Sign in once. Siftree reads your records and reacts to new events as they happen.
Get Alert
Retrieve full CrowdStrike Falcon alert records for one or more alert composite IDs via GET /alerts/entities/alerts/v1 (max 1000 per request). Use Search Alerts to find alert IDs first.
Get Host
Includes hostname, os_version, agent_version, status (containment status) and reduced_functionality_mode (sensor health). Use Search Hosts to find device IDs first, and more
Get RTR Command Status
Retrieve the status and output of a Real-Time Response command via GET /real-time-response/entities/command/v1, returning stdout, stderr and completion status. Provide the cloud_request_id returned by Run RTR Command .…
Host Status ChangedTrigger
Emit new event for each host matching a user-supplied FQL filter that has not been emitted in a prior run. Polls GET /devices/combined/devices/v1 (returns full device records including status /containment status and…
Includes status /containment status and sensor-health fields) and deduplicates on a deviceId-modified_timestamp composite so only genuinely changed hosts emit. Covers both sensor-health and containment-status scenarios via the filter prop, and more
New AlertTrigger
Emit new event for each CrowdStrike Falcon alert created since the last run. Polls GET /alerts/queries/alerts/v1 (GetQueriesAlertsV2) for alert IDs newer than the stored created_timestamp checkpoint, then hydrates them…
Act
Take action in CrowdStrike Falcon
Agents update records and send messages for you, automatically, as drafts, or after you approve.
Manage Host Containment
Manage host containment on one or more CrowdStrike Falcon hosts via POST /devices/entities/devices-actions/v2 ( action_name query param, ids body). Use Search Hosts or Get Host to find device IDs.
Run RTR Command
Initiate a Real-Time Response (RTR) session on a host and execute a read-only responder command. Calls POST /real-time-response/entities/sessions/v1 to open the session, then POST…
Siftree is an AI platform that sales, CX, marketing, product, and strategy teams use to find, win, and keep customers.
Siftree connects calls, tickets, reviews, social, documents, video, and the systems you already use — then builds pipelines, datasets, tools, and cited insights your team and agents can operate on. Long-horizon agents keep building after you walk away.
- Describe what you need in plain language; Siftree builds pipelines, structures the data, and routes models for language, vision, audio, transcription, classification, and enrichment.
- Operate on datasets, tools, reports, and cited insights. You define the rules — what counts, how it's scored, what gets labeled.
- Marketplace: 14,824 sources across 4,169 apps and websites as of October 2026, plus any public website. Search, choose a source, and create an analysis-ready dataset without scraper maintenance.
- Native connectors for help desks, CRMs, and call recorders, plus upload and API. Audio and video are transcribed and labeled with everything else.
- Runs on a schedule or a trigger, and alerts your team in Slack when a threshold is crossed.
- Acts in your systems: writes labels and fields back to the help desk or CRM, opens issues in Linear or Jira, and drafts replies and emails. Each agent runs automatically, drafts for review, or asks first, and every action is logged.
- Ask questions of your data from Claude or ChatGPT through Siftree MCP.
- Enterprise protections: continuous verification of every request, encryption in storage and transit, privilege and identity governance, immutable activity logs.
- Teams use the eight products in place of separate point tools for prospecting data, support analytics, social listening, community triage, ad research, AI search visibility, research repositories, and competitive intelligence.