The Collections Toolkit sample Foundry app is a community-driven, open source project which serves as an example of an app which can be built using CrowdStrike's Foundry ecosystem. foundry-sample-collections-toolkit is an open source project, not a CrowdStrike product. As such, it carries no formal support, expressed or implied.

This app is one of several App Templates included in Foundry that you can use to jumpstart your development. It comes complete with a set of preconfigured capabilities aligned to its business purpose. Deploy this app from the Templates page with a single click in the Foundry UI, or create an app from this template using the CLI.

The Collections Toolkit sample Foundry app shows how to use collections with functions, workflows, and UI extensions.

• The Foundry CLI (instructions below).
• Python 3.13+ (needed if modifying the app's functions). See Python For Beginners for installation instructions.
• Node 22+ (needed if modifying the app's UI). See https://nodejs.org/en/download for installation instructions.

You can install the Foundry CLI with Scoop on Windows or Homebrew on Linux/macOS.

Windows:

Install Scoop. Then, add the Foundry CLI bucket and install the Foundry CLI.

scoop bucket add foundry https://github.com/crowdstrike/scoop-foundry-cli.git
scoop install foundry

Or, you can download the latest Windows zip file, expand it, and add the install directory to your PATH environment variable.

Linux and macOS:

Install Homebrew. Then, add the Foundry CLI repository to the list of formulae that Homebrew uses and install the CLI:

brew tap crowdstrike/foundry-cli
brew install crowdstrike/foundry-cli/foundry

Run foundry version to verify it's installed correctly.

Clone this sample to your local system, or download as a zip file and import it into Foundry.

git clone https://github.com/CrowdStrike/foundry-sample-collections-toolkit
cd foundry-sample-collections-toolkit

Log in to Foundry:

foundry login

Select the following permissions:

• Create and run RTR scripts
• Create, execute and test workflow templates
• Create, run and view API integrations
• Create, edit, delete, and list queries

Deploy the app:

foundry apps deploy

Once the deployment has finished, you can release the app:

foundry apps release

Next, go to Foundry > App catalog, find your app, and install it. Go to Fusion SOAR > Workflows to see the on-demand workflows from this app.

This sample is designed to show how to use Collections in Falcon Foundry. It contains a few capabilities:

1. Collections:

   • event_logs
   • processing_checkpoints
   • security_events_csv
   • threat_intel
   • user_preferences

2. Python functions:

   • csv-import: Shows how to import CSV files and convert to collection data
   • log-event: Uses FalconPy to store data in a collection
   • process-events: Processes events with checkpointing to prevent duplicates

3. Test workflows to invoke the last two functions.

4. Extensive integration testing for the CSV import via GitHub Actions.

5. UI extensions on Host setup and management > Host management that can be used to do CRUD (Create, Read, Update, and Delete) on the user_preferences collection.

See this sample's App docs README for usage information.

• Foundry documentation: US-1 | US-2 | EU
• Foundry learning resources: US-1 | US-2 | EU