Skip to main content

​
CrowdStrike Falcon Response Actions

This page describes the optional, opt-in capability that lets RAD Security perform response actions — such as host containment and isolation — on endpoints managed by CrowdStrike Falcon. This capability is separate from, and not required by, the read-only CrowdStrike Falcon Insight data-sync integration.
Data synchronization is read-only and requires none of this. The standard CrowdStrike Falcon Insight integration only reads data from your environment and cannot change anything on your endpoints.Response actions are a separate, optional capability that is off by default. When enabled, they grant RAD Security the ability to contain or isolate CrowdStrike-managed endpoints. Enable them only if you intend for RAD Security to act on your endpoints.

​
How access is gated

Response actions require two independent conditions, and both are off by default. Neither one alone enables anything:
1

You grant the Hosts: Write scope

On your CrowdStrike API client, you grant Write permission on the Hosts scope. Without it, CrowdStrike itself will not accept containment or isolation requests, regardless of any RAD Security setting.
2

RAD Security enables response actions for your integration

RAD Security must explicitly turn on response actions for your specific integration. This is disabled by default and cannot be self-served — contact your RAD Security representative to request it.
Both conditions must hold at the same time. If either the Hosts: Write scope is absent or RAD Security has not enabled response actions for your integration, RAD Security remains read-only for that integration.

​
Enable response actions

1

Grant Hosts: Write on your API client

In the CrowdStrike Falcon Console, edit the API client you created for the RAD Security integration and add Write permission to the Hosts scope.The API client lives under Support and resources > Resources and tools > API clients and keys. For the full walkthrough of where the client is created and how to edit its scopes, see the CrowdStrike Falcon Insight setup guide.
Grant only the Hosts: Write scope. All other scopes for this integration remain Read. Data synchronization does not use write access.
2

Request RAD Security to enable response actions

Contact your RAD Security representative and ask them to enable response actions for your CrowdStrike integration. Because this is off by default, response actions will not function until RAD Security turns it on for your specific integration — even after the Hosts: Write scope is granted.

​
What RAD can do when enabled

Once both conditions are met, RAD Security can perform host containment and isolation on CrowdStrike-managed endpoints through the CrowdStrike Falcon API. Response actions may be initiated through RAD Security’s AI agent, allowing containment or isolation of an affected endpoint as part of an investigation or coordinated response.
Containment and isolation are governed by CrowdStrike. RAD Security requests the action through CrowdStrike’s API; CrowdStrike enforces it according to your host and isolation policies.

​
Auditing

Response actions change the state of your endpoints, so treat them as high-impact operations.

Monitor Response Actions

Monitor and audit response actions performed through the integration for compliance and incident review.

Review in CrowdStrike

Correlate RAD-initiated actions with CrowdStrike’s own host action and audit logs to maintain a complete record.

​
Troubleshooting

Possible causes:
  • The Hosts: Write scope is missing from your CrowdStrike API client
  • Response actions have not been enabled by RAD Security for this integration (disabled by default)
  • CrowdStrike-side host or isolation policy restrictions prevent the action
Solution:
  • Verify the Hosts scope on your API client has Write permission, and re-check after any scope edits
  • Confirm RAD Security has enabled response actions for your specific integration; if unsure, contact your RAD Security representative
  • Review your CrowdStrike containment and isolation policies to ensure the target hosts are permitted to be contained or isolated

CrowdStrike Falcon Insight Setup

Configure the read-only data-sync integration and API client scopes.

EDR Integrations Overview

Explore other EDR integration options.