What Falcon doesn't ship with, we build into it.

Falcon Foundry is CrowdStrike's development platform: apps that run inside your Falcon console and work with your data — no infrastructure of your own. We build on it, in Python and Go, with a CrowdStrike-certified app in the official App Catalog.

Discuss your Foundry project

Active security incident? 24/7 emergency line +49 89 2000 7683

This is some text inside of a div block.

Foundation

Falcon Foundry — and why you probably already have it.

Foundry is the development platform inside Falcon. Apps run where your analysts already work — with access to Falcon data and APIs, no servers of your own, no second login. If you license Falcon Prevent or Insight XDR, you can run one Foundry app at no extra cost. Few people know that.

Data

Where the app gets its information

Third-party systems connected through their APIs

Custom data collections inside the platform

Queries against your Next-Gen SIEM data

Logic

What the app does with it

Serverless functions in Python or Go

Automations as reusable building blocks

Scripts executed on endpoints

Interface

Where your team sees the result

Extra panels in existing Falcon views

Dedicated pages with their own menu entry

Dashboards on your data

All of it runs inside the Falcon console. No second system, no extra login, no infrastructure anyone has to run and secure — and no data leaving the house.

The proof

Our app is already in your console.

ByteRay CQL Hub is a CrowdStrike-certified Foundry app in the official App Catalog: reviewed, approved and installable by any Falcon customer.

Curated lists into your SIEM — no manual upkeep

Tor exit nodes, generative-AI domains, AWS IP ranges: maintained lists you pick with a toggle and then sync into Next-Gen SIEM automatically every day. Anyone who has kept these up to date by hand knows how often it slips.

Rules that have drifted from their template

A correlation rule created from a CrowdStrike template is a one-time copy — it stays disconnected from the template. When CrowdStrike improves the template later, your rule never hears about it. The Drift Checker compares the two and shows, line by line, what has diverged.

The same detection, running more than once

A template can spawn any number of rules. Sometimes that's intentional; often it's overlooked duplication: the same logic running several times, burning compute and being tuned separately. The Duplicate Checker groups these cases for review.

Foundry › App catalog

ByteRay CQL Hub

Authored by ByteRay GmbH

◉ Certified app

Use case: Threat intelligence
Vendor: ByteRay
Requires: Falcon Next-Gen SIEM

This is how the entry looks in your own Falcon console. Certified means reviewed by CrowdStrike and released to all customers — not self-published.

From client projects

Two questions Falcon couldn't answer before.

Neither app started as a product idea — both came from a concrete blind spot in day-to-day operations. We don't name the clients; we do describe the starting point and the result.

A username is not yet a person.

Starting point

An alert flags a compromised account and gives you a username. Who is behind it, which site the person works at and who their manager is lives in the HR system — not in Falcon. Every triage started with a question to someone who happened to be unavailable.

What we built

A Foundry app that brings HR master data into the Falcon platform and attaches it to the affected identity. The same app continuously reconciles the accounts in Falcon Identity Protection against the active workforce.

What's different now

The context is in the alert before anyone has to ask. And accounts of people who left the company long ago surface on their own — instead of in a twice-a-year list reconciliation.

The attack that happens at your supplier.

Starting point

When a supplier is hit by a ransomware group, its name appears on a leak site — often days before the supplier communicates anything. Whoever finds out, finds out by accident: through the press, through a colleague, sometimes not at all.

What we built

A Foundry app that continuously matches the company's supplier base against the publications of known ransomware groups and raises overlaps as alerts in Falcon.

What's different now

An affected supplier is an alert, not a press clipping. Access can be reviewed and data handovers paused while it still makes a difference.

Our standard

The click builder is fine for the prototype.

Inside the Falcon console you can click apps together — it's well made and enough for many things. But as soon as an app needs its own interface, has to process larger data volumes or reach into external systems, the click path ends. From there we work with the Foundry CLI and write code.

Which permissions does the app get — and which not?

A Foundry app works with permissions on your Falcon data. Scoped too wide, it becomes a risk itself. Scoped too tight, it eventually fails at runtime — in our experience not in testing, but in production.

What happens when the other side doesn't answer for three days?

The moment an app talks to external systems, it inherits their problems: rate limits, maintenance windows, silent format changes. The difference between an app that runs and one that used to run is decided in exactly these cases.

Will the data model still hold in two years?

Custom data collections in the platform are quick to create. The hard part comes afterwards: growing data volumes, changing requirements, a run that breaks halfway and needs to pick up exactly where it stopped.

What does the app do at a thousand times the data volume instead of ten?

Serverless functions have time and memory limits. As long as the test environment is small, you never notice. In a grown production environment you notice immediately — as an outage.

Who maintains this a year from now?

The Falcon platform keeps evolving, and so do your requirements. An app nobody can touch anymore is a legacy system with a fresh coat of paint. That's why documentation and a handover session for your team are part of the project — not of a follow-up quote.

About four weeks

Requirements workshop, architecture, development, testing, handover

Python & Go

Via the Foundry CLI — including custom pages and scripts

Handed over, documented

Your team can run and extend the app on its own afterwards

Scope check

When you need an app — and when a playbook will do.

Level 1

Playbook from a template

Fusion SOAR ships with ready-made workflows you can adapt. For common cases that's enough.

Doable without us

Level 2

Playbook with custom logic

Branches, approvals, scheduling, defined behaviour on failure. No code, but real design work.

Usually done together

Level 3

Custom building block in a playbook

When no existing step does what's needed: a Foundry function that becomes a regular action inside the playbook.

Requires development

Level 4

Full Foundry app

When it's not just a workflow that's missing but a capability: its own interface, its own data, its own analytics — inside the Falcon console.

Requires development

Most requests land at level 2 or 3 — and nobody wins if they're turned into an app project. If you're not sure which level your idea sits on: our Fusion SOAR page (in German) describes the lower two levels in detail.

Common questions

What usually gets clarified before the first call.

What is CrowdStrike Falcon Foundry?

Foundry is the development platform inside the CrowdStrike Falcon platform. It lets you build applications that run directly in the Falcon console — with access to Falcon data and APIs, with their own interface and without servers of your own. ByteRay builds such apps for clients and runs the ByteRay CQL Hub, a CrowdStrike-certified app in the official Foundry App Catalog.

Do we need an extra licence for this?

Customers with Falcon Prevent or Falcon Insight XDR can develop and run one Foundry app at no extra cost. Several apps or a larger footprint require a Foundry entitlement — your CrowdStrike contact can clarify that in minutes. Individual capabilities need additional modules, for example Next-Gen SIEM for queries on SIEM data.

How long does a Foundry project take?

For a clearly scoped app we plan around four weeks — from requirements workshop through architecture and development to testing and handover. Larger projects are cut into stages, so something usable lands in your environment early instead of everything arriving at once at the end.

Who owns the app in the end?

You do. The app runs in your Falcon environment; source code and documentation transfer to you at handover. You don't depend on us to keep developing it — and we build it so that holds true in practice.

When is Foundry the wrong tool?

If a workflow needs automating but no custom interface and no custom data storage, a Fusion SOAR playbook is usually enough: faster to build, easier to maintain, cheaper. And if an application has nothing to do with security, it doesn't belong in the Falcon console. We say so in the first call — even if that means the smaller project.

How do we know you can actually do this?

The fastest check is your own Falcon console: under Foundry › App catalog you'll find the ByteRay CQL Hub, marked as a certified app — reviewed by CrowdStrike and released to all customers, not self-published. Our public query library is also available at cql-hub.com.