Use Falcon for security context and response; use Steward and Logs MCP to reach evidence outside Falcon.

Everest Security is designed to complement CrowdStrike rather than reproduce EDR, SIEM or SOAR. Three published CrowdStrike interfaces are particularly useful.

Falcon MCP

A read-only Falcon MCP backend can give a BrainStorm investigation security context such as detections, hosts and intelligence. Falcon itself continues to authorise those calls according to the API credentials and scopes configured for the Falcon MCP server.

Fusion SOAR

Steward Admin exposes a security REST/OpenAPI surface intended for workflow triggering. A Fusion workflow can submit a detection as investigation context, receive a job id and later retrieve the structured finding.

AIDR

Steward can send tool listing, tool input and tool output events to CrowdStrike AIDR and apply allow, block or redaction decisions. Because Steward is multi-user, the request can include the actual user, agent, backend and tool rather than only a static collector identity.

Reference flow

Falcon detection → Fusion workflow → Steward Security API → BrainStorm security watch → Falcon MCP + Logs MCP → structured finding → Falcon case/ticket.