ModuleX
Integrations
CrowdStrike logo

CrowdStrike integration

Monitoring & Observability · 3 actions · API key auth

Integrate CrowdStrike Identity Protection into workflows to search sensors, fetch sensor details by device ID, and run sensor aggregate queries against the Falcon API.

Put CrowdStrike to workView CrowdStrike integration docs
Overview

The ModuleX CrowdStrike integration lets a ModuleX agent operate CrowdStrike on your behalf — working across sensors, sensor details and sensor aggregates — directly from a plain-English request, using your organization's own CrowdStrike credentials. No pre-built workflow is required: the agent picks the right CrowdStrike action for the task.

CrowdStrike is a monitoring & observability platform. ModuleX adds the agent layer: ask for an outcome and it selects and runs the right CrowdStrike action — or, when you want a repeatable process, the composer assembles a CrowdStrike workflow for you, streaming the nodes onto the canvas as it builds.

Ask the assistant

Drive CrowdStrike in plain English

Type what you want. A ModuleX agent picks the right CrowdStrike action — or chains several — and runs it. No workflow to build.

  • Show me the sensors that match what I describe
    resolves toquery_sensors
  • Get CrowdStrike Identity Protection sensor details for one or more device IDs
    resolves toget_sensor_details
  • Get CrowdStrike Identity Protection sensor aggregates from a JSON aggregate query body
    resolves toget_sensor_aggregates
Use cases

What you can automate with CrowdStrike

  • Query your sensors from a plain-English questionquery_sensors
  • Look up a sensor detail on demandget_sensor_details
  • Get CrowdStrike Identity Protection sensor aggregates from a JSON aggregate query bodyget_sensor_aggregates
At a glance

CrowdStrike integration at a glance

VendorCrowdStrike
CategoryMonitoring & Observability
Actions available3
AuthenticationAPI key
Uses your own credentialsYes
Works with the assistantYes
Works in the composerYes
Multi-step / tool-chainingYes
Technical referenceView docs
Integration version1.0.0
Last updatedJun 2026
Reference

All 3 CrowdStrike actions

Sensors1
query_sensors
Search CrowdStrike Identity Protection sensors by hostname, IP, or related fields using a Falcon Query Language filter.
Sensor Details1
get_sensor_details
Get CrowdStrike Identity Protection sensor details for one or more device IDs.
Sensor Aggregates1
get_sensor_aggregates
Get CrowdStrike Identity Protection sensor aggregates from a JSON aggregate query body.

See full parameters and response schemas in the CrowdStrike integration docs

Two ways

Two ways to use CrowdStrike in ModuleX

Ask the assistantType what you want done and a ModuleX agent picks the right CrowdStrike action and runs it — no workflow to build.
Compose a workflowNeed it to happen every time? Describe the process and the composer wires CrowdStrike into a repeatable workflow you can run on a schedule, from chat, or as an API.
Security

Connecting CrowdStrike

API keyCrowdStrike uses API-key authentication. You provide your own CrowdStrike secret key; ModuleX encrypts it and scopes it to your organization, so your whole team can use CrowdStrike without re-authenticating.

Step-by-step setup in the CrowdStrike docs

Related

Pairs well with CrowdStrike

Agents often chain CrowdStrike with these — connect them once and the agent can use all of them in a single task.

incident.io46 actionsVanta29 actionsGrafana25 actionsDatadog11 actionsNew Relic4 actionsPagerDuty4 actions
FAQ

CrowdStrike + ModuleX FAQ

A ModuleX agent can run any of CrowdStrike's 3 actions — across sensors, sensor details and sensor aggregates — from a plain-English request, using your organization's own CrowdStrike credentials.
No. The agent selects the right CrowdStrike action from your prompt. A workflow is only needed when you want a repeatable process — and the composer builds that for you from a description.
Via your own CrowdStrike API key, stored encrypted and scoped to your organization.
3, spanning sensors, sensor details and sensor aggregates.
CrowdStrike runs on your own credentials, so any CrowdStrike usage is billed by CrowdStrike directly. ModuleX meters the agent run — and if you connect your own model keys, there's no ModuleX markup on model usage.

Put CrowdStrike to work in ModuleX.

Connect CrowdStrike once with your own credentials and let your agent run all 3 actions on demand.

Put CrowdStrike to workView technical docs
Last updated: Jun 2026Browse all 175 integrations →