CrowdStrike Real Time Response, Fusion and the Falcon API: Automation Explained

CrowdStrike gives you five ways to automate the Falcon platform, and the documentation sorts them by product rather than by the job you're trying to do. This guide maps Real Time Response, Fusion SOAR, the Falcon API, Falcon Foundry and Falcon Data Replicator to the work each one is built for. It covers the limits, roles and licences you'll hit in the first week, with every figure dated November 2026.

TL;DR

• The short answer. RTR runs commands on hosts, Fusion SOAR chains actions on events, the API lets your own code drive Falcon, Foundry builds apps inside the console, and FDR exports raw telemetry.
• Access. Every API call uses an OAuth2 client with read or write scopes and a token that lasts 30 minutes.
• Limits. Rate limits are pooled per API client, so give each heavy script its own client.
• Licensing. RTR and Fusion ride on the Enterprise bundle; Foundry and FDR are quoted separately.
• Fit. Falcon automation is built for security response; routine IT scripting still lives most naturally in an RMM.

The Five Automation Surfaces at a Glance

Each surface answers a different question. RTR asks "what is on this host right now?" Fusion asks "what should happen when this event fires?" The API asks "how does my own tool talk to Falcon?" Foundry asks "can this live inside the console?" FDR asks "where does the raw data go?"

Real Time Response: A Shell on Every Host

Real Time Response, RTR in every forum thread, opens a remote session on any host the Falcon sensor can reach. No VPN, no RDP, no site visit. You list processes, read registry keys, pull files, kill a process or run a script, from the console or through the API. Our CrowdStrike EDR guide covers how RTR fits into investigation; this section covers how to automate it.

Access comes in three tiers. Read Only Analyst runs reconnaissance commands such as ls, ps, cat, filehash and reg. Active Responder adds commands that change the host and pull files, such as get, cp, rm and mkdir. RTR Administrator adds put, run and custom scripts, which is where scripted automation lives. A separate response policy decides whether put, put-and-run and script commands work at all on a host group.

Batch sessions are what turn RTR from a console tool into an automation tool. The RealTimeResponse API collection opens sessions on a list of host IDs at once, then runs a read-only, active-responder or admin command across the whole batch. A queue_offline flag holds the command until a sleeping laptop comes back online. Per the RTR API reference, each request waits 30 seconds by default and 5 minutes at most.

File size is the limit practitioners hit next. A July 2026 r/crowdstrike thread on pulling forensic images notes that RTR's get command stops at 4 GB per file. The poster lists what CrowdStrike suggested on calls: map an SMB share, or split the file into 1 GB chunks with a helper script. Both work. Both cost disk space or open ports, which is the trade-off to plan for before an incident, not during one.

Two set-up details catch new teams. The Falcon Administrator role doesn't include RTR by default, so assign the RTR roles explicitly. And scripts stored in the console as cloud files can be called by name from the API, which keeps the script library in one place instead of in every technician's Downloads folder.

Fusion SOAR: Workflows Without Code

Falcon Fusion SOAR is the workflow engine. A workflow starts on a trigger, runs actions, branches on conditions and loops over lists. Triggers are events such as a new detection or incident, a schedule, or a manual run. Actions call CrowdStrike APIs, run Foundry functions, query event data, send notifications or call any external REST API through HTTP actions.

The classic pattern joins Fusion to RTR. A detection fires, the workflow runs an RTR script on the host to collect context, a condition reads the result, and the workflow either contains the host or opens a ticket. No analyst touches it until the ticket arrives. CrowdStrike's own walkthrough shows the build, step by step.

The engine has published ceilings, listed on the Fusion SOAR developer page as of November 2026. Scheduled workflows run at most once an hour. A loop can run 100,000 iterations. An action result can be up to 10 MB, and execution logs stay for 90 days. The hourly floor matters most: anything that needs to run every five minutes belongs in a trigger, not a schedule.

The product is moving fast. CrowdStrike now markets Charlotte Agentic SOAR on top of Fusion, where a natural-language request becomes a draft workflow and AI agents take steps inside it. Our Charlotte AI review covers what the agent layer does and how it's billed. The content library of prebuilt playbooks and third-party actions is covered in our Marketplace and integrations guide.

The Falcon API: Clients, Scopes and Rate Limits

The Falcon API is a REST API with OAuth2 authentication. You create an API client in the console, pick its scopes, and get a client ID and secret. Each scope is a read or write permission on one service collection, such as Hosts: READ or Real time response: WRITE. The client exchanges its secret for a bearer token that lasts 30 minutes.

The surface is wide. CrowdStrike's developer center lists 140 service collections in November 2026, from Hosts and Alerts to IT Automation and Flight Control. Your tenant lives in one cloud region, US-1, US-2, EU-1 or US-GOV-1, and the base URL has to match it. MSPs on Flight Control pass a member CID with each call to act inside one client's tenant, which our CrowdStrike for MSPs guide explains in context.

Rate limits are the part to design for. CrowdStrike doesn't publish one table of limits per endpoint. Every response carries X-Ratelimit-Limit and X-Ratelimit-Remaining headers, and the sample response in the FalconPy documentation shows a limit of 6,000. The pool belongs to the API client, so every script and integration sharing one client ID shares one budget. A Fusion workflow polling hard can starve a nightly report that uses the same credentials.

Nobody writes raw HTTP for long. CrowdStrike maintains SDKs in six languages: FalconPy for Python at version 1.6.6, PSFalcon for PowerShell at 2.2.9, plus Go, TypeScript, Rust and Ruby. FalconPy and PSFalcon have about 520 and 490 GitHub stars respectively as of November 2026. PSFalcon turns up in r/crowdstrike answers again and again, because one cmdlet, Invoke-FalconRtr, runs an RTR command across a list of hosts.

One migration catches older scripts. The Detects API, which many "crowdstrike alerts" scripts were written against, was decommissioned on 30 September 2025, per the Detects collection notice. The Alerts collection replaces it. If a script that pulled detections into a ticket queue went quiet last autumn, that's the first place to look.

The newest way in is Falcon MCP, an open-source server that connects AI assistants to Falcon through the Model Context Protocol. Version 0.20.2 shipped on 3 November 2026 with more than 25 modules, from detections and hosts to Spotlight and Fusion. Its RTR module runs read-only commands only and works only when you host the server yourself, which is a sensible default for anything an AI model can call.

Falcon Foundry: Apps Inside the Console

Falcon Foundry is CrowdStrike's low-code platform for building apps that run inside the Falcon console. An app can bundle serverless functions in Python or Go, API integrations, data collections, saved queries, RTR scripts, Fusion workflow templates, dashboards and UI panels that appear on detection or host pages. CrowdStrike hosts it all, so there is no server to run.

Foundry makes sense when the same enrichment or response step keeps getting rebuilt. A function that looks up a host's owner in your CMDB, a panel that shows it on every detection, and a workflow that pages the owner can ship as one app. It needs a separate Foundry entitlement, per the Foundry developer guide, plus the Falcon Administrator or Foundry App Developer role.

FDR and Event Streams: Getting Raw Data Out

Falcon Data Replicator, FDR, copies raw sensor events out of Falcon into an AWS S3 bucket. New batches arrive as gzipped JSON files, and an SQS queue announces each one, so a collector knows what to fetch. CrowdStrike creates the bucket and queue; you get the credentials from the console. FDR is a separate paid subscription, and the data volume is large, because it is the full event stream rather than detections.

Teams use FDR to feed a data lake or a SIEM they already run, or to keep telemetry longer than the console holds it. CrowdStrike publishes an open-source FDR client on GitHub that writes to local disk or another S3 bucket. If you only need detections and audit events in another tool, the Event Streams API is lighter: it streams alerts and console activity without the raw process telemetry.

What IT Teams Automate With It

Admins don't stop at security. In an August 2025 r/crowdstrike thread, an admin shared PSFalcon one-liners that pull Windows update history from many hosts at once, force-install a named KB and run winget updates through an RTR cloud script. The poster added "I know most people use an RMM for this", and the replies agreed while sharing their own script libraries.

CrowdStrike's answer for that kind of work is Falcon for IT, which has its own IT Automation API collection. Tasks, task groups, scheduled tasks and live osquery-based queries all run through it, on the same sensor and the same API client model. Our Falcon for IT review covers what the module does on its own terms.

The split that works is by urgency. Falcon's automation is strongest when a security event needs a response in seconds: contain, collect, kill, enrich. Routine IT work wants per-client schedules, a maintained script library, maintenance windows and reports with a client's name on them. That is RMM territory. An open RMM such as OpenFrame handles the scheduled scripting, patching and reporting, and Falcon's API feeds detections into the same ticket queue. Flamingo builds OpenFrame, which competes with some of the tools covered here. It costs $1 per device a month with 10 million AI tokens included, per the OpenFrame pricing page.

What It Costs to Automate Falcon

RTR rides on endpoint detection and response, so the cheapest self-serve route to it is Falcon Enterprise. That bundle lists at $184.99 per device a year on CrowdStrike's pricing page, read on 9 November 2026, and includes EDR, threat hunting, IT Hygiene and Next-Gen SIEM. Go and Pro don't include EDR, so they don't include RTR either. Our CrowdStrike pricing guide breaks down every bundle and quoted module.

The other pieces sit outside the public price list. Fusion launched in October 2021 as free for Falcon Prevent and Insight customers, per CrowdStrike's launch announcement; confirm that the current Agentic SOAR features are covered by your licence. Foundry and FDR are quoted. The public price list carries no separate line for API access.

Who Gets the Most From Falcon Automation

Security teams on Enterprise get the most for the least extra spend: RTR, Fusion and the API are already in the bundle, and a detection-to-containment workflow takes an afternoon. MSPs get the same, multiplied across tenants through Flight Control and the member CID, provided each client's scopes stay tight. Teams that want custom panels or raw telemetry should price Foundry and FDR before they plan around them.

Start small. Create one API client per workload, name it after the job, and give it only the scopes that job needs. Build one Fusion workflow that collects context on high-severity detections. Then decide whether the routine IT scripts you are tempted to move into RTR would be better off in the RMM that already schedules and reports on them.

Keywords: crowdstrike api, crowdstrike falcon api, crowdstrike rtr, crowdstrike real time response, falcon fusion, crowdstrike fusion soar, crowdstrike fusion, falcon foundry, crowdstrike foundry, crowdstrike fdr, falcon fdr, crowdstrike alerts, crowdstrike falcon console, crowdstrike dashboard, falconpy, psfalcon, falcon data replicator