> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rad.security/llms.txt
> Use this file to discover all available pages before exploring further.

# CrowdStrike Falcon — Response Actions

> Optionally allow RAD Security to perform response actions, such as host containment and isolation, on CrowdStrike-managed endpoints.

# CrowdStrike Falcon Response Actions

This page describes the **optional, opt-in** capability that lets RAD Security perform response actions — such as host containment and isolation — on endpoints managed by CrowdStrike Falcon. This capability is separate from, and not required by, the read-only [CrowdStrike Falcon Insight data-sync integration](/rad-security/integrations/edr/crowdstrike-falcon-insight-setup).

<Warning>
  **Data synchronization is read-only and requires none of this.** The standard CrowdStrike Falcon Insight integration only reads data from your environment and cannot change anything on your endpoints.

  Response actions are a **separate, optional capability that is off by default.** When enabled, they grant RAD Security the ability to contain or isolate CrowdStrike-managed endpoints. Enable them only if you intend for RAD Security to act on your endpoints.
</Warning>

***

## How access is gated

Response actions require **two independent conditions**, and **both are off by default**. Neither one alone enables anything:

<Steps>
  <Step title="You grant the Hosts: Write scope">
    On your CrowdStrike API client, you grant **Write** permission on the **Hosts** scope. Without it, CrowdStrike itself will not accept containment or isolation requests, regardless of any RAD Security setting.
  </Step>

  <Step title="RAD Security enables response actions for your integration">
    RAD Security must explicitly turn on response actions for your specific integration. This is disabled by default and cannot be self-served — contact your RAD Security representative to request it.
  </Step>
</Steps>

<Note>
  Both conditions must hold at the same time. If either the Hosts: Write scope is absent **or** RAD Security has not enabled response actions for your integration, RAD Security remains read-only for that integration.
</Note>

***

## Enable response actions

<Steps>
  <Step title="Grant Hosts: Write on your API client">
    In the CrowdStrike Falcon Console, edit the API client you created for the RAD Security integration and add **Write** permission to the **Hosts** scope.

    The API client lives under **Support and resources > Resources and tools > API clients and keys**. For the full walkthrough of where the client is created and how to edit its scopes, see the [CrowdStrike Falcon Insight setup guide](/rad-security/integrations/edr/crowdstrike-falcon-insight-setup).

    <Info>
      Grant only the Hosts: Write scope. All other scopes for this integration remain **Read**. Data synchronization does not use write access.
    </Info>
  </Step>

  <Step title="Request RAD Security to enable response actions">
    Contact your RAD Security representative and ask them to enable response actions for your CrowdStrike integration. Because this is off by default, response actions will not function until RAD Security turns it on for your specific integration — even after the Hosts: Write scope is granted.
  </Step>
</Steps>

***

## What RAD can do when enabled

Once both conditions are met, RAD Security can perform host containment and isolation on CrowdStrike-managed endpoints through the CrowdStrike Falcon API.

Response actions may be initiated through RAD Security's AI agent, allowing containment or isolation of an affected endpoint as part of an investigation or coordinated response.

<Info>
  Containment and isolation are governed by CrowdStrike. RAD Security requests the action through CrowdStrike's API; CrowdStrike enforces it according to your host and isolation policies.
</Info>

***

## Auditing

Response actions change the state of your endpoints, so treat them as high-impact operations.

<CardGroup cols={2}>
  <Card title="Monitor Response Actions" icon="shield-check">
    Monitor and audit response actions performed through the integration for compliance and incident review.
  </Card>

  <Card title="Review in CrowdStrike" icon="clipboard-list">
    Correlate RAD-initiated actions with CrowdStrike's own host action and audit logs to maintain a complete record.
  </Card>
</CardGroup>

***

## Troubleshooting

<AccordionGroup>
  <Accordion title="Cannot Perform Response Actions" icon="hand">
    **Possible causes:**

    * The **Hosts: Write** scope is missing from your CrowdStrike API client
    * Response actions have not been enabled by RAD Security for this integration (disabled by default)
    * CrowdStrike-side host or isolation policy restrictions prevent the action

    **Solution:**

    * Verify the Hosts scope on your API client has **Write** permission, and re-check after any scope edits
    * Confirm RAD Security has enabled response actions for your specific integration; if unsure, contact your RAD Security representative
    * Review your CrowdStrike containment and isolation policies to ensure the target hosts are permitted to be contained or isolated
  </Accordion>
</AccordionGroup>

***

## Related

<CardGroup cols={2}>
  <Card title="CrowdStrike Falcon Insight Setup" icon="shield-check" href="/rad-security/integrations/edr/crowdstrike-falcon-insight-setup">
    Configure the read-only data-sync integration and API client scopes.
  </Card>

  <Card title="EDR Integrations Overview" icon="shield" href="/rad-security/integrations/edr/overview">
    Explore other EDR integration options.
  </Card>
</CardGroup>