Kyle Butler
Community@kyle9021
CrowdStrike Falcon MCP skills for cloud vulnerability tracing, container incident triage, security posture briefings, and investigation productionization.
Agent Skills by Kyle Butler
Showing 6 vetted skills indexed across 1 GitHub repositories.
kyle9021falcon-setup
Configures and verifies a read-only CrowdStrike Falcon MCP server connection with credential and guardrail checks.
kyle9021trace-vm-image
Traces critical vulnerabilities on cloud VMs back to their source images and ranks images by blast radius.
kyle9021skill-template
Guides creation of new Falcon security investigation skills with structured SKILL.md playbooks.
kyle9021image-sprawl
Traces a container detection to its image and maps every cluster and cloud running it.
kyle9021posture-brief
Assembles detections, vulnerabilities, sensor health, and threat intelligence into a prioritized security posture summary.
kyle9021crystallize
Converts finished Falcon MCP investigations into standalone Python scripts that render HTML dashboards.
Frequently Asked Questions About Kyle Butler
FAQPage SchemaWhat tasks can I accomplish with kyle9021's Falcon skills?▼
You can set up and diagnose the Falcon MCP harness, trace cloud VM vulnerabilities to their boot images across AWS, Azure, and GCP, triage Kubernetes detections by mapping container image exposure, generate prioritized security posture briefings, and convert finished investigations into standalone scheduled scripts with HTML dashboards.
Who are these Falcon skills designed for?▼
They target security operations analysts, cloud security engineers, and incident responders working with CrowdStrike Falcon. Typical users triage container detections, prioritize vulnerability backlogs across multi-cloud fleets, brief leadership on posture, or codify repeatable investigations into reusable playbooks with FQL and safety boundaries.
How do I get started with the Falcon MCP harness?▼
Run the falcon-setup skill first. It creates the credentials file, checks API scopes, explains authentication failures, and verifies security guardrails are live. Use it for first-run setup, when Falcon tools fail or return no data, or to confirm the harness is configured correctly.
What prerequisites do these skills require?▼
You need a CrowdStrike Falcon environment with valid API credentials and appropriate scopes, plus the Falcon MCP harness configured via falcon-setup. Cloud visibility features require Falcon coverage across AWS, Azure, or GCP workloads, and container triage requires Kubernetes clusters reporting detections.
Can I turn an investigation into a repeatable scheduled report?▼
Yes. The crystallize skill converts a finished MCP investigation into a standalone script calling the Falcon API directly, with no model, tokens, or MCP server, and renders an HTML dashboard. Use it to schedule recurring runs such as a daily morning posture brief.