functions-falcon-api
Call CrowdStrike Falcon platform APIs (detections, alerts, hosts, RTR) from within Foundry function handlers. TRIGGER when user asks to "call Falcon APIs from a function", "use FalconPy in a function", "use gofalcon in a function", or needs to integrate Falcon platform APIs within serverless function code. DO NOT TRIGGER when user wants to expose external third-party APIs to Foundry — use api-integrations instead.
78
—
Does it follow best practices?
Impact
90%
1.12xAverage score across 2 eval scenarios
Advisory
Suggest reviewing before use
Evaluation results
92%
Device Lookup Foundry Function
Python Foundry function with correct FDK patterns and manifest
Function.instance() singleton
100%
100%
@func.handler decorator
100%
100%
func.run() entrypoint
100%
100%
Zero-arg FalconPy constructor
100%
100%
No explicit credential passing
100%
100%
No requests library
100%
100%
Correct OAuth scope in manifest
100%
100%
Non-200 error handling
100%
100%
207 Multi-Status handling
0%
0%
FDK imports present
100%
100%
88%
20%ServiceNow Incident Feed from CrowdStrike Detections
Detection severity mapping to ServiceNow via Foundry function
Function.instance() singleton
0%
100%
@func.handler decorator
0%
87%
FDK imports present
0%
100%
Zero-arg FalconPy constructor
100%
100%
No explicit credential passing
100%
100%
Correct FQL severity field
100%
66%
Severity-to-priority mapping
100%
100%
Limit capping with min()
100%
100%
status_code validation
100%
100%
Error logging on failure
100%
100%
detections:read scope in manifest
0%
30%
- Repository
- CrowdStrike/foundry-skills
- Commit
2f0ce35
- Evaluated
- Agent
- Claude Code
- Model
- Claude Sonnet 4.6
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.