CrowdStrike Falcon + Memtro

Only when you ask, and only what it has been granted: change the status of alerts, comment on them, or add or remove an alert tag; assign alerts to a Falcon user, or unassign them; network-contain hosts; lift network containment from hosts; hide hosts (stops their detections being reported); restore hidden hosts; add or remove Falcon grouping tags on hosts; create a case; update a case's name, description, severity or assignee; add tags to a case; remove tags from a case; create a custom indicator of compromise (IOC); delete custom IOCs by id. Every other tool reads, searches or lists. The Connections page labels the tools that act, an administrator grants each one by name to the teams that may use it, and a personal connection acts only after its owner allows it.

A personal connection serves only your own requests. A shared connection serves the organisation: everyone, or only the teams an admin chooses. Admins can always add shared connections; other members need the permission.

Credentials are encrypted at rest. Tool results are cached briefly so agent loops do not repeat identical calls, and the facts the model extracts are saved to your organisation's memory with provenance (system, record and link) so they can be checked and superseded. An hourly sync anchors recently changed CrowdStrike Falcon records into memory as entities.

Client ID and client secret. In the Falcon console, open Support and resources → API clients and keys and create an API client with the read scopes, plus write scopes only for actions you want. Copy the secret, which is shown once.