CrowdStrike × AmbactiBring CrowdStrike into
the flow of work.
A little less busywork with CrowdStrike.
Hosts5 capabilities+
- GetDeviceDetails
Retrieve device details for a specific host.
- QueryDevicesByFilter
Query devices by filter.
- PerformDeviceAction
Perform a device action such as 'Contain' or 'Lift Containment'.
- GetDeviceSnapshots
Get snapshots of device status.
- GetDeviceDetailsById
Retrieve device details for a specific host by device ID.
Alerts5 capabilities+
- GetAlerts
Retrieve a list of alerts.
- GetAlertDetails
Retrieve details of a specific alert.
- AcknowledgeAlert
Acknowledge a specific alert.
- UpdateAlert
Update details of a specific alert.
- DeleteAlert
Delete a specific alert.
Detection5 capabilities+
- QueryDetections
Retrieve detections based on provided query parameters.
- GetDetectionDetails
Retrieve details for a specific detection.
- UpdateDetection
Update details of a specific detection.
- AcknowledgeDetection
Acknowledge a specific detection.
- DeleteDetection
Delete a specific detection.
Users5 capabilities+
- GetUsers
Retrieve a list of users.
- GetUserDetails
Retrieve details of a specific user.
- CreateUser
Create a new user.
- UpdateUser
Update details of a specific user.
- DeleteUser
Delete a specific user.
Frequently asked
questions.
What could an Ambacti integration do with CrowdStrike?
The documented operations include Hosts: GetDeviceDetails; Hosts: QueryDevicesByFilter; Hosts: PerformDeviceAction; Hosts: GetDeviceSnapshots.
Could I keep a workflow read-only?
For a read-only workflow, limit account permissions to reading data and exclude actions that create, update, or delete records.
Will every action run automatically?
Choose which steps could run on their own and which should pause for review. Changes should follow the permissions and approval rules you set.
Do I need to review actions in CrowdStrike?
Decide which work could run on its own and which steps need your review.