The Functions with Python sample Foundry app is a community-driven, open source project which serves as an example of an app which can be built using CrowdStrike's Foundry ecosystem. foundry-sample-functions-python is an open source project, not a CrowdStrike product. As such, it carries no formal support, expressed or implied.

This app is one of several App Templates included in Foundry that you can use to jumpstart your development. It comes complete with a set of preconfigured capabilities aligned to its business purpose. Deploy this app from the Templates page with a single click in the Foundry UI, create an app from this template using the Foundry CLI, or download it as a zip and import it.

The Functions with Python sample Foundry app shows how to use Python functions with FalconPy, workflows, API integrations, collections, and UI extensions.

• The Foundry CLI (instructions below).
• pre-commit for secret scanning
• Python 3.14+ (needed if running the app's functions locally). See Python For Beginners for installation instructions.

You can install the Foundry CLI with Scoop on Windows or Homebrew on Linux/macOS.

Windows:

Install Scoop. Then, add the Foundry CLI bucket and install the Foundry CLI.

scoop bucket add foundry https://github.com/crowdstrike/scoop-foundry-cli.git
scoop install foundry

Or, you can download the latest Windows zip file, expand it, and add the install directory to your PATH environment variable.

Linux and macOS:

Install Homebrew. Then, add the Foundry CLI repository to the list of formulae that Homebrew uses and install the CLI:

brew tap crowdstrike/foundry-cli
brew install crowdstrike/foundry-cli/foundry

Run foundry version to verify it's installed correctly.

Clone this sample to your local system, or download as a zip file and import it into Foundry.

git clone https://github.com/CrowdStrike/foundry-sample-functions-python
cd foundry-sample-functions-python

Set up secret scanning:

pip install pre-commit
pre-commit install

Log in to Foundry:

foundry login

Select the following permissions:

• Create and run RTR scripts
• Create, execute and test workflow templates
• Create, run and view API integrations
• Create, edit, delete, and list queries

Deploy the app:

foundry apps deploy

Once the deployment has finished, you can release the app:

foundry apps release

Next, go to Foundry > App catalog, find your app, and install it. Go to Fusion SOAR > Workflows to see the test workflows from this app.

This sample has two kinds of tests: unit tests that run locally with mocked dependencies, and integration tests that run against the deployed functions.

Each function has a test_main.py. Create a virtual environment at the root of the repo, install the function's dependencies and pytest, and run pytest from the function's directory:

python3 -m venv .venv
source .venv/bin/activate
pip install -r functions/hello/requirements.txt pytest
cd functions/hello && pytest

Keep the virtual environment at the repo root. A .venv inside a function's directory is never deployed, but foundry functions exec and foundry functions test count it as an undeployed local change.

The hello and host-details functions have a tests.yml with test cases that foundry functions test runs against the deployed function (Foundry CLI 2.1.0 or later). Deploy the app first, then run:

foundry functions test --function hello

The host-details tests call the Hosts API through FalconPy, which needs an installed app. Release and install the app once, replace YOUR_HOST_AID_HERE in functions/host-details/tests.yml with a host ID from Host management in the Falcon console, then run:

foundry functions test --function host-details

Use --case <name> to run a single test case. Until the app is installed, the valid_host_id and invalid_host_id cases return 403 with app is not installed.

This sample is designed to show how to use Python Functions in Falcon Foundry. It contains a few capabilities:

1. Python functions:

   • hello: Simple greeting service
   • host-details: Uses FalconPy to get Host details
   • servicenow: Uses FalconPy to invoke an API Integration
   • log-event: Uses FalconPy to store data in a collection

2. Test workflows to invoke each function.

3. A UI extension on Endpoint security > Endpoint detections that can be used to call the hello function.

See this sample's App docs README for configuration and usage information.

• Built on CrowdStrike's Foundry Function framework
• Written in Python with dependencies including:
  • crowdstrike-foundry-function and FalconPy for CrowdStrike API integration

• Falcon Foundry documentation
• Getting started with Falcon Foundry

This repository enforces secret scanning on every commit via the pre-commit framework using betterleaks, a tool that detects secrets and credentials in source code before they are committed.

# Install pre-commit (run once)
brew install pre-commit

# Register the git hook (run once after cloning)
pre-commit install

On each git commit, betterleaks scans all staged files for secrets and credentials.

Bypass (false positives only):

git commit --no-verify