All 15 major modules of the CrowdStrike Falcon platform, mapped honestly — 7 with real, working code built against the official FalconPy SDK (verified class and method names, dry-run execution since no paid tenant is available to test against live), the rest documented for a complete platform picture. Built specifically to demonstrate end-to-end Falcon fluency across detection, response, vulnerability management, identity, cloud security, orchestration, and AI-assisted investigation — not just EDR alone.
This is the third matrix-pattern project in this profile, alongside SIEM-Tool-Matrix and SOAR-Playbook-Matrix — same discipline: real code kept clearly separate from researched reference material, everywhere it appears.
| Module | What it does | Real FalconPy backing |
|---|---|---|
| Hosts / Detections | Device lookup, containment actions, detection triage | Hosts.GetDeviceDetails, Hosts.PerformActionV2 (action_name=contain), Detects.QueryDetects |
| Real-Time Response (RTR) | Hands-on-keyboard command execution at scale, correctly split into read-only vs. privileged tiers — matching Falcon's actual access-control model | RealTimeResponse.BatchCmd (read-only), BatchActiveResponderCmd (privileged) |
| Spotlight | Vulnerability prioritization using risk logic that outranks raw CVSS when exploit-availability + asset-criticality signals are present | SpotlightVulnerabilities query + custom risk scoring |
| Identity Protection | Simulates 4 documented ITDR scenarios (credential abuse, lateral movement, risky logins), each returning a non-destructive recommended action | IdentityProtection GraphQL query shape |
| Cloud Security | CSPM-style posture scan returning findings by severity | CSPMRegistration / CloudSecurity* classes |
| Fusion SOAR | 2 real playbooks with actual branching logic (severity-based containment, priority-based escalation) — reuses the CACAO execution engine from SOAR-Playbook-Matrix | Playbook JSON + standalone executor |
| Next-Gen SIEM / LogScale | Bidirectional bridge: converts real Falcon detections into Sigma format and back — reuses the verified pysigma-backend-crowdstrike LogScale backend from Detection-as-Code |
Cross-project reuse, not reinvented |
Every method name above was checked against the installed falconpy package directly (dir(Hosts), dir(Detects), etc.) before being used — not written from memory or guessed.
CrowdStrike's real Charlotte AI and Falcon MCP server let analysts query the platform in natural language. This project includes a small, honestly-scoped analog: describe what you need in plain English, an LLM decides which Falcon module and API method would answer it, and flags anything that would require destructive-action approval before it could run. Same prompt-injection defense pattern as AI-SOC-Copilot — the analyst's request is treated as untrusted input, never as an instruction that can override the system prompt.
Stated plainly: this is not the real Charlotte AI or Falcon MCP — it's a scoped demonstration of the same query-planning concept, clearly labeled as such everywhere it appears.
Falcon Insight XDR, Prevent, OverWatch, Complete, Spotlight, Discover, Identity Protection, Cloud Security, RTR, Fusion SOAR, Next-Gen SIEM/LogScale, Intelligence, Charlotte AI, Falcon MCP, and Falcon Foundry — architecture and purpose for every one, researched from CrowdStrike's own 2026 platform documentation. The Built vs. Documented distinction is marked in the UI itself, not just this README.
git clone https://github.com/Aditya-Sec/Falcon-Platform-Matrix.git
cd Falcon-Platform-Matrix
pip install -r requirements.txt
cp .env.example .env
python app.py
# open http://127.0.0.1:5000Works out of the box in dry-run/mock mode — no Falcon tenant or API key needed to explore every module. Set FALCON_CLIENT_ID/FALCON_CLIENT_SECRET in .env if you have a Falcon tenant to test against for real; set LLM_PROVIDER=anthropic (or openai) for real copilot generation instead of mock mode.
python tests/test_platform.py44 checks: real FalconPy method verification, RTR privilege-tier routing, risk-based Spotlight prioritization, all 4 identity scenarios, cloud posture findings, Falcon-to-Sigma conversion (with real SPL output verified), both Fusion SOAR playbooks' branching logic, copilot routing and approval-gating, full 15-module knowledge base integrity, and every route.
Proves: genuine breadth across the Falcon platform beyond just endpoint detection — you understand RTR's privilege model, how Spotlight's risk scoring differs from raw CVSS, what Identity Protection and Cloud Security actually do, how Fusion SOAR playbooks branch, and you can build an AI query layer with real safety boundaries, all grounded in the real SDK rather than guessed.
Doesn't prove: production administration of a live Falcon tenant. No paid tenant was available to test against — every operation here is a verified-accurate dry-run, and that's stated on every page it applies to, not just buried in this README.
MIT — see LICENSE.