functions-falcon-api
Call CrowdStrike Falcon platform APIs (detections, alerts, hosts, RTR) from within Foundry function handlers. TRIGGER when user asks to "call Falcon APIs from a function", "use FalconPy in a function", "use gofalcon in a function", or needs to integrate Falcon platform APIs within serverless function code. DO NOT TRIGGER when user wants to expose external third-party APIs to Foundry — use api-integrations instead.
83
87%
Does it follow best practices?
Impact
66%
1.29xAverage score across 3 eval scenarios
Low
Low-risk findings worth noting
Evaluation results
100%
100%Detection Feed API for Security Dashboard
Python Foundry detection retrieval endpoint
Alerts class imported
0%
100%
query_alerts_v2 called
0%
100%
get_alerts_v2 called
0%
100%
product filter applied
0%
100%
Zero-arg constructor
0%
100%
No auth code
0%
100%
FDK imports
0%
100%
FDK handler entrypoint
0%
100%
auth.scopes declared
0%
100%
FQL AND syntax
0%
100%
Limit capped
0%
100%
0%
-55%Host Security Alert Enrichment Endpoint
Multi-API host-alert enrichment with retry and mocked unit tests
Zero-arg Hosts()
0%
0%
Zero-arg Alerts()
0%
0%
Hosts query-then-details
70%
0%
Alerts query-then-details
70%
0%
Retry on transient status codes
100%
0%
Exponential backoff
100%
0%
Mock-based unit tests
70%
0%
207 Multi-Status handling
0%
0%
Severity integer mapping
100%
0%
devices:read scope in manifest
0%
0%
Alerts scope in manifest
80%
0%
FDK handler pattern
0%
0%
100%
LogScale Query Endpoint for Fusion Repository
NGSIEM async search from Foundry function
NGSIEM class used
100%
100%
Zero-arg constructor
100%
100%
search-all repository param
100%
100%
search= keyword argument
100%
100%
resources key for job id
100%
100%
body key for results
100%
100%
#repo filter prefix in query
100%
100%
Polling loop with done check and timeout
100%
100%
humio-auth-proxy:read scope
100%
100%
- Repository
- CrowdStrike/foundry-skills
- Commit
1854e7d
- Evaluated
- Agent
- Claude Code
- Model
- Claude Sonnet 4.6
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.