Query CrowdStrike Falcon API for endpoint detections

Steps

1. Create an API client in the Falcon console under API Clients and Keys with the Detections: Read and Hosts: Read scopes; note the client_id and client_secret (YOUR_SECRET)
2. Obtain an OAuth2 access token by POSTing to the /oauth2/token endpoint with client_id and client_secret as form fields; tokens expire after a short period so cache and refresh them
3. Search for detection IDs with GET /detects/queries/detects/v1 using the filter parameter (FQL — Falcon Query Language) to narrow by status, severity, or time range (e.g., created_timestamp:>='2024-01-01T00:00:00Z')
4. Retrieve full detection details by POSTing the list of detection IDs to /detects/entities/summaries/v1 with a JSON body; each detection summary includes device, tactic, technique, severity, and status fields
5. Update detection status (true_positive, false_positive, ignored, or in_progress) with PATCH /detects/entities/detects/v1 providing the detection id and updated fields to reflect analyst triage
6. Paginate ID search results using the offset parameter; the response includes total count so you can calculate the number of pages needed