docs(crowdstrike): document the API scopes each tool group needs - #464
Open
leet-c1 wants to merge 2 commits into
Open
docs(crowdstrike): document the API scopes each tool group needs#464leet-c1 wants to merge 2 commits into
leet-c1 wants to merge 2 commits into
Conversation
The page told admins to grant "Read access to Detections, Incidents, and Hosts", which does not map to the tools C1 actually exposes and leaves the most confusing case undocumented. Adds a Choose API scopes section mapping each tool group to its Falcon API scope, covering hosts, alerts, incidents, indicators of compromise, device control policies, Spotlight vulnerabilities, Falcon Intelligence, Zero Trust Assessment, Falcon Discover, and cloud misconfigurations. Calls out the trap behind a real support question: the cloud misconfiguration tools need CSPM registration, not Cloud Security API Detections. The two scopes authorize different Falcon APIs, so an admin who enables the latter sees 403s on those tools while everything else works. Also documents the write scopes the response tools need (Hosts and IOC Manager), since the previous text implied Read was sufficient for the whole surface, and notes that a read-only API client is a deliberate way to keep response actions unavailable. Scope edits apply on the next token request, so admins do not need to re-register the server.
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
|
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this fixes
The CrowdStrike MCP server page told admins to grant "Read access to Detections, Incidents, and Hosts". That does not map to the tools the server actually exposes, and it leaves the most confusing case undocumented.
Changes
A
Choose API scopessection mapping each tool group to its Falcon API scope — hosts, alerts, incidents, indicators of compromise, device control policies, Spotlight vulnerabilities, Falcon Intelligence, Zero Trust Assessment, Falcon Discover, and cloud misconfigurations (IOM).The CSPM registration trap, called out in a
<Warning>. This comes from a real support question: an admin enabled Cloud Security API Detections, reasonably assuming it covered cloud misconfiguration tools, and got 403s while every other tool worked. The two scopes authorize different Falcon APIs, and the one the tools need is CSPM registration. Documented so the next admin does not lose time to it.The write scopes, which the page previously implied were unnecessary. Host containment and IOC creation need Write on Hosts and IOC Manager. Also states the useful inverse: a read-only API client is a deliberate way to keep response actions unavailable.
Scope-change timing — edits apply on the next token request, so admins do not need to re-register the server or reconnect.
Notes for review
REVIEWER NOTEsince I could not verify each label against the console UI. The mapping itself is derived from the API each tool calls, so the groupings are right even if a label needs a word changed.npx mint broken-linksreports 12 broken links in 5 files, all pre-existing (baton/bamboohr.mdximages,/docs-prefixed links inbaton/sendgrid.mdx,baton/twilio-segment-v2.mdxandindex.mdx, and theconnector-template.mdxplaceholder). None are in this page, and the crawl completes, so nothing here is a parse blocker.docs.json, so the nav is unchanged.#choose-api-scopesresolve.