Scheduled Reports
Accessing and managing CrowdStrike Falcon scheduled reports and scheduled searches
API Scopes
Section titled “API Scopes”Scheduled Reports:read
falcon_download_report_execution
Section titled “falcon_download_report_execution”Required scopes: Scheduled Reports:read
Download the results of a completed report execution.
Only works for executions with status=‘DONE’. Check status first using falcon_search_report_executions. Returns CSV string or JSON records depending on the report’s configured format. PDF format is not supported.
Example prompts:
- “Download the results for report execution abc123”
falcon_launch_scheduled_report
Section titled “falcon_launch_scheduled_report”Required scopes: Scheduled Reports:read
Launch a scheduled report or search on demand.
Executes the report immediately outside its recurring schedule. Returns execution records containing an execution ID that can be tracked with falcon_search_report_executions and downloaded with falcon_download_report_execution when complete.
Example prompts:
- “Run scheduled report abc123 now”
falcon_search_report_executions
Section titled “falcon_search_report_executions”Required scopes: Scheduled Reports:read
Search for report/search execution history.
Use this to find executions by status, report ID, or completion date. Consult falcon://scheduled-reports/executions/search/fql-guide before constructing filter expressions. Returns full execution details including status and timestamps.
Example prompts:
- “Show me completed executions for report abc123”
falcon_search_scheduled_reports
Section titled “falcon_search_scheduled_reports”Required scopes: Scheduled Reports:read
Search for scheduled reports and searches in your CrowdStrike environment.
Use this to find reports by status, type, creator, or creation date. Consult falcon://scheduled-reports/search/fql-guide before constructing filter expressions. Returns full report/search entity details including schedule configuration.
Example prompts:
- “Show me all active scheduled reports”
Resources
Section titled “Resources”falcon://scheduled-reports/search/fql-guide: Contains the guide for thefilterparam of thefalcon_search_scheduled_reportstool.falcon://scheduled-reports/executions/search/fql-guide: Contains the guide for thefilterparam of thefalcon_search_report_executionstool.