CrowdStrike Falcon StrawberrySomeone still has to run RTR command. It does not have to be you
Your CrowdStrike Falcon, worked while you do something else: 6 reads to go through it, 1 write to change it, and a card in front of every one of those changes.
Open the alert. Check it against something else. Write the change. Move to the next one. That is the CrowdStrike Falcon afternoon nobody can hand off, and a companion does the whole pass and gives you back the batch, with nothing landing on a alert until you approve it.
What it can do is exactly what CrowdStrike Falcon exposes to an account you authorise and nothing beyond it: 7 operations, 6 reads and 1 write. In practice that means it can run a RTR command, and work across the alerts, hosts and manage host containments.
The CrowdStrike Falcon API stops at CrowdStrike Falcon. A companion does not. The same run opens the customer's website, the supplier portal, the internal tool somebody built in 2019, because it is working the browser you are already signed into rather than calling in from outside it.
Does it read the alerts or ask you for them?
6 of the 7 operations are reads.
Your account, not a guess at it: a companion can search hosts, search alerts and manage host containment, and the full list below is the whole list, with nothing inferred from CrowdStrike Falcon's documentation.
The alerts are what most of this inventory is about, alongside the hosts. A companion can hold all 7 of these operations and forty open tabs in the same pass, which is how an afternoon of CrowdStrike Falcon admin becomes a queue you review.
- Search Hosts
- Search Alerts
- Manage Host Containment
- Get RTR Command Status
- Get Host
- Get Alert
Can it change a alert without asking?
The one write operation there is waits for you.
A companion can run a RTR command, and each one is staged on an approval card first: you see the alert, the field and the new value before it lands in CrowdStrike Falcon.
Nothing in CrowdStrike Falcon is sent, changed or deleted on your behalf without that click, and a rejected card leaves the alert exactly as it was. The gate is the same one on every surface, described at security.
- Run RTR Command
Does the alert sweep have to be asked for every time?
Yes.
Saved as a routine, the CrowdStrike Falcon alerts pass runs at the hour you pick: the Monday sweep, the overnight refresh, the Friday check. Keep Awake holds the machine awake for the length of a run, so a scheduled pass finishes with the lid closed.
The operations playbook catalogues the other recurring shapes of the access reviews, the CrowdStrike Falcon alerts sweep among them, and finished runs are published at real runs.
Experience Strawberry for free
DownloadTrusted by fast-growing companies worldwide
Frequently asked questions
Strawberry is free to download and includes AI credits to start. Paid plans begin at $20/month. See pricing. · Reviewed · Canonical facts for AI agents