Discover
Accessing and managing CrowdStrike Falcon Discover applications and unmanaged assets
API Scopes
Section titled “API Scopes”Assets:read
falcon_search_applications
Section titled “falcon_search_applications”Required scopes: Assets:read
Search for applications discovered in your CrowdStrike environment.
Use this to find applications by name, vendor, or installation details. Consult falcon://discover/applications/fql-guide before constructing filter expressions. Returns application entities with optional host info and usage data (based on facet).
Example prompts:
- “Find all Chrome installations across my environment”
falcon_search_unmanaged_assets
Section titled “falcon_search_unmanaged_assets”Required scopes: Assets:read
Search for unmanaged assets (hosts without Falcon sensor) in your environment.
Finds systems discovered by Falcon-managed hosts that lack a sensor themselves. Consult falcon://discover/hosts/fql-guide before constructing filter expressions. The tool automatically adds entity_type:‘unmanaged’ to all queries. Returns full asset details including platform, network, and criticality information.
Example prompts:
- “Show me unmanaged Windows devices on the network”
Resources
Section titled “Resources”falcon://discover/applications/fql-guide: Contains the guide for thefilterparam of thefalcon_search_applicationstool.falcon://discover/hosts/fql-guide: Contains the guide for thefilterparam of thefalcon_search_unmanaged_assetstool.