Connect CrowdStrike to ChatGPT: Hunt Threats and Run Response Tools

If you need to connect CrowdStrike to ChatGPT to automate threat hunting, triage alerts, or execute Real-Time Response (RTR) commands, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between ChatGPT's native tool-calling capabilities and CrowdStrike's complex REST APIs.

If your team uses Claude, check out our guide on connecting CrowdStrike to Claude or explore our broader architectural overview on connecting CrowdStrike to AI Agents.

Giving a Large Language Model (LLM) read and write access to a mission-critical endpoint detection and response (EDR) platform is a massive engineering challenge. You have to handle Falcon Query Language (FQL) mapping, stateful session management for Real-Time Response scripts, and incredibly strict RBAC scopes. You can either build and maintain this infrastructure yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL.

This guide breaks down exactly how to use Truto to generate a secure MCP server for CrowdStrike, connect it natively to ChatGPT, and execute complex SOC workflows using natural language.

The Engineering Reality of the CrowdStrike API

While the open MCP standard provides a predictable way for models to discover tools, implementing it against CrowdStrike's highly specialized API is exceptionally painful. If you decide to build a custom CrowdStrike MCP server, you own the entire API lifecycle. Here are the specific integration challenges that break standard CRUD assumptions when working with the Falcon platform:

The Falcon Query Language (FQL) Barrier

CrowdStrike relies heavily on FQL for searching hosts, alerts, and incidents. An endpoint like GET /alerts/queries/alerts/v1 does not accept standard REST query parameters like ?status=new. Instead, it requires URL-encoded FQL strings like ?filter=status:'new'+severity:'High'. If your MCP server doesn't explicitly instruct the LLM on how to format FQL strings via the JSON Schema descriptions, ChatGPT will hallucinate standard REST parameters, resulting in HTTP 400 Bad Request errors. Mapping FQL syntax rules into prompt-friendly tool schemas is tedious.

Stateful Real-Time Response (RTR) Sessions

Executing a script on a compromised host via CrowdStrike is not a single API call. RTR is highly stateful. To run a command, your AI agent must:

1. Call batch_init_sessions to wake the host and establish a session.
2. Call execute_admin_command with the active session ID.
3. Poll check_admin_command_status until the execution completes.
4. Call delete_session to clean up.

A custom MCP server must either wrap this entire state machine into a single monolithic tool (which is brittle and times out), or expose the raw primitives and rely on the LLM to successfully navigate the state machine across multiple sequential tool calls.

Complex Composite IDs

Unlike SaaS APIs that use simple UUIDs, CrowdStrike often relies on composite IDs for routing requests (especially in alerts and detections). An alert ID might contain the customer ID (CID), the device ID (AID), and a localized timestamp string. If an LLM parses or modifies these strings, subsequent API calls will fail. You must strictly instruct the LLM to pass composite IDs exactly as they were returned.

Step 1: Generate a CrowdStrike MCP Server

Instead of hardcoding tool definitions and dealing with FQL schema mapping, you can use Truto to dynamically generate a CrowdStrike MCP server. The server derives its tool definitions directly from CrowdStrike's API specifications, exposing only the endpoints that have verified documentation.

You can generate the MCP server in two ways: via the Truto dashboard or programmatically via the API.

Method 1: Via the Truto UI

1. Log into your Truto account and navigate to Integrated Accounts.
2. Select your connected CrowdStrike account.
3. Click the MCP Servers tab.
4. Click Create MCP Server.
5. Select your desired configuration (e.g., name, allowed methods like read, and specific tags to limit scope).
6. Copy the generated MCP server URL (e.g., https://api.truto.one/mcp/a1b2c3d4...). Treat this URL as a sensitive credential.

Method 2: Via the Truto API

If you are provisioning AI agents programmatically, you can generate the MCP server via a single API call. This scopes the server to a specific CrowdStrike tenant and applies granular access filters.

curl -X POST https://api.truto.one/integrated-account/$INTEGRATED_ACCOUNT_ID/mcp \
  -H "Authorization: Bearer $TRUTO_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "CrowdStrike SOC Assistant",
    "config": {
      "methods": ["read", "write", "custom"],
      "tags": ["alerts", "hosts", "incident_management", "rtr"]
    },
    "expires_at": "2026-12-31T23:59:59Z"
  }'

The API validates that tools exist for your requested filters, generates a secure cryptographic token, and returns the MCP server URL.

Step 2: Connect the MCP Server to ChatGPT

Once you have the Truto MCP URL, you can connect it to ChatGPT. This allows the model to immediately discover the available CrowdStrike tools and their required FQL parameter schemas.

Method A: Via the ChatGPT UI

If you are using ChatGPT Pro, Plus, Business, Enterprise, or Education accounts with Developer Mode enabled:

1. In ChatGPT, navigate to Settings -> Apps -> Advanced settings.
2. Ensure Developer mode is toggled on.
3. Under MCP servers / Custom connectors, click Add new server.
4. Name: "CrowdStrike SecOps"
5. Server URL: Paste the Truto MCP URL.
6. Click Save.

ChatGPT will immediately ping the server, run the initialize and tools/list JSON-RPC handshake, and display the connected CrowdStrike tools in your workspace.

Method B: Via Manual Config File (Claude Desktop / Local Agents)

If you are testing locally or using an SSE-compatible framework, you can connect the server via a configuration file. Because Truto MCP servers speak JSON-RPC over HTTP POST, you use the standard SSE transport wrapper.

Create or update your MCP configuration file (e.g., mcp-config.json):

{
  "mcpServers": {
    "crowdstrike-truto": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "--url",
        "https://api.truto.one/mcp/a1b2c3d4e5f6..."
      ]
    }
  }
}

CrowdStrike Hero Tools for ChatGPT

Truto automatically generates hundreds of tools for CrowdStrike. Below are the highest-leverage "hero" tools your agent will use to automate security operations.

Search Alerts via FQL

Tool: crowd_strike_alerts_post_combined_alerts_v_1

This is the primary entry point for incident triage. It allows ChatGPT to search for active alerts using Falcon Query Language. The LLM constructs the FQL string based on the user's natural language request (e.g., mapping "critical alerts from today" to severity:'Critical'+created_timestamp:>'2026-10-01T00:00:00Z').

"Find all high-severity alerts related to PowerShell execution that occurred in the last 24 hours. Summarize the aggregate threat patterns."

Identify and Query Hosts

Tool: crowd_strike_hosts_combined_devices_by_filter

Before taking action on a host, the agent must resolve the hostname or IP address to an Agent ID (AID). This tool executes an FQL search against the host inventory to retrieve system details, OS version, and network configuration.

"I need the CrowdStrike Agent ID (AID) and current IP address for the machine with hostname DESKTOP-ENG-042."

Execute Real-Time Response Commands

Tool: crowd_strike_real_time_response_admin_rtr_execute_admin_command

This tool allows the agent to run administrative commands (like runscript, put, or kill) directly on a host. It requires a valid session_id obtained via the batch_init_sessions tool.

"Execute the 'isolate-host' script on Agent ID 123456789. The active RTR session ID is session-987. Wait for the command to finish and report the status."

Threat Intelligence Lookups

Tool: crowd_strike_intel_query_intel_indicator_entities

ChatGPT can investigate suspicious hashes, IPs, or domains by checking them against CrowdStrike's global threat intelligence database to retrieve context, actor attribution, and malware family metadata.

"Check this SHA256 hash against CrowdStrike Threat Intel. If it's known malware, tell me which APT group usually distributes it and list the associated MITRE techniques."

Create Incident Management Cases

Tool: crowd_strike_case_management_entities_cases_put_v_2

When a threat is confirmed, the agent can programmatically open a case in Falcon Case Management, assigning it to a specific SOC group and attaching the relevant alert evidence.

"Create a new High severity case named 'Suspicious PowerShell Activity on ENG-042'. Assign it to the Tier 2 Escalation group and attach alert ID ABC-123 as evidence."

Manage Network Containment

Tool: network_containment_update_containment_allowlist_rules

If a host is isolated, the agent can modify network containment allowlists to ensure critical IT management tools (like VPN or patching servers) can still communicate with the quarantined machine.

"Update the network containment allowlist to permit outbound traffic on port 443 to our IT management IP range 192.168.50.0/24."

To view the complete inventory of available API operations and their exact JSON Schema definitions, refer to the CrowdStrike integration page.

Workflows in Action

When you connect CrowdStrike to ChatGPT via MCP, the model handles the sequence of API calls required to complete complex objectives. Here is how specific SOC personas leverage the integration in the real world.

1. The Autonomous Threat Hunter

When a SOC analyst needs to quickly investigate a spike in alerts, they can prompt ChatGPT to handle the FQL querying and data synthesis.

"Search for all New alerts related to 'credential dumping' in the last 12 hours. Extract the hostnames involved, query their system details, and give me a summary of the affected OS versions."

Tool Execution Flow:

1. crowd_strike_alerts_post_combined_alerts_v_1 (Executes an FQL search for status:'new'+tactic:'Credential Access').
2. crowd_strike_alerts_post_entities_alerts_v_2 (Fetches the full alert details for the returned IDs).
3. crowd_strike_hosts_get_device_details_v_2 (Looks up the AIDs found in the alerts to get OS and network details).

The analyst receives a clean summary of the credential dumping alerts, categorized by operating system, without writing a single line of FQL.

2. The Automated Incident Responder

If a confirmed threat requires immediate containment, ChatGPT can navigate the complex RTR state machine to isolate the host and extract forensic evidence.

"Host WEB-PROD-01 is compromised. Find its Agent ID, start an RTR session, run the 'collect-syslogs' script, and then create a high-severity case with the results."

sequenceDiagram
    participant ChatGPT as ChatGPT
    participant MCP as Truto MCP Server
    participant CS as CrowdStrike API

    ChatGPT->>MCP: Call hosts_combined_devices_by_filter (Find WEB-PROD-01)
    MCP->>CS: GET /devices/queries/devices-scroll/v1
    CS-->>ChatGPT: Return AID
    ChatGPT->>MCP: Call rtr_init_session (AID)
    MCP->>CS: POST /real-time-response/entities/sessions/v1
    CS-->>ChatGPT: Return Session ID
    ChatGPT->>MCP: Call rtr_execute_admin_command (runscript collect-syslogs)
    MCP->>CS: POST /real-time-response/entities/admin-command/v1
    CS-->>ChatGPT: Return Cloud Request ID
    ChatGPT->>MCP: Call cases_put_v_2 (Create Case)
    MCP->>CS: POST /case-management/entities/cases/v2
    CS-->>ChatGPT: Return Case ID

The LLM handles the sequential dependencies: extracting the AID to initialize the session, extracting the Session ID to run the command, and extracting the Cloud Request ID to check the status.

Security and Access Control

Giving an AI agent access to CrowdStrike requires strict governance. Truto MCP servers enforce boundaries at the infrastructure layer, ensuring the LLM cannot exceed its granted permissions.

• Method Filtering: You can restrict an MCP server to strictly read-only operations by passing methods: ["read"] during server creation. This prevents ChatGPT from executing RTR commands or modifying policies, while still allowing it to hunt threats and analyze alerts.
• Tag Filtering: Limit the server to specific resource tags. For example, tags: ["alerts", "intel"] ensures the agent only sees tools related to threat intelligence and alert querying, hiding host management entirely.
• Time-to-Live (TTL): Temporary contractors or incident response teams can be given short-lived access by setting the expires_at field. Once the timestamp passes, the MCP server is automatically destroyed.
• Secondary Authentication: By setting require_api_token_auth: true, you force the MCP client to pass a valid Truto API token in the Authorization header. This ensures that even if the MCP URL leaks, unauthorized users cannot execute CrowdStrike tools.

Before orchestrating high-volume threat hunting loops, it is critical to understand how API limits are handled. Truto does not retry, throttle, or apply backoff on rate limit errors. When the upstream CrowdStrike API returns an HTTP 429 Too Many Requests, Truto passes that error directly to the caller. Truto normalizes the upstream rate limit information into standardized IETF headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset). The caller (your AI agent framework or ChatGPT client) is entirely responsible for reading these headers and implementing its own retry and backoff logic.

Moving from Dashboards to Agentic SOCs

Connecting CrowdStrike to ChatGPT via MCP transforms how security teams interact with telemetry. Instead of clicking through dashboards and manually constructing complex FQL strings, analysts can use natural language to traverse the entire Falcon platform — from initial alert discovery to active host containment.

By leveraging Truto's dynamically generated MCP servers, you eliminate the need to write and maintain custom schema parsers, OAuth token refresh workers, and JSON-RPC routing logic. You get secure, fully typed AI tools that stay perfectly in sync with CrowdStrike's API surface.