CrowdStrike Falcon + Stream Deck
Security · 2 triggers · 7 actions
Cloud-native cybersecurity platform Add CrowdStrike Falcon to your Stream Deck workflows with guided setup for the connection details it needs.
- No code
- Free tier
- Key press or app-event trigger
- Pairs with OBS & Elgato tools
- OAuth & keys handled in-builder
Popular ways to use CrowdStrike Falcon
Add CrowdStrike Falcon to a workflow and pair it with a Stream Deck button to run it in one press — handy for security tasks. Combine it with OBS, your Elgato tools, or any other app you connect to build a routine that fits how you work.
Browse all templatesTriggers & actions
Events that start your workflow automatically.
New Alert
Emit new event for each CrowdStrike Falcon alert created since the last run. Polls GET /alerts/queries/alerts/v1 (GetQueriesAlertsV2) for alert IDs newer than the stored created_timestamp checkpoint, then hydrates them via POST /alerts/entities/alerts/v1 (PostEntitiesAlertsV2, body field composite_ids). Use the optional FQL filter to narrow to specific alert products (e.g. legacy endpoint detections, now surfaced through the Alerts API). View docs.
Host Status Changed
Emit new event for each host matching a user-supplied FQL filter that has not been emitted in a prior run. Polls GET /devices/combined/devices/v1 (returns full device records including status/containment status and sensor-health fields) and deduplicates on a deviceId-modified_timestamp composite so only genuinely changed hosts emit. Covers both sensor-health and containment-status scenarios via the filter prop. View docs.
About CrowdStrike Falcon
Cloud-native cybersecurity platform
Security
How to connect
1
Sign up for free
Create your Conductor Deck account: no credit card required.
2
Connect CrowdStrike Falcon
Follow the setup prompts for CrowdStrike Falcon. Conductor Deck handles the app authorization or required connection details inside the workflow builder.
3
Build a workflow
Add a CrowdStrike Falcon action to your visual workflow canvas. Configure the options you need, then connect it to other steps.
4
Run it from a key, or let events fire it
Sync your workflow to a Stream Deck button, or skip the button: CrowdStrike Falcon triggers can start it automatically when events happen.
Frequently asked questions
- How do I connect CrowdStrike Falcon?
- Sign up for Conductor Deck, then add a CrowdStrike Falcon step to a workflow on the visual canvas. The builder walks you through the connection it needs — an account authorization or the required keys — right inside the step. No separate setup or code.
- Is it free?
- Yes — Conductor Deck has a free tier you can build and run workflows on, with no credit card required. Paid plans raise the monthly run limits and add advanced features when you need them.
- What's the difference between a trigger and an action?
- A trigger is the event that starts a workflow — for example, a Stream Deck button press or an incoming event from a connected app. An action is a step the workflow performs once it runs. A workflow is one trigger followed by one or more actions.
Automate CrowdStrike Falcon with your Stream Deck
Sign up for free and start building CrowdStrike Falcon workflows in minutes.