ast crowdstrike virustotal

Manually triaging security alerts across disconnected consoles wastes critical response time. This skill provides a unified command-line and MCP interface to investigate threats in CrowdStrike Falcon and verify indicators with VirusTotal reputation data.

What it does

• Falcon Investigation reads host metadata, detection details, telemetry hunts via LogScale, and network events.
• Threat Intelligence performs reputation lookups for hashes, IPs, domains, and URLs using VirusTotal.
• Incident Response executes containment, Real Time Response (RTR) commands, and scan triggers on Falcon-managed endpoints.
• Policy Management modifies exclusions, IOC blocks, host groups, and prevention policies.
• Credential Safety manages API keys via system keychain or local environment files without exposing secrets in chat.

How it works

1. Discovery: Use cs-search to find affected hosts or alerts and vt-search to verify if indicators are known malicious.
2. Proposal: Describe the necessary response action, such as containing a host or blocking a hash, to the user for approval.
3. Execution: Run the cs-edit command or MCP tool once the user provides explicit consent.
4. Verification: Re-read the Falcon state to confirm the change was successfully applied and report the final status.

Frameworks & tools

Built for Python 3.12+ environments. It utilizes the CrowdStrike Falcon API and VirusTotal API via dedicated CLI tools (cs-search, cs-edit, vt-search) and a secure MCP server (sectools-mcp).

Why this beats prompting it yourself

Writing reliable API scripts for security platforms requires complex authentication and error handling for empty results. This skill enforces a strict safety model with write gates and dry-run tokens, ensuring you never accidentally contain a production server or leak an API key in a prompt.

Use cases

• Investigate a suspicious process hash found on an endpoint against VirusTotal.
• Sweep an entire Falcon environment for a specific IP or domain indicator.
• Contain an infected workstation and retrieve its sensor uninstall secret.
• Update device-control or prevention policies across specific host groups.

Known limitations

Does not support file/URL uploads or detonations in VirusTotal. It cannot access Microsoft Defender alerts or Falcon Flight Control child-CID switching. Required tools must be installed via the provided shell script.