What can I automate with the CrowdStrike integration?

Investigate Falcon hosts, alerts, incidents and vulnerabilities, and manage host groups. Lodol supports 25 actions and 1 trigger for CrowdStrike, which you can combine with any other app in a workflow.

How do I connect CrowdStrike to Lodol?

Connect CrowdStrike once in your workspace and every action and trigger it supports can be added to a workflow, by you in the editor or by your AI.

All integrationsSecurity

CrowdStrike

Investigate Falcon hosts, alerts, incidents and vulnerabilities, and manage host groups.

Start Free Browse all integrations

actions: 25
trigger: 1

Triggers

Start a workflow when something happens in CrowdStrike.

New alertRuns when a new Falcon alert ID matches your filter. Use Get alerts to retrieve its details. Existing records form the initial baseline. Polling refuses scans exceeding 4,000 visible records.

Actions

Steps a workflow can run in CrowdStrike.

Filter CrowdStrike actions

List hostsSearch for hosts in your environment by platform, hostname, IP, and other criteria. Returns one page; use Next cursor to continue when Has more is true.
Get hostsGet details on one or more hosts by providing host IDs as a query parameter.
Get host online stateGet the online status for one or more hosts by specifying each host’s unique ID.
Query host IDsDeprecated: Please use the CombinedDevicesByFilter endpoint. Returns one page; use Next cursor to continue when Has more is true.
List hidden hostsSearch for hidden hosts in your environment by platform, hostname, IP, and other criteria. Returns one page; use Next cursor to continue when Has more is true.
List host groupsSearch for Host Groups in your environment by providing an FQL filter and paging details. Returns one page; use Next cursor to continue when Has more is true.
Get host groupsRetrieve a set of Host Groups by specifying their IDs
Create host groupsCreate Host Groups by specifying details about the group to create
Update host groupsUpdate Host Groups by specifying the ID of the group and details to update
Delete host groupsDelete a set of Host Groups by specifying their IDs
List host group membersSearch for members of a Host Group in your environment by providing an FQL filter and paging details. Returns one page; use Next cursor to continue when Has more is true.
Query alert IDsRetrieves all Alerts ids that match a given query. Returns one page; use Next cursor to continue when Has more is true.
Get alertsRetrieves all Alerts given their composite ids.
Query incident IDsDECOMMISSIONED: DEPRECATED: the incidentapi will be removed in March 2026. Returns one page; use Next cursor to continue when Has more is true.
Get incidentsDECOMMISSIONED: DEPRECATED: the incidentapi will be removed in March 2026.
Query behavior IDsDECOMMISSIONED: DEPRECATED: the incidentapi will be removed in March 2026. Returns one page; use Next cursor to continue when Has more is true.
Get behaviorsDECOMMISSIONED: DEPRECATED: the incidentapi will be removed in March 2026.
Get CrowdScoresDECOMMISSIONED: DEPRECATED: the incidentapi will be removed in March 2026.
Query vulnerability IDsSearch for Vulnerabilities in your environment by providing an FQL filter and paging details. Returns one page; use Next cursor to continue when Has more is true.
Get vulnerabilitiesGet details on vulnerabilities by providing one or more IDs
Get remediationsGet details on remediations by providing one or more IDs
Query user IDsList user IDs for all users in your customer account, including external users who have roles assigned in your customer account. Returns one page; use Next cursor to continue when Has more is true.
Get usersGet info about users including their name, UID, CID and whether they are external by providing user UUIDs
List role IDsShow role IDs for all roles available in your customer account. Returns one page; use Next cursor to continue when Has more is true.
Get rolesGet info about a role