indicators by IDsDelete a set of Firewall PoliciesDelete the IOA exclusions by IDDelete the ML exclusions by IDDelete a set of Prevention PoliciesDelete a set of Response PoliciesDelete a set of Sensor Update PoliciesDelete the sensor visibility exclusions by IDDelete a put-fileDelete a custom-scriptRevoke one
More actionsEverything else it can do in CrowdStrike Falcon.
Permanently delete hosts from the systemTake various actions on the hosts in your environmentAppend or remove one or more Falcon Grouping TagsPerform the specified action on the provided groupPerform the specified action on the Host GroupsActions used to manipulate the contentExecute an SDMF data frame query against exclusionPerform statistical aggregations over incident dataReturn a Report PDF attachmentExecute an SDMF data frame query against IOCPerform the specified action on the Device ControlPerform the specified action on the FirewallPerform the specified action on the PreventionPerform the specified action on the ResponseReturn count of potentially affected quarantinedExecute an active responder command on a single hostExecute an RTR administrator command on a single hostExecute a command on a single hostRefresh a session timeout on a single hostInitialize a new session with the RTR cloudRefresh an active event streamPerform a combined query and get operationGrant or Revoke one or more roles to a userModify an existing user's first or last namePerform actions on detectionsPerform actions on AlertsReset existing API Clients's secretIncrements a bulk maintenance tokenReveals an uninstall token for a specific devicePerform the specified action on the Content UpdatePerform the specified action on the Sensor UpdateBatch executes an RTR active-responder command acrossBatch executes an RTR administrator command acrossBatch executes an RTR read-only command acrossBatch executes `get` command across hostsBatch initialize an RTR session on multiple hostsBatch refresh an RTR session on multiple hostsModify an existing user's
Showing the main actions in each group.
Triggers
2When something happens in CrowdStrike Falcon, an AI agent can start on its own. Pick an event, and say what should happen next.
Then An AI agent starts and runs the steps you describe.
Then An AI agent starts and runs the steps you describe.
It only does what you allow.
Choose which CrowdStrike Falcon actions it may use, and how often it checks with you. Looking things up just runs.
- Turn off what you don’t need, when you connect or anytime after.
- Disconnect in one click. Nothing in your CrowdStrike Falcon is deleted.
Manage actionsConnected
327 of 327 capabilities enabled
Create a new case
Get info about a role
Update the ML exclusions
Return a Report PDF attachment
Your permission mode is Auto. It decides when to check with you.
CrowdStrike Falcon questions
Try Praxivara for free, open Integrations, pick CrowdStrike Falcon and follow the steps to connect your account. You can change or remove it anytime.
Only if you let it. You choose how often it checks with you, and you can switch off any action you don’t want it to use.
Praxivara stops using it right away. Nothing in CrowdStrike Falcon is deleted. Any agent that needed it skips those steps until you connect it again.
Hand off the CrowdStrike Falcon busywork.
Try it free for 7 days and connect CrowdStrike Falcon in a click.