What problem does it solve? Re-running a completed security investigation through an AI model every day wastes tokens on a discovery already made. This Skill turns a finished CrowdStrike Falcon MCP investigation into a deterministic, GET-only Python script that calls the Falcon REST API directly and renders a self-contained HTML dashboard, so the same question can be answered on a schedule at zero token cost. ## Core Features & Use Cases - MCP-to-REST translation: Maps falcon_* MCP tools to verified Falcon REST endpoints, transferring FQL filters verbatim and unlocking multi-facet queries the MCP layer hides. - Deterministic, auditable output: Generates scripts with token pagination, denial-aware gap reporting, exit codes for CI gating, and full query provenance recorded in the dashboard. - Cross-cloud resolution patterns: Handles AWS, Azure, and GCP instance-to-image resolution, including VMSS parents, ARM paths, and CSPM two-step entity lookups. - Use Case: After an interactive investigation reveals which vulnerable base images drive the most downstream exposure, crystallize it into a cron-scheduled script that regenerates the ranked dashboard every morning without any model involvement. ## Quick Start Ask the AI to crystallize the investigation we just finished into a repeatable scheduled script with a dashboard.
