Skip to content
CrowdStrike Developer Center

Intel

The Intel service collection provides operations for querying and retrieving CrowdStrike threat intelligence. Search for actor, indicator, malware, and report entities using FQL filters. Download rule files, retrieve MITRE ATT&CK mappings, and access vulnerability intelligence.

LanguageLast Update
Pythonv1.6.5
PowerShellv2.2.9
Gov0.22.0
TypeScriptv0.6.0
Rustv0.7.1
Rubyv1.4.0

This service collection has code examples posted to the repository.

Table of Contents

Section titled “Table of Contents”
OperationDescription
cao_incidents_aggregates_v1
cao_incidents_aggregates_v1		Perform statistical aggregations over incident data.
cao_incidents_entities_v1
cao_incidents_entities_v1		Retrieve full details for one or more adversary incidents by their IDs.
cao_incidents_queries_v1
cao_incidents_queries_v1		Search for adversary incidents using FQL criteria and return a paginated list of matching incident IDs.
GetIntelActorEntities
get_actor_entities		Retrieve specific actors using their actor IDs.
GetIntelIndicatorEntities
get_indicator_entities		Retrieve specific indicators using their indicator IDs.
GetIntelReportEntities
get_report_entities		Retrieve specific reports using their report IDs.
GetIntelReportPDF
get_report_pdf		Return a Report PDF attachment
GetIntelRuleEntities
get_rule_entities		Retrieve details for rule sets for the specified ids.
GetIntelRuleFile
get_rule_file		Download earlier rule sets.
GetLatestIntelRuleFile
get_latest_rule_file		Download the latest rule set.
GetMalwareEntities
get_malware_entities		Get malware entities for specified ids.
GetMalwareMitreReport
get_malware_report		Export Mitre ATT&CK information for a given malware family.
GetMitreReport
get_mitre_report		Export Mitre ATT&CK information for a given actor.
GetVulnerabilities
get_vulnerabilities		Get vulnerabilities
PostMitreAttacks
mitre_attacks		Retrieves report and observable IDs associated with the given actor and attacks
QueryIntelActorEntities
query_actor_entities		Get info about actors that match provided FQL filters.
QueryIntelActorIds
query_actor_ids		Get actor IDs that match provided FQL filters.
QueryIntelIndicatorEntities
query_indicator_entities		Get info about indicators that match provided FQL filters.
QueryIntelIndicatorIds
query_indicator_ids		Get indicators IDs that match provided FQL filters.
QueryIntelReportEntities
query_report_entities		Get info about reports that match provided FQL filters.
QueryIntelReportIds
query_report_ids		Get report IDs that match provided FQL filters.
QueryIntelRuleIds
query_rule_ids		Search for rule IDs that match provided filter criteria.
QueryMalware
query_malware		Get malware family names that match provided FQL filters.
QueryMalwareEntities
query_malware_entities		Get malware entities that match provided FQL filters.
QueryMitreAttacks
query_mitre_attacks		Gets MITRE tactics and techniques for the given actor, returning concatenation of id and tactic and technique ids, example: fancy-bear_TA0011_T1071
QueryMitreAttacksForMalware
query_mitre_attacks_for_malware		Gets MITRE tactics and techniques for the given malware
QueryVulnerabilities
query_vulnerabilities		Get vulnerabilities IDs

cao_incidents_aggregates_v1

Section titled “cao_incidents_aggregates_v1”

Perform statistical aggregations over incident data.

Method POST
Route /intel/aggregates/incidents/v1
Scope CAO Incidents: READ
PEP 8 cao_incidents_aggregates_v1

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
date_ranges body · array
The date_ranges value.
exclude body · string
The exclude value.
extended_bounds body · object
The extended_bounds value.
field body · string
The field value.
filter body · string
The filter value.
filters_spec body · object
The filters_spec value.
from body · integer
The from value.
include body · string
The include value.
interval body · string
The interval value.
max_doc_count body · integer
The max_doc_count value.
min_doc_count body · integer
The min_doc_count value.
missing body · string
The missing value.
name body · string
The name value.
percents body · array
The percents value.
q body · string
The q value.
ranges body · array
The ranges value.
size body · integer
The size value.
sort body · string
The sort value.
sub_aggregates body · array
The sub_aggregates value.
time_zone body · string
The time_zone value.
type body · string
The type value.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


extended_bounds = {
    "max": "string",
    "min": "string"
}


filters_spec = {
    "filters": "string",
    "other_bucket": True,
    "other_bucket_key": "string"
}


response = falcon.cao_incidents_aggregates_v1(date_ranges=["string"],
                                              exclude="string",
                                              extended_bounds=extended_bounds,
                                              field="string",
                                              filter="string",
                                              filters_spec=filters_spec,
                                              from=integer,
                                              include="string",
                                              interval="string",
                                              max_doc_count=integer,
                                              min_doc_count=integer,
                                              missing="string",
                                              name="string",
                                              percents=["string"],
                                              q="string",
                                              ranges=["string"],
                                              size=integer,
                                              sort="string",
                                              sub_aggregates=["string"],
                                              time_zone="string",
                                              type="string")
print(response)
Responses
[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

cao_incidents_entities_v1

Section titled “cao_incidents_entities_v1”

Retrieve full details for one or more adversary incidents by their IDs.

Method POST
Route /intel/entities/incidents/GET/v1
Scope CAO Incidents: READ
PEP 8 cao_incidents_entities_v1

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
ids body · array
The ids value.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.cao_incidents_entities_v1(ids=id_list)
print(response)
Responses
[
  {
    "ActivityEnd": 0,
    "ActivityStart": 0,
    "CausedByIncidents": [],
    "CreatedAt": 0,
    "Id": "string",
    "InvolvesAdversaries": [],
    "InvolvesThreats": [],
    "LastModifiedAt": 0,
    "MitreAttack": [],
    "Motivations": [],
    "Objectives": [],
    "PublishDate": 0,
    "ReducedTimeStampGranularity": "string",
    "ReferencedByReports": [],
    "ReferencesNotableEvents": [],
    "TargetCountries": [],
    "TargetIndustries": [],
    "TargetRegions": [],
    "TargetingProfile": [],
    "TargetsVulnerabilities": [],
    "Title": "string"
  }
]

cao_incidents_queries_v1

Section titled “cao_incidents_queries_v1”

Search for adversary incidents using FQL criteria and return a paginated list of matching incident IDs.

Method GET
Route /intel/queries/incidents/v1
Scope CAO Incidents: READ
PEP 8 cao_incidents_queries_v1

Parameters

Section titled “Parameters”
sort query · string
The property to sort on, followed by a dot (.), followed by the sort direction, either “asc” or “desc”. Available sort properties:
Available values (6)
LastModifiedAtActivityStartActivityEnd
PublishDateInvolvesAdversaries.NameInvolvesAdversaries.Slug
filter query · string
Optional filter and sort criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
limit query · integer
The maximum records to return. Cannot be higher than 200.
offset query · string
Starting index of overall result set from which to return ids.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.cao_incidents_queries_v1(sort="string",
                                           filter="string",
                                           limit=integer,
                                           offset="string")
print(response)
Responses
[
  "string"
]

GetIntelActorEntities

Section titled “GetIntelActorEntities”

Retrieve specific actors using their actor IDs.

Method GET
Route /intel/entities/actors/v1
Scope Actors (Falcon Intelligence): READ
PEP 8 get_actor_entities

Parameters

Section titled “Parameters”
ids query · string or list of strings
The IDs of the actors you want to retrieve.
fields query · string or list of strings
The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: <collection>. Ex: slug full. Defaults to basic.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_actor_entities(fields=id_list, ids=id_list)
print(response)
Responses
[
  {
    "active": false,
    "actor_type": "string",
    "animal_classifier": "string",
    "capabilities": [],
    "capability": {},
    "created_date": 0,
    "description": "string",
    "description_length": 0,
    "develops_threats": [],
    "develops_threats_count": 0,
    "ecrime_kill_chain": {},
    "entitlements": [],
    "first_activity_date": 0,
    "group": {},
    "has_subgroup": [],
    "has_subgroup_actors_count": 0,
    "has_successor": [],
    "has_successor_actors_count": 0,
    "id": 0,
    "image": {},
    "in_reports": [],
    "in_reports_count": 0,
    "is_subgroup_of": [],
    "is_subgroup_of_actors_count": 0,
    "is_successor_of": [],
    "is_successor_of_actors_count": 0,
    "is_supported_by": [],
    "is_supported_by_actors_count": 0,
    "kill_chain": {},
    "known_as": "string",
    "last_activity_date": 0,
    "last_modified_date": 0,
    "motivations": [],
    "name": "string",
    "notify_users": false,
    "objectives": [],
    "origins": [],
    "recent_alerting": 0,
    "region": {},
    "rich_text_description": "string",
    "sells_threats": [],
    "sells_threats_count": 0,
    "short_description": "string",
    "slug": "string",
    "status": "string",
    "supports": [],
    "supports_actors_count": 0,
    "target_countries": [],
    "target_industries": [],
    "target_regions": [],
    "thumbnail": {},
    "url": "string",
    "uses_distinct_indicators_count": 0,
    "uses_indicators_count": 0,
    "uses_mitre_attacks_count": 0,
    "uses_mitre_tactics_count": 0,
    "uses_mitre_techniques_count": 0,
    "uses_threats": [],
    "uses_threats_count": 0,
    "uses_vulnerabilities": [],
    "vulnerabilities_count": 0
  }
]

GetIntelIndicatorEntities

Section titled “GetIntelIndicatorEntities”

Retrieve specific indicators using their indicator IDs.

Method POST
Route /intel/entities/indicators/GET/v1
Scope Indicators (Falcon Intelligence): READ
PEP 8 get_indicator_entities

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
ids body · array
ID(s) of the indicator entities to retrieve.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_indicator_entities(ids=id_list)
print(response)
Responses
[
  {
    "_marker": "string",
    "actors": [],
    "deleted": false,
    "domain_types": [],
    "id": "string",
    "indicator": "string",
    "ip_address_types": [],
    "kill_chains": [],
    "labels": [],
    "last_updated": 0,
    "malicious_confidence": "string",
    "malware_families": [],
    "published_date": 0,
    "relations": [],
    "reports": [],
    "targets": [],
    "threat_types": [],
    "type": "string",
    "vulnerabilities": []
  }
]

GetIntelReportEntities

Section titled “GetIntelReportEntities”

Retrieve specific reports using their report IDs.

Method GET
Route /intel/entities/reports/v1
Scope Reports (Falcon Intelligence): READ
PEP 8 get_report_entities

Parameters

Section titled “Parameters”
ids query · string or list of strings
The IDs of the reports you want to retrieve.
fields query · string or list of strings
The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: <collection>. Ex: slug full. Defaults to basic.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_report_entities(fields=id_list, ids=id_list)
print(response)
Responses
[
  {
    "active": false,
    "actors": [],
    "attachments": [],
    "created_date": 0,
    "description": "string",
    "entitlements": [],
    "id": 0,
    "image": {},
    "last_modified_date": 0,
    "malware": [],
    "mitre_attacks": [],
    "motivations": [],
    "name": "string",
    "notify_users": false,
    "read_time_in_minutes": 0,
    "rich_text_description": "string",
    "rich_text_short_description": "string",
    "short_description": "string",
    "slug": "string",
    "sub_type": {},
    "summary": "string",
    "tags": [],
    "target_countries": [],
    "target_industries": [],
    "thumbnail": {},
    "topic": {},
    "type": {},
    "url": "string"
  }
]

GetIntelReportPDF

Section titled “GetIntelReportPDF”

Return a Report PDF attachment

Method GET
Route /intel/entities/report-files/v1
Scope Reports (Falcon Intelligence): READ
PEP 8 get_report_pdf

Parameters

Section titled “Parameters”
id query · string
The ID of the report you want to download as a PDF.
ids query · string
The ID of the report you want to download as a PDF. This parameter is used only if no id parameter given.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


with open("output_file", "wb") as save_file:
    response = falcon.get_report_pdf(id="string", ids=id_list, stream=boolean)
    save_file.write(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetIntelRuleEntities

Section titled “GetIntelRuleEntities”

Retrieve details for rule sets for the specified ids.

Method GET
Route /intel/entities/rules/v1
Scope Rules (Falcon Intelligence): READ
PEP 8 get_rule_entities

Parameters

Section titled “Parameters”
ids query · string or list of strings
The ids of rules to return.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_rule_entities(ids=id_list)
print(response)
Responses
[
  {
    "created_date": 0,
    "description": "string",
    "id": 0,
    "last_modified_date": 0,
    "name": "string",
    "rich_text_description": "string",
    "short_description": "string",
    "tags": [],
    "type": "string"
  }
]

GetIntelRuleFile

Section titled “GetIntelRuleFile”

Download earlier rule sets.

Method GET
Route /intel/entities/rules-files/v1
Scope Rules (Falcon Intelligence): READ
PEP 8 get_rule_file

Parameters

Section titled “Parameters”
id query · integer
The ID of the rule set.
format query · string
Choose the format you want the rule set in. Valid formats are zip and gzip. Defaults to zip.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


with open("output_file", "wb") as save_file:
    response = falcon.get_rule_file(format="string", id=integer, stream=boolean)
    save_file.write(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetLatestIntelRuleFile

Section titled “GetLatestIntelRuleFile”

Download the latest rule set.

Method GET
Route /intel/entities/rules-latest-files/v1
Scope Rules (Falcon Intelligence): READ
PEP 8 get_latest_rule_file

Parameters

Section titled “Parameters”
type query · string
The rule news report type. Accepted values:
Available values (11)
snort-suricata-mastersnort-suricata-updatesnort-suricata-changelog
yara-masteryara-updateyara-changelog
common-event-formatnetwitnesscql-master
cql-updatecql-changelog
format query · string
Choose the format you want the rule set in. Valid formats are zip and gzip. Defaults to zip.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
if_none_match body · string
Download the latest rule set only if it doesn’t have an ETag matching the given ones.
if_modified_since body · string
Download the latest rule set only if the rule was modified after this date. http, ANSIC and RFC850 formats accepted.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


with open("output_file", "wb") as save_file:
    response = falcon.get_latest_rule_file(if_none_match="string",
                                           if_modified_since="string",
                                           format="string",
                                           type="string",
                                           stream=boolean)
    save_file.write(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetMalwareEntities

Section titled “GetMalwareEntities”

Get malware entities for specified ids.

Method GET
Route /intel/entities/malware/v1
Scope Malware Families (Falcon Intelligence): READ
PEP 8 get_malware_entities

Parameters

Section titled “Parameters”
ids query · string or list of strings
Malware family name in lower case with spaces, dots and slashes replaced with dashes
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_malware_entities(ids=id_list)
print(response)
Responses
[
  {
    "actors_count": 0,
    "all_systems": [],
    "associated_actors": [],
    "capabilities": [],
    "community_identifiers": [],
    "created_timestamp": "string",
    "description": "string",
    "description_text_length": 0,
    "developed_by": [],
    "developed_by_count": 0,
    "distinct_indicator_count": 0,
    "files_containing_threat_count": 0,
    "id": "string",
    "indicator_count": 0,
    "kill_chain": [],
    "last_updated": "string",
    "mitre": [],
    "mitre_attack_count": 0,
    "mitre_tactic_count": 0,
    "mitre_technique_count": 0,
    "motivation": [],
    "name": "string",
    "next_stage_of": [],
    "next_stages": [],
    "plugin_of": [],
    "plugins": [],
    "purchased_by": [],
    "purchased_by_count": 0,
    "report_count": 0,
    "reports": [],
    "seen_in_environment": {},
    "slug": "string",
    "sold_by": [],
    "sold_by_count": 0,
    "status": "string",
    "sub_botnet_of": [],
    "sub_botnets": [],
    "successor_of": [],
    "successors": [],
    "systems_targeted_count": 0,
    "target_countries": [],
    "target_industries": [],
    "targeting_profile": [],
    "targets_systems": [],
    "threat_file_count": 0,
    "threat_properties": [],
    "threat_relations_count": 0,
    "used_by": [],
    "used_by_count": 0,
    "variant_of": [],
    "variants": [],
    "vulnerabilities": []
  }
]

GetMalwareMitreReport

Section titled “GetMalwareMitreReport”

Export Mitre ATT&CK information for a given malware family.

Method GET
Route /intel/entities/malware-mitre-reports/v1
Scope Malware Families (Falcon Intelligence): READ
PEP 8 get_malware_report

Parameters

Section titled “Parameters”
id query · string
Malware family name in lower case with spaces replaced with dashes
format query · string
Supported report formats:
Available values (3)
CSVJSONJSON_NAVIGATOR
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.get_malware_report(id="string", format="string")
print(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetMitreReport

Section titled “GetMitreReport”

Export Mitre ATT&CK information for a given actor.

Method GET
Route /intel/entities/mitre-reports/v1
Scope Actors (Falcon Intelligence): READ
PEP 8 get_mitre_report

Parameters

Section titled “Parameters”
actor_id query · string
Actor ID(derived from the actor’s name)
format query · string
Supported report formats:
Available values (2)
CSVJSON
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


with open("output_file", "wb") as save_file:
    response = falcon.get_mitre_report(actor_id="string",
                                       format="string",
                                       stream=boolean)
    save_file.write(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetVulnerabilities

Section titled “GetVulnerabilities”

Get vulnerabilities

Method POST
Route /intel/entities/vulnerabilities/GET/v1
Scope Vulnerabilities (Falcon Intelligence): READ
PEP 8 get_vulnerabilities

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
ids body · array
ID(s) of the indicator entities to retrieve.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.get_vulnerabilities(ids=id_list)
print(response)
Responses
[
  {
    "affected_products": [],
    "community_identifiers": [],
    "cve": "string",
    "cvss_v2_base": {},
    "cvss_v3_base": {},
    "description": "string",
    "exploit_status": "string",
    "name": "string",
    "publish_date": "string",
    "references": [],
    "related_actors": [],
    "related_reports": [],
    "related_threats": [],
    "severity": "string",
    "updated_timestamp": "string"
  }
]

PostMitreAttacks

Section titled “PostMitreAttacks”

Retrieves report and observable IDs associated with the given actor and attacks

Method POST
Route /intel/entities/mitre/v1
Scope Actors (Falcon Intelligence): READ
PEP 8 mitre_attacks

Parameters

Section titled “Parameters”
body body · dictionary
Full body payload as JSON formatted dictionary.
ids body · array
ID(s) of the indicator entities to retrieve.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.mitre_attacks(ids=id_list)
print(response)
Responses
{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

QueryIntelActorEntities

Section titled “QueryIntelActorEntities”

Get info about actors that match provided FQL filters.

Method GET
Route /intel/combined/actors/v1
Scope Actors (Falcon Intelligence): READ
PEP 8 query_actor_entities

Parameters

Section titled “Parameters”
offset query · integer
Set the starting row number to return actors from. Defaults to 0.
limit query · integer
Set the number of actors to return. The value must be between 1 and 5000.
sort query · string
The property to sort by. (Ex: created_date|desc)
filter query · string
Filter your query by specifying FQL filter parameters. Filter parameters include:
Available values (70)
actor_typeanimal_classifiercapabilities
capabilitycapability.idcapability.slug
capability.valuecreated_datedescription
ecrime_kill_chain.attributionecrime_kill_chain.crimesecrime_kill_chain.customers
ecrime_kill_chain.marketingecrime_kill_chain.monetizationecrime_kill_chain.services_offered
ecrime_kill_chain.services_usedecrime_kill_chain.technical_tradecraftecrime_kill_chain.victims
first_activity_dategroupgroup.id
group.sluggroup.valueid
kill_chain.actions_and_objectiveskill_chain.actions_on_objectiveskill_chain.command_and_control
kill_chain.deliverykill_chain.exploitationkill_chain.installation
kill_chain.objectiveskill_chain.reconnaissancekill_chain.weaponization
known_aslast_activity_datelast_modified_date
mitre_attack.idmitre_attack.tactic_idmitre_attack.tactic_name
mitre_attack.technique_idmitre_attack.technique_namemotivations
motivations.idmotivations.slugmotivations.value
nameobjectivesorigins
origins.idorigins.slugorigins.value
regionregion.idregion.slug
region.valueshort_descriptionslug
statustarget_countriestarget_countries.id
target_countries.slugtarget_countries.valuetarget_industries
target_industries.idtarget_industries.slugtarget_industries.value
target_regionstarget_regions.idtarget_regions.slug
target_regions.value
q query · string
Perform a generic substring search across all fields.
fields query · string or list of strings
The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: <collection>. Ex: slug full. Defaults to basic.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.query_actor_entities(fields=id_list,
                                       filter="string",
                                       limit=integer,
                                       offset=integer,
                                       q="string",
                                       sort="string")
print(response)
Responses
[
  {
    "active": false,
    "actor_type": "string",
    "animal_classifier": "string",
    "capabilities": [],
    "capability": {},
    "created_date": 0,
    "description": "string",
    "description_length": 0,
    "develops_threats": [],
    "develops_threats_count": 0,
    "ecrime_kill_chain": {},
    "entitlements": [],
    "first_activity_date": 0,
    "group": {},
    "has_subgroup": [],
    "has_subgroup_actors_count": 0,
    "has_successor": [],
    "has_successor_actors_count": 0,
    "id": 0,
    "image": {},
    "in_reports": [],
    "in_reports_count": 0,
    "is_subgroup_of": [],
    "is_subgroup_of_actors_count": 0,
    "is_successor_of": [],
    "is_successor_of_actors_count": 0,
    "is_supported_by": [],
    "is_supported_by_actors_count": 0,
    "kill_chain": {},
    "known_as": "string",
    "last_activity_date": 0,
    "last_modified_date": 0,
    "motivations": [],
    "name": "string",
    "notify_users": false,
    "objectives": [],
    "origins": [],
    "recent_alerting": 0,
    "region": {},
    "rich_text_description": "string",
    "sells_threats": [],
    "sells_threats_count": 0,
    "short_description": "string",
    "slug": "string",
    "status": "string",
    "supports": [],
    "supports_actors_count": 0,
    "target_countries": [],
    "target_industries": [],
    "target_regions": [],
    "thumbnail": {},
    "url": "string",
    "uses_distinct_indicators_count": 0,
    "uses_indicators_count": 0,
    "uses_mitre_attacks_count": 0,
    "uses_mitre_tactics_count": 0,
    "uses_mitre_techniques_count": 0,
    "uses_threats": [],
    "uses_threats_count": 0,
    "uses_vulnerabilities": [],
    "vulnerabilities_count": 0
  }
]

QueryIntelActorIds

Section titled “QueryIntelActorIds”

Get actor IDs that match provided FQL filters.

Method GET
Route /intel/queries/actors/v1
Scope Actors (Falcon Intelligence): READ
PEP 8 query_actor_ids

Parameters

Section titled “Parameters”
offset query · integer
Set the starting row number to return actors IDs from. Defaults to 0.
limit query · integer
Set the number of actor IDs to return. The value must be between 1 and 5000.
sort query · string
The property to sort by. (Ex: created_date|desc)
filter query · string
Filter your query by specifying FQL filter parameters. Filter parameters include:
Available values (70)
actor_typeanimal_classifiercapabilities
capabilitycapability.idcapability.slug
capability.valuecreated_datedescription
ecrime_kill_chain.attributionecrime_kill_chain.crimesecrime_kill_chain.customers
ecrime_kill_chain.marketingecrime_kill_chain.monetizationecrime_kill_chain.services_offered
ecrime_kill_chain.services_usedecrime_kill_chain.technical_tradecraftecrime_kill_chain.victims
first_activity_dategroupgroup.id
group.sluggroup.valueid
kill_chain.actions_and_objectiveskill_chain.actions_on_objectiveskill_chain.command_and_control
kill_chain.deliverykill_chain.exploitationkill_chain.installation
kill_chain.objectiveskill_chain.reconnaissancekill_chain.weaponization
known_aslast_activity_datelast_modified_date
mitre_attack.idmitre_attack.tactic_idmitre_attack.tactic_name
mitre_attack.technique_idmitre_attack.technique_namemotivations
motivations.idmotivations.slugmotivations.value
nameobjectivesorigins
origins.idorigins.slugorigins.value
regionregion.idregion.slug
region.valueshort_descriptionslug
statustarget_countriestarget_countries.id
target_countries.slugtarget_countries.valuetarget_industries
target_industries.idtarget_industries.slugtarget_industries.value
target_regionstarget_regions.idtarget_regions.slug
target_regions.value
q query · string
Perform a generic substring search across all fields.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.query_actor_ids(filter="string",
                                  limit=integer,
                                  offset=integer,
                                  q="string",
                                  sort="string")
print(response)
Responses
[
  "string"
]

QueryIntelIndicatorEntities

Section titled “QueryIntelIndicatorEntities”

Get info about indicators that match provided FQL filters.

Method GET
Route /intel/combined/indicators/v1
Scope Indicators (Falcon Intelligence): READ
PEP 8 query_indicator_entities

Parameters

Section titled “Parameters”
offset query · integer
Set the starting row number to return indicators from. Defaults to 0.
limit query · integer
Set the number of indicators to return. The number must be between 1 and 10000
sort query · string
The property to sort by. (Ex: created_date|desc)
filter query · string
Filter your query by specifying FQL filter parameters. Filter parameters include:
Available values (23)
_markeractorsdeleted
domain_typesidindicator
ip_address_typeskill_chainslabels
labels.created_onlabels.last_valid_onlabels.name
last_updatedmalicious_confidencemalware_families
published_datereportsreports.slug
scopetargetsthreat_types
typevulnerabilities
q query · string
Perform a generic substring search across all fields.
include_deleted query · boolean
If true, include both published and deleted indicators in the response. Defaults to false.
include_relations query · boolean
If true, include related indicators in the response. Defaults to true.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
fields body · string
The fields to return, or a predefined set of fields in the form of the collection name surround by two underscores: <collection_name>. e.g. slug full. Defaults to basic.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.query_indicator_entities(fields="string",
                                           filter="string",
                                           include_deleted=boolean,
                                           include_relations=boolean,
                                           limit=integer,
                                           offset=integer,
                                           q="string",
                                           sort="string")
print(response)
Responses
[
  {
    "_marker": "string",
    "actors": [],
    "deleted": false,
    "domain_types": [],
    "id": "string",
    "indicator": "string",
    "ip_address_types": [],
    "kill_chains": [],
    "labels": [],
    "last_updated": 0,
    "malicious_confidence": "string",
    "malware_families": [],
    "published_date": 0,
    "relations": [],
    "reports": [],
    "targets": [],
    "threat_types": [],
    "type": "string",
    "vulnerabilities": []
  }
]

QueryIntelIndicatorIds

Section titled “QueryIntelIndicatorIds”

Get indicators IDs that match provided FQL filters.

Method GET
Route /intel/queries/indicators/v1
Scope Indicators (Falcon Intelligence): READ
PEP 8 query_indicator_ids

Parameters

Section titled “Parameters”
offset query · integer
Set the starting row number to return indicator IDs from. Defaults to 0.
limit query · integer
Set the number of indicator IDs to return. The number must be between 1 and 10000
sort query · string
The property to sort by. (Ex: created_date|desc)
filter query · string
Filter your query by specifying FQL filter parameters. Filter parameters include:
Available values (23)
_markeractorsdeleted
domain_typesidindicator
ip_address_typeskill_chainslabels
labels.created_onlabels.last_valid_onlabels.name
last_updatedmalicious_confidencemalware_families
published_datereportsreports.slug
scopetargetsthreat_types
typevulnerabilities
q query · string
Perform a generic substring search across all fields.
include_deleted query · boolean
If true, include both published and deleted indicators in the response. Defaults to false.
include_relations query · boolean
If true, include related indicators in the response. Defaults to true.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.query_indicator_ids(filter="string",
                                      include_deleted=boolean,
                                      include_relations=boolean,
                                      limit=integer,
                                      offset=integer,
                                      q="string",
                                      sort="string")
print(response)
Responses
[
  "string"
]

QueryIntelReportEntities

Section titled “QueryIntelReportEntities”

Get info about reports that match provided FQL filters.

Method GET
Route /intel/combined/reports/v1
Scope Reports (Falcon Intelligence): READ
PEP 8 query_report_entities

Parameters

Section titled “Parameters”
offset query · integer
Set the starting row number to return reports from. Defaults to 0.
limit query · integer
Set the number of reports to return. The value must be between 1 and 5000.
sort query · string
The property to sort by. (Ex: created_date|desc)
filter query · string
Filter your query by specifying FQL filter parameters. Filter parameters include:
Available values (49)
actorsactors.animal_classifieractors.id
actors.nameactors.slugactors.url
created_datedescriptionid
last_modified_datemalwaremalware.community_identifiers
malware.family_namemalware.slugmitre_attack.id
mitre_attack.tactic_idmitre_attack.tactic_namemitre_attack.technique_id
mitre_attack.technique_namemotivationsmotivations.id
motivations.slugmotivations.valuename
name.rawshort_descriptionslug
sub_typesub_type.idsub_type.name
sub_type.slugsummarytags
tags.idtags.slugtags.value
target_countriestarget_countries.idtarget_countries.slug
target_countries.valuetarget_industriestarget_industries.id
target_industries.slugtarget_industries.valuetype
type.idtype.nametype.slug
url
q query · string
Perform a generic substring search across all fields.
fields query · string or list of strings
The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: <collection>. Ex: slug full. Defaults to basic.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.query_report_entities(fields=id_list,
                                        filter="string",
                                        limit=integer,
                                        offset=integer,
                                        q="string",
                                        sort="string")
print(response)
Responses
[
  {
    "active": false,
    "actors": [],
    "attachments": [],
    "created_date": 0,
    "description": "string",
    "entitlements": [],
    "id": 0,
    "image": {},
    "last_modified_date": 0,
    "malware": [],
    "mitre_attacks": [],
    "motivations": [],
    "name": "string",
    "notify_users": false,
    "read_time_in_minutes": 0,
    "rich_text_description": "string",
    "rich_text_short_description": "string",
    "short_description": "string",
    "slug": "string",
    "sub_type": {},
    "summary": "string",
    "tags": [],
    "target_countries": [],
    "target_industries": [],
    "thumbnail": {},
    "topic": {},
    "type": {},
    "url": "string"
  }
]

QueryIntelReportIds

Section titled “QueryIntelReportIds”

Get report IDs that match provided FQL filters.

Method GET
Route /intel/queries/reports/v1
Scope Reports (Falcon Intelligence): READ
PEP 8 query_report_ids

Parameters

Section titled “Parameters”
offset query · integer
Set the starting row number to return report IDs from. Defaults to 0.
limit query · integer
Set the number of report IDs to return. The value must be between 1 and 5000.
sort query · string
The property to sort by. (Ex: created_date|desc)
filter query · string
Filter your query by specifying FQL filter parameters. Filter parameters include:
Available values (49)
actorsactors.animal_classifieractors.id
actors.nameactors.slugactors.url
created_datedescriptionid
last_modified_datemalwaremalware.community_identifiers
malware.family_namemalware.slugmitre_attack.id
mitre_attack.tactic_idmitre_attack.tactic_namemitre_attack.technique_id
mitre_attack.technique_namemotivationsmotivations.id
motivations.slugmotivations.valuename
name.rawshort_descriptionslug
sub_typesub_type.idsub_type.name
sub_type.slugsummarytags
tags.idtags.slugtags.value
target_countriestarget_countries.idtarget_countries.slug
target_countries.valuetarget_industriestarget_industries.id
target_industries.slugtarget_industries.valuetype
type.idtype.nametype.slug
url
q query · string
Perform a generic substring search across all fields.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.query_report_ids(filter="string",
                                   limit=integer,
                                   offset=integer,
                                   q="string",
                                   sort="string")
print(response)
Responses
[
  "string"
]

QueryIntelRuleIds

Section titled “QueryIntelRuleIds”

Search for rule IDs that match provided filter criteria.

Method GET
Route /intel/queries/rules/v1
Scope Rules (Falcon Intelligence): READ
PEP 8 query_rule_ids

Parameters

Section titled “Parameters”
offset query · integer
Set the starting row number to return reports from. Defaults to 0.
limit query · integer
The number of rule IDs to return. Defaults to 10.
sort query · string
The property to sort by. (Ex: created_date|desc)
name query · string or list of strings
Search by rule title.
type query · string
The rule news report type. Accepted values:
Available values (11)
snort-suricata-mastersnort-suricata-updatesnort-suricata-changelog
yara-masteryara-updateyara-changelog
common-event-formatnetwitnesscql-master
cql-updatecql-changelog
description query · string or list of strings
Substring match on description field.
tags query · string or list of strings
Search for rule tags.
min_created_date query · integer
Filter results to those created on or after a certain date.
max_created_date query · string
Filter results to those created on or before a certain date.
q query · string
Perform a generic substring search across all fields.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.query_rule_ids(description=id_list,
                                 limit=integer,
                                 max_created_date="string",
                                 min_created_date=integer,
                                 name=id_list,
                                 offset=integer,
                                 q="string",
                                 sort="string",
                                 tags=id_list,
                                 type="string")
print(response)
Responses
[
  "string"
]

QueryMalware

Section titled “QueryMalware”

Get malware family names that match provided FQL filters.

Method GET
Route /intel/queries/malware/v1
Scope Malware Families (Falcon Intelligence): READ
PEP 8 query_malware

Parameters

Section titled “Parameters”
offset query · integer
Set the starting row number to return malware IDs from. Defaults to 0.
limit query · integer
Set the number of malware IDs to return. The value must be between 1 and 5000.
sort query · string
The property to sort by. (Ex: created_date|desc)
filter query · string
FQL query expression that should be used to limit the results.
q query · string
Perform a generic substring search across all fields.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.query_malware(filter="string",
                                limit=integer,
                                offset=integer,
                                q="string",
                                sort="string")
print(response)
Responses
[
  "string"
]

QueryMalwareEntities

Section titled “QueryMalwareEntities”

Get malware entities that match provided FQL filters.

Method GET
Route /intel/combined/malware/v1
Scope Malware Families (Falcon Intelligence): READ
PEP 8 query_malware_entities

Parameters

Section titled “Parameters”
offset query · integer
Set the starting row number to return malware IDs from. Defaults to 0.
limit query · integer
Set the number of malware IDs to return. The value must be between 1 and 5000.
sort query · string
Order fields in ascending or descending order. Ex: created_date|asc
filter query · string
Filter your query by specifying FQL filter parameters
q query · string
Perform a generic substring search across all fields.
fields query · string or list of strings
The fields to return
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.query_malware_entities(offset=integer,
                                         limit=integer,
                                         sort="string",
                                         filter="string",
                                         q="string",
                                         fields=id_list)
print(response)
Responses
[
  {
    "actors_count": 0,
    "all_systems": [],
    "associated_actors": [],
    "capabilities": [],
    "community_identifiers": [],
    "created_timestamp": "string",
    "description": "string",
    "description_text_length": 0,
    "developed_by": [],
    "developed_by_count": 0,
    "distinct_indicator_count": 0,
    "files_containing_threat_count": 0,
    "id": "string",
    "indicator_count": 0,
    "kill_chain": [],
    "last_updated": "string",
    "mitre": [],
    "mitre_attack_count": 0,
    "mitre_tactic_count": 0,
    "mitre_technique_count": 0,
    "motivation": [],
    "name": "string",
    "next_stage_of": [],
    "next_stages": [],
    "plugin_of": [],
    "plugins": [],
    "purchased_by": [],
    "purchased_by_count": 0,
    "report_count": 0,
    "reports": [],
    "seen_in_environment": {},
    "slug": "string",
    "sold_by": [],
    "sold_by_count": 0,
    "status": "string",
    "sub_botnet_of": [],
    "sub_botnets": [],
    "successor_of": [],
    "successors": [],
    "systems_targeted_count": 0,
    "target_countries": [],
    "target_industries": [],
    "targeting_profile": [],
    "targets_systems": [],
    "threat_file_count": 0,
    "threat_properties": [],
    "threat_relations_count": 0,
    "used_by": [],
    "used_by_count": 0,
    "variant_of": [],
    "variants": [],
    "vulnerabilities": []
  }
]

QueryMitreAttacks

Section titled “QueryMitreAttacks”

Gets MITRE tactics and techniques for the given actor, returning concatenation of id and tactic and technique ids, example: fancy-bear_TA0011_T1071

Method GET
Route /intel/queries/mitre/v1
Scope Actors (Falcon Intelligence): READ
PEP 8 query_mitre_attacks

Parameters

Section titled “Parameters”
id query · string
The actor ID(derived from the actor’s name) for which to retrieve a list of attacks, for example: fancy-bear. Only one value is allowed
ids query · string or list of strings
The actor ID(derived from the actor’s name) for which to retrieve a list of attacks, for example: fancy-bear. Multiple values are allowed
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.query_mitre_attacks(id="string", ids=id_list)
print(response)
Responses
[
  "string"
]

QueryMitreAttacksForMalware

Section titled “QueryMitreAttacksForMalware”

Gets MITRE tactics and techniques for the given malware

Method GET
Route /intel/queries/mitre-malware/v1
Scope Malware Families (Falcon Intelligence): READ
PEP 8 query_mitre_attacks_for_malware

Parameters

Section titled “Parameters”
ids query · string or list of strings
Malware family name in lower case with spaces replaced with dashes
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']


response = falcon.query_mitre_attacks_for_malware(ids=id_list)
print(response)
Responses
[
  "string"
]

QueryVulnerabilities

Section titled “QueryVulnerabilities”

Get vulnerabilities IDs

Method GET
Route /intel/queries/vulnerabilities/v1
Scope Vulnerabilities (Falcon Intelligence): READ
PEP 8 query_vulnerabilities

Parameters

Section titled “Parameters”
offset query · string
Starting index of result set from which to return IDs.
limit query · integer
Number of IDs to return.
sort query · string
The property to sort by. (Ex: created_date|desc)
filter query · string
FQL query expression that should be used to limit the results.
q query · string
Match phrase_prefix query criteria; included fields: _all (all filter string fields indexed).
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import Intel


falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )


response = falcon.query_vulnerabilities(filter="string",
                                        limit=integer,
                                        offset="string",
                                        q="string",
                                        sort="string")
print(response)
Responses
[
  "string"
]
© 2026 CrowdStrike, Inc. All rights reserved. Privacy Notice Cookie Notice Terms of Use