crowdstrike-falcon
Installation
SKILL.md
CrowdStrike Falcon — content authoring
This skill encodes operational context for authoring detection content destined for configurations.crowdstrike blocks in OpenTide MDR objects. Falcon's content surfaces are split across multiple distinct products with different query languages and lifecycle expectations — the first decision is identifying which surface the rule targets.
1. Surface identification
| Surface | Query language | Use for |
|---|---|---|
| Falcon Insight — Event Search | Falcon Query Language (FQL) | Ad-hoc hunting, scheduled searches; original EAM data store |
| Falcon Insight — Custom IOAs | IOA rule-builder (UI-driven, condition tree) | Real-time behavioural detection on the sensor |
| Falcon Insight — Custom IOCs | Indicator API (hash, IP, domain) | Block / detect-only on observable atoms |
| Falcon Correlation Rules | FQL/CQL filter (JSON-defined) | Detection-as-code: scheduled queries with alert generation |
| Falcon Next-Gen SIEM (NG-SIEM, ex-Humio / LogScale) | LogScale Query Language (CQL) | Log search, dashboards, scheduled queries; multi-source ingestion |
| Falcon Real-Time Response (RTR) | RTR command set (limited shell) | Manual or automated response actions |
Confirm which surface the content targets before authoring. The same intent (e.g. "alert on suspicious PowerShell") looks very different as an IOA, an Event Search scheduled query, an NG-SIEM correlation rule, or a Fusion workflow.