Intel

The Intel service collection provides operations for querying and retrieving CrowdStrike threat intelligence. Search for actor, indicator, malware, and report entities using FQL filters. Download rule files, retrieve MITRE ATT&CK mappings, and access vulnerability intelligence.

Language	Last Update
Python	v1.5.4
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

This service collection has code examples posted to the repository.

Operation	Description
QueryIntelActorEntities `query_actor_entities`	Get info about actors that match provided FQL filters.
QueryIntelIndicatorEntities `query_indicator_entities`	Get info about indicators that match provided FQL filters.
QueryMalwareEntities `query_malware_entities`	Get malware entities that match provided FQL filters.
QueryIntelReportEntities `query_report_entities`	Get info about reports that match provided FQL filters.
GetMalwareMitreReport `get_malware_report`	Export Mitre ATT&CK information for a given malware family.
GetIntelActorEntities `get_actor_entities`	Retrieve specific actors using their actor IDs.
GetIntelIndicatorEntities `get_indicator_entities`	Retrieve specific indicators using their indicator IDs.
GetMalwareEntities `get_malware_entities`	Get malware entities for specified IDs.
GetMitreReport `get_mitre_report`	Export Mitre ATT&CK information for a given actor.
PostMitreAttacks `mitre_attacks`	Retrieves report and observable IDs associated with the given actor and attacks.
GetIntelReportPDF `get_report_pdf`	Return a Report PDF attachment
GetIntelReportEntities `get_report_entities`	Retrieve specific reports using their report IDs.
GetIntelRuleFile `get_rule_file`	Download earlier rule sets.
GetLatestIntelRuleFile `get_latest_rule_file`	Download the latest rule set.
GetIntelRuleEntities `get_rule_entities`	Retrieve details for rule sets for the specified ids.
GetVulnerabilities `get_vulnerabilities`	Get vulnerabilities
QueryIntelActorIds `query_actor_ids`	Get actor IDs that match provided FQL filters.
QueryIntelIndicatorIds `query_indicator_ids`	Get indicators IDs that match provided FQL filters.
QueryMalware `query_malware`	Get malware family names that match provided FQL filters.
QueryMitreAttacksForMalware `query_mitre_attacks_for_malware`	Gets MITRE tactics and techniques for the given malware.
QueryMitreAttacks `query_mitre_attacks`	Gets MITRE tactics and techniques for the given actor.
QueryIntelReportIds `query_report_ids`	Get report IDs that match provided FQL filters.
QueryIntelRuleIds `query_rule_ids`	Search for rule IDs that match provided filter criteria.
QueryVulnerabilities `query_vulnerabilities`	Get vulnerabilities IDs

QueryIntelActorEntities

Get info about actors that match provided FQL filters.

GET /intel/combined/actors/v1

Scope Actors (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 query_actor_entities

Parameters

Name	Type	Data type	Description
fields	query	string	The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: <collection>. Ex: slug full. Defaults to basic.
filter	query	string	FQL query expression that should be used to limit the results. Filter parameters include: actors, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url, animal_classifier
limit	query	integer	Maximum number of records to return. (Max: 5000)
offset	query	string	Starting index of overall result set from which to return ids.
q	query	string	Free text search across all indexed fields.
sort	query	string	The property to sort by. (Ex: created_date\|desc)
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.query_actor_entities(fields="string",
                                       filter="string",
                                       limit=integer,
                                       offset=integer,
                                       q="string",
                                       sort="string")
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.QueryIntelActorEntities(fields="string",
                                          filter="string",
                                          limit=integer,
                                          offset=integer,
                                          q="string",
                                          sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryIntelActorEntities",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string",
                          q="string",
                          fields=id_list)
print(response)

Get-FalconActor -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"
  q := "string"

  response, err := client.Intel.QueryIntelActorEntities(
    &intel.QueryIntelActorEntitiesParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Q: &q,
      Fields: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.queryIntelActorEntities(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string",  // filter
  "string",  // q
  ["ID1", "ID2", "ID3"]  // fields
);

console.log(response);

use rusty_falcon::apis::intel_api::query_intel_actor_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_intel_actor_entities(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
        Some(vec!["string".to_string()]),  // fields
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.query_intel_actor_entities(offset: integer,
                                          limit: integer,
                                          sort: 'string',
                                          filter: 'string',
                                          q: 'string',
                                          fields: ['ID1', 'ID2', 'ID3'])

puts response

QueryMalwareEntities

Get malware entities that match provided FQL filters.

GET /intel/combined/malware/v1

Scope Intel: READ Consumes · Produces application/json

PEP 8 query_malware_entities

Parameters

Name	Type	Data type	Description
offset	query	integer	Set the starting row number to return malware IDs from. Defaults to 0
limit	query	integer	Set the number of malware IDs to return. The value must be between 1 and 5000
sort	query	string	Order fields in ascending or descending order. Ex: created_date\|asc
filter	query	string	Filter your query by specifying FQL filter parameters
q	query	string	Perform a generic substring search across all fields
fields	query	string/array	The fields to return
parameters	query	dictionary	Full query string parameters payload in JSON format

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.query_malware_entities(offset=integer,
                                         limit=integer,
                                         sort="string",
                                         filter="string",
                                         q="string",
                                         fields=id_list)
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.QueryMalwareEntities(offset=integer,
                                       limit=integer,
                                       sort="string",
                                       filter="string",
                                       q="string",
                                       fields=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("QueryMalwareEntities",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string",
                          q="string",
                          fields=id_list)
print(response)

Get-FalconMalwareFamily -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"
  q := "string"

  response, err := client.Intel.QueryMalwareEntities(
    &intel.QueryMalwareEntitiesParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Q: &q,
      Fields: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.queryMalwareEntities(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string",  // filter
  "string",  // q
  ["ID1", "ID2", "ID3"]  // fields
);

console.log(response);

use rusty_falcon::apis::intel_api::query_malware_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_malware_entities(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
        Some(vec!["string".to_string()]),  // fields
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.query_malware_entities(offset: integer,
                                      limit: integer,
                                      sort: 'string',
                                      filter: 'string',
                                      q: 'string',
                                      fields: ['ID1', 'ID2', 'ID3'])

puts response

QueryIntelIndicatorEntities

Get info about indicators that match provided FQL filters.

GET /intel/combined/indicators/v1

Scope Indicators (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 query_indicator_entities

Parameters

Name	Type	Data type	Description
fields	query	string	The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: <collection>. Ex: slug full. Defaults to basic.
filter	query	string	FQL query expression that should be used to limit the results. Filter parameters include: _marker, actors, deleted, domain_types, id, indicator, ip_address_types, kill_chains, labels, labels.created_on, labels.last_valid_on, labels.name, last_updated, malicious_confidence, malware_families, published_date, reports, reports.slug, targets, threat_types, type, vulnerabilities
include_deleted	query	boolean	Flag indicating if both published and deleted indicators should be returned.
include_relations	query	boolean	Flag indicating if related indicators should be returned.
limit	query	integer	Maximum number of records to return. (Max: 5000)
offset	query	string	Starting index of overall result set from which to return ids.
q	query	string	Free text search across all indexed fields.
sort	query	string	The property to sort by. (Ex: created_date\|desc)
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.query_indicator_entities(fields="string",
                                           filter="string",
                                           include_deleted="string",
                                           include_relations=boolean,
                                           limit=integer,
                                           offset=integer,
                                           q="string",
                                           sort="string")
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.QueryIntelIndicatorEntities(fields="string",
                                              filter="string",
                                              include_deleted="string",
                                              include_relations=boolean,
                                              limit=integer,
                                              offset=integer,
                                              q="string",
                                              sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryIntelIndicatorEntities",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string",
                          q="string",
                          include_deleted=boolean,
                          include_relations=boolean)
print(response)

Get-FalconIndicator -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"
  q := "string"
  includeDeleted := boolean
  includeRelations := boolean

  response, err := client.Intel.QueryIntelIndicatorEntities(
    &intel.QueryIntelIndicatorEntitiesParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Q: &q,
      IncludeDeleted: &includeDeleted,
      IncludeRelations: &includeRelations,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.queryIntelIndicatorEntities(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string",  // filter
  "string",  // q
  boolean,  // includeDeleted
  boolean  // includeRelations
);

console.log(response);

use rusty_falcon::apis::intel_api::query_intel_indicator_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_intel_indicator_entities(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
        Some(boolean),  // include_deleted
        Some(boolean),  // include_relations
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.query_intel_indicator_entities(offset: integer,
                                              limit: integer,
                                              sort: 'string',
                                              filter: 'string',
                                              q: 'string',
                                              include_deleted: boolean,
                                              include_relations: boolean)

puts response

QueryIntelReportEntities

Get info about reports that match provided FQL filters.

GET /intel/combined/reports/v1

Scope Reports (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 query_report_entities

Parameters

Name	Type	Data type	Description
fields	query	string	The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: <collection>. Ex: slug full. Defaults to basic.
filter	query	string	FQL query expression that should be used to limit the results. Filter parameters include: actors, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url, actors.animal_classifier, malware, malware.community_identifiers, malware.family_name, malware.slug, summary
include_deleted	query	boolean	Flag indicating if both published and deleted indicators should be returned.
limit	query	integer	Maximum number of records to return. (Max: 5000)
offset	query	string	Starting index of overall result set from which to return ids.
q	query	string	Free text search across all indexed fields.
sort	query	string	The property to sort by. (Ex: created_date\|desc)
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.query_report_entities(fields="string",
                                        filter="string",
                                        limit=integer,
                                        offset=integer,
                                        q="string",
                                        sort="string")
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.QueryIntelReportEntities(fields="string",
                                           filter="string",
                                           limit=integer,
                                           offset=integer,
                                           q="string",
                                           sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryIntelReportEntities",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string",
                          q="string",
                          fields=id_list)
print(response)

Get-FalconIntel -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"
  q := "string"

  response, err := client.Intel.QueryIntelReportEntities(
    &intel.QueryIntelReportEntitiesParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Q: &q,
      Fields: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.queryIntelReportEntities(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string",  // filter
  "string",  // q
  ["ID1", "ID2", "ID3"]  // fields
);

console.log(response);

use rusty_falcon::apis::intel_api::query_intel_report_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_intel_report_entities(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
        Some(vec!["string".to_string()]),  // fields
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.query_intel_report_entities(offset: integer,
                                           limit: integer,
                                           sort: 'string',
                                           filter: 'string',
                                           q: 'string',
                                           fields: ['ID1', 'ID2', 'ID3'])

puts response

GetMalwareMitreReport

Export Mitre ATT&CK information for a given malware family.

GET /intel/entities/malware-mitre-reports/v1

Scope Malware Families (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 get_malware_report

Parameters

Name	Type	Data type	Description
id	query	string	Malware family name in lower case with spaces replaced with dashes
format	query	string	Supported report formats: CSV, JSON or JSON_NAVIGATOR
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.get_malware_report(id="string", format="string")
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.GetMalwareMitreReport(id="string", format="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetMalwareMitreReport",
                          id="string",
                          format="string")
print(response)

Receive-FalconMalwareFamilyAttck -Slug "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Intel.GetMalwareMitreReport(
    &intel.GetMalwareMitreReportParams{
      ID: "string",
      Format: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.getMalwareMitreReport(
  "string",  // id
  "string"  // format
);

console.log(response);

use rusty_falcon::apis::intel_api::get_malware_mitre_report;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_malware_mitre_report(
        &falcon.cfg,  // configuration
        "string",  // id
        "string",  // format
        Some("string"),  // x_cs_useruuid
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.get_malware_mitre_report('string', 'string')

puts response

GetIntelActorEntities

Retrieve specific actors using their actor IDs.

GET /intel/entities/actors/v1

Scope Actors (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 get_actor_entities

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	Actor IDs to retrieve.
fields	query	array (string)	The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: <collection>. Ex: slug full. Defaults to basic.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_actor_entities(fields="string", ids=id_list)
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetIntelActorEntities(fields="string", ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetIntelActorEntities",
                          ids=id_list,
                          fields=id_list)
print(response)

Get-FalconActor -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Intel.GetIntelActorEntities(
    &intel.GetIntelActorEntitiesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Fields: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.getIntelActorEntities(
  ["ID1", "ID2", "ID3"],  // ids
  ["ID1", "ID2", "ID3"]  // fields
);

console.log(response);

use rusty_falcon::apis::intel_api::get_intel_actor_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_intel_actor_entities(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
        Some(vec!["string".to_string()]),  // fields
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.get_intel_actor_entities(['ID1', 'ID2', 'ID3'])

puts response

GetIntelIndicatorEntities

Retrieve specific indicators using their indicator IDs.

POST /intel/entities/indicators/GET/v1

Scope Indicators (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 get_indicator_entities

Parameters

Name	Type	Data type	Description
ids	body	string or list of strings	Indicator IDs to retrieve.
body	body	dictionary	Full body payload in JSON format.

You must use either the body or the ids keywords in order to use this method.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_indicator_entities(ids=id_list)
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetIntelIndicatorEntities(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("GetIntelIndicatorEntities", body=body_payload)
print(response)

Get-FalconIndicator -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Intel.GetIntelIndicatorEntities(
    &intel.GetIntelIndicatorEntitiesParams{
      Body: &models.MsaIdsRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.getIntelIndicatorEntities(
  {
    ids: []
}  // body
);

console.log(response);

use rusty_falcon::apis::intel_api::get_intel_indicator_entities;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaIdsRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = get_intel_indicator_entities(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

body = Falcon::MsaIdsRequest.new(
  ids: []
)

response = api.get_intel_indicator_entities(body)

puts response

GetMalwareEntities

Get malware entities for specified IDs.

GET /intel/entities/malware/v1

Scope Malware Families (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 get_malware_entities

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	Malware family name in lower case with spaces replaced with dashes.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_malware_entities(ids=id_list)
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetMalwareEntities(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetMalwareEntities",
                          ids=id_list)
print(response)

Get-FalconMalwareFamily -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Intel.GetMalwareEntities(
    &intel.GetMalwareEntitiesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.getMalwareEntities(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::intel_api::get_malware_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_malware_entities(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.get_malware_entities(['ID1', 'ID2', 'ID3'])

puts response

GetMitreReport

Export Mitre ATT&CK information for a given actor.

GET /intel/entities/mitre-reports/v1

Scope Actors (Falcon Intelligence): READ Consumes · Produces application/octet-stream

PEP 8 get_mitre_report

Parameters

Name	Type	Data type	Description
actor_id	query	string	Actor IDs (derived from actor name).
format	query	string	Report format (`json` or `csv`).
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

with open("output_file", "wb") as save_file:
    response = falcon.get_mitre_report(actor_id="string",
                                       format="string",
                                       stream=boolean)
    save_file.write(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

with open("output_file", "wb") as save_file:
    response = falcon.GetMitreReport(actor_id="string",
                                     format="string",
                                     stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("output_file", "wb") as save_file:
    response = falcon.command("GetMitreReport",
                              actor_id="string",
                              format="string")
    save_file.write(response)

Receive-FalconAttck -Slug "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Intel.GetMitreReport(
    &intel.GetMitreReportParams{
      ActorID: "string",
      Format: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.getMitreReport(
  "string",  // actorId
  "string"  // format
);

console.log(response);

use rusty_falcon::apis::intel_api::get_mitre_report;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_mitre_report(
        &falcon.cfg,  // configuration
        "string",  // actor_id
        "string",  // format
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.get_mitre_report('string', 'string')

puts response

PostMitreAttacks

Retrieves report and observable IDs associated with the given actor and attacks.

POST /intel/entities/mitre/v1

Scope Actors (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 mitre_attacks

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
ids	body	string or list of strings	The actor / attack IDs to retrieve.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.mitre_attacks(ids=id_list)
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.PostMitreAttacks(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("PostMitreAttacks", body=body_payload)
print(response)

Get-FalconAttck -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Intel.PostMitreAttacks(
    &intel.PostMitreAttacksParams{
      Body: &models.MsaIdsRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.postMitreAttacks(
  {
    ids: []
}  // body
);

console.log(response);

use rusty_falcon::apis::intel_api::post_mitre_attacks;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaIdsRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = post_mitre_attacks(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

body = Falcon::MsaIdsRequest.new(
  ids: []
)

response = api.post_mitre_attacks(body)

puts response

GetIntelReportPDF

Return a Report PDF attachment

GET /intel/entities/report-files/v1

Scope Reports (Falcon Intelligence): READ Consumes · Produces application/octet-stream

PEP 8 get_report_pdf

Parameters

Name	Type	Data type	Description
id	query	string	Report ID to download as a PDF.
parameters	query	dictionary	Full query string parameters payload in JSON format.

The id parameter must be passed to the Uber class as part of the parameters dictionary.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.get_report_pdf(id=id_list, ids=id_list, stream=boolean)
    save_file.write(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.GetIntelReportPDF(id=id_list, ids=id_list, stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.command("GetIntelReportPDF",
                              id="string",
                              ids="string")
    save_file.write(response)

Receive-FalconIntel -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"
  ids := "string"

  response, err := client.Intel.GetIntelReportPDF(
    &intel.GetIntelReportPDFParams{
      ID: &iD,
      Ids: &ids,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.getIntelReportPDF(
  "string",  // id
  "string"  // ids
);

console.log(response);

use rusty_falcon::apis::intel_api::get_intel_report_pdf;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_intel_report_pdf(
        &falcon.cfg,  // configuration
        Some("string"),  // id
        Some("string"),  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.get_intel_report_pdf(id: 'string', ids: 'string')

puts response

GetIntelReportEntities

Retrieve specific reports using their report IDs.

GET /intel/entities/reports/v1

Scope Reports (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 get_report_entities

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	Report IDs to retrieve.
fields	query	array (string)	The fields to return, or a predefined set of fields in the form of the collection name surrounded by two underscores like: <collection>. Ex: slug full. Defaults to basic.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_report_entities(fields="string", ids=id_list)
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetIntelReportEntities(fields="string", ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetIntelReportEntities",
                          ids=id_list,
                          fields=id_list)
print(response)

Get-FalconIntel -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Intel.GetIntelReportEntities(
    &intel.GetIntelReportEntitiesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Fields: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.getIntelReportEntities(
  ["ID1", "ID2", "ID3"],  // ids
  ["ID1", "ID2", "ID3"]  // fields
);

console.log(response);

use rusty_falcon::apis::intel_api::get_intel_report_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_intel_report_entities(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
        Some(vec!["string".to_string()]),  // fields
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.get_intel_report_entities(['ID1', 'ID2', 'ID3'])

puts response

GetIntelRuleFile

Download earlier rule sets.

GET /intel/entities/rules-files/v1

Scope Rules (Falcon Intelligence): READ Consumes · Produces application/zip

PEP 8 get_rule_file

Parameters

Name	Type	Data type	Description
id	query	string	Rule set ID to retrieve.
format	query	string	Choose the format you want the ruleset in. Valid formats are `zip` and `gzip`. Defaults to zip.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.get_rule_file(format="string", id=id_list, stream=boolean)
    save_file.write(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.GetIntelRuleFile(format="string", id=id_list, stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

with open("output_file", "wb") as save_file:
    response = falcon.command("GetIntelRuleFile",
                              id=integer,
                              format="string")
    save_file.write(response)

Receive-FalconRule -Path "string" -Id integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  format := "string"

  response, err := client.Intel.GetIntelRuleFile(
    &intel.GetIntelRuleFileParams{
      ID: integer,
      Format: &format,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.getIntelRuleFile(
  integer,  // id
  "string",  // accept
  "string"  // format
);

console.log(response);

use rusty_falcon::apis::intel_api::get_intel_rule_file;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_intel_rule_file(
        &falcon.cfg,  // configuration
        integer,  // id
        Some("string"),  // accept
        Some("string"),  // format
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.get_intel_rule_file(integer)

puts response

GetLatestIntelRuleFile

Download the latest rule set.

GET /intel/entities/rules-latest-files/v1

Scope Rules (Falcon Intelligence): READ Consumes · Produces application/zip

PEP 8 get_latest_rule_file

Parameters

Name	Type	Data type	Description
type	query	string	The rule news report type. Accepted values: `snort-suricata-master`, `snort-suricata-update`, `snort-suricata-changelog`, `yara-master`, `yara-update`, `yara-changelog`, `common-event-format`, `netwitness`, `cql-master`, `cql-update`, `cql-changelog`
format	query	string	Choose the format you want the rule set in. Valid formats are `zip` and `gzip`. Defaults to zip.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

with open("output_file", "wb") as save_file:
    response = falcon.get_latest_rule_file(if_none_match="string",
                                           if_modified_since="string",
                                           format="string",
                                           type="string",
                                           stream=boolean)
    save_file.write(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

with open("output_file", "wb") as save_file:
    response = falcon.GetLatestIntelRuleFile(if_none_match="string",
                                             if_modified_since="string",
                                             format="string",
                                             type="string",
                                             stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("output_file", "wb") as save_file:
    response = falcon.command("GetLatestIntelRuleFile",
                              type="string",
                              format="string")
    save_file.write(response)

Receive-FalconRule -Type "string" -Path "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  format := "string"

  response, err := client.Intel.GetLatestIntelRuleFile(
    &intel.GetLatestIntelRuleFileParams{
      Type: "string",
      Format: &format,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.getLatestIntelRuleFile(
  "string",  // type
  "string",  // accept
  "string",  // ifNoneMatch
  "string",  // ifModifiedSince
  "string",  // format
  "string"  // ifModifiedSince2
);

console.log(response);

use rusty_falcon::apis::intel_api::get_latest_intel_rule_file;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_latest_intel_rule_file(
        &falcon.cfg,  // configuration
        Some("string"),  // accept
        Some("string"),  // if_none_match
        Some("string"),  // if_modified_since
        Some("string"),  // format
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.get_latest_intel_rule_file('string')

puts response

GetIntelRuleEntities

Retrieve details for rule sets for the specified ids.

GET /intel/entities/rules/v1

Scope Rules (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 get_rule_entities

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	Rule IDs to retrieve.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_rule_entities(ids=id_list)
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetIntelRuleEntities(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("GetIntelRuleEntities",
                          ids=id_list)
print(response)

Get-FalconRule -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Intel.GetIntelRuleEntities(
    &intel.GetIntelRuleEntitiesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.getIntelRuleEntities(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::intel_api::get_intel_rule_entities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = get_intel_rule_entities(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.get_intel_rule_entities(['ID1', 'ID2', 'ID3'])

puts response

GetVulnerabilities

Get vulnerabilities by ID(s).

POST /intel/entities/vulnerabilities/GET/v1

Scope Vulnerabilities (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 get_vulnerabilities

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
ids	body	string or list of strings	Vulnerability IDs to retrieve.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_vulnerabilities(ids=id_list)
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.GetVulnerabilities(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("GetVulnerabilities", body=body_payload)
print(response)

Get-FalconCve -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Intel.GetVulnerabilities(
    &intel.GetVulnerabilitiesParams{
      Body: &models.MsaIdsRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.getVulnerabilities(
  {
    ids: []
}  // body
);

console.log(response);

use rusty_falcon::apis::intel_api::get_vulnerabilities;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaIdsRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = get_vulnerabilities(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

body = Falcon::MsaIdsRequest.new(
  ids: []
)

response = api.get_vulnerabilities(body)

puts response

QueryIntelActorIds

Get actor IDs that match provided FQL filters.

GET /intel/queries/actors/v1

Scope Actors (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 query_actor_ids

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query expression that should be used to limit the results. Filter parameters include: actors, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url, animal_classifier
limit	query	integer	Maximum number of records to return. (Max: 5000)
offset	query	string	Starting index of overall result set from which to return ids.
q	query	string	Free text search across all indexed fields.
sort	query	string	The property to sort by. (Ex: created_date\|desc)
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.query_actor_ids(filter="string",
                                  limit=integer,
                                  offset=integer,
                                  q="string",
                                  sort="string")
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.QueryIntelActorIds(filter="string",
                                     limit=integer,
                                     offset=integer,
                                     q="string",
                                     sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryIntelActorIds",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string",
                          q="string")
print(response)

Get-FalconActor -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"
  q := "string"

  response, err := client.Intel.QueryIntelActorIds(
    &intel.QueryIntelActorIdsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Q: &q,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.queryIntelActorIds(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string",  // filter
  "string"  // q
);

console.log(response);

use rusty_falcon::apis::intel_api::query_intel_actor_ids;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_intel_actor_ids(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.query_intel_actor_ids(offset: integer,
                                     limit: integer,
                                     sort: 'string',
                                     filter: 'string',
                                     q: 'string')

puts response

QueryIntelIndicatorIds

Get indicators IDs that match provided FQL filters.

GET /intel/queries/indicators/v1

Scope Indicators (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 query_indicator_ids

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query expression that should be used to limit the results. Filter parameters include: _marker, actors, deleted, domain_types, id, indicator, ip_address_types, kill_chains, labels, labels.created_on, labels.last_valid_on, labels.name, last_updated, malicious_confidence, malware_families, published_date, reports, reports.slug, targets, threat_types, type, vulnerabilities
include_deleted	query	boolean	Flag indicating if both published and deleted indicators should be returned.
include_relations	query	boolean	Flag indicating if related indicators should be returned.
limit	query	integer	Maximum number of records to return. (Max: 5000)
offset	query	string	Starting index of overall result set from which to return ids.
q	query	string	Free text search across all indexed fields.
sort	query	string	The property to sort by. (Ex: created_date\|desc)
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.query_indicator_ids(filter="string",
                                      include_deleted="string",
                                      include_relations=boolean,
                                      limit=integer,
                                      offset=integer,
                                      q="string",
                                      sort="string")
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.QueryIntelIndicatorIds(filter="string",
                                         include_deleted="string",
                                         include_relations=boolean,
                                         limit=integer,
                                         offset=integer,
                                         q="string",
                                         sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryIntelIndicatorIds",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string",
                          q="string",
                          include_deleted=boolean,
                          include_relations=boolean)
print(response)

Get-FalconIndicator -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"
  q := "string"
  includeDeleted := boolean
  includeRelations := boolean

  response, err := client.Intel.QueryIntelIndicatorIds(
    &intel.QueryIntelIndicatorIdsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Q: &q,
      IncludeDeleted: &includeDeleted,
      IncludeRelations: &includeRelations,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.queryIntelIndicatorIds(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string",  // filter
  "string",  // q
  boolean,  // includeDeleted
  boolean  // includeRelations
);

console.log(response);

use rusty_falcon::apis::intel_api::query_intel_indicator_ids;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_intel_indicator_ids(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
        Some(boolean),  // include_deleted
        Some(boolean),  // include_relations
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.query_intel_indicator_ids(offset: integer,
                                         limit: integer,
                                         sort: 'string',
                                         filter: 'string',
                                         q: 'string',
                                         include_deleted: boolean,
                                         include_relations: boolean)

puts response

QueryMalware

Get malware family names that match provided FQL filters.

GET /intel/queries/malware/v1

Scope Malware Families (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 query_malware

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query expression that should be used to limit the results.
limit	query	integer	Set the number of malware IDs to return. (Max: 5000)
offset	query	string	Set the starting row number to return malware IDs from. Defaults to 0.
q	query	string	Free text search across all indexed fields.
sort	query	string	The property to sort by. (Ex: created_date\|desc)
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.query_malware(filter="string",
                                limit=integer,
                                offset=integer,
                                q="string",
                                sort="string")
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.QueryMalware(filter="string",
                               limit=integer,
                               offset=integer,
                               q="string",
                               sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryMalware",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string",
                          q="string")
print(response)

Get-FalconMalwareFamily -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"
  q := "string"

  response, err := client.Intel.QueryMalware(
    &intel.QueryMalwareParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Q: &q,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.queryMalware(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string",  // filter
  "string"  // q
);

console.log(response);

use rusty_falcon::apis::intel_api::query_malware;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_malware(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.query_malware(offset: integer,
                             limit: integer,
                             sort: 'string',
                             filter: 'string',
                             q: 'string')

puts response

QueryMitreAttacksForMalware

Gets MITRE tactics and techniques for the given malware.

GET /intel/queries/mitre-malware/v1

Scope Malware Families (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 query_mitre_attacks_for_malware

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	Malware family name in lower case with spaces replaced with dashes.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.query_mitre_attacks_for_malware(ids=id_list)
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.QueryMitreAttacksForMalware(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("QueryMitreAttacksForMalware",
                          ids=id_list)
print(response)

Get-FalconMalwareFamily -Id @("ID1", "ID2") -Mitre $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Intel.QueryMitreAttacksForMalware(
    &intel.QueryMitreAttacksForMalwareParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.queryMitreAttacksForMalware(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::intel_api::query_mitre_attacks_for_malware;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_mitre_attacks_for_malware(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.query_mitre_attacks_for_malware(['ID1', 'ID2', 'ID3'])

puts response

QueryMitreAttacks

Gets MITRE tactics and techniques for the given actor.

GET /intel/queries/mitre/v1

Scope Actors (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 query_mitre_attacks

Parameters

Name	Type	Data type	Description
id	query	string	Actor ID for which to retrieve a list of attacks.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.query_mitre_attacks(id="string", ids=id_list)
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.QueryMitreAttacks(id="string", ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("QueryMitreAttacks",
                          id="string",
                          ids=id_list)
print(response)

Get-FalconAttck -Slug "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  iD := "string"

  response, err := client.Intel.QueryMitreAttacks(
    &intel.QueryMitreAttacksParams{
      ID: &iD,
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.queryMitreAttacks(
  "string",  // id
  ["ID1", "ID2", "ID3"]  // ids
);

console.log(response);

use rusty_falcon::apis::intel_api::query_mitre_attacks;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_mitre_attacks(
        &falcon.cfg,  // configuration
        Some("string"),  // id
        Some(vec!["string".to_string()]),  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.query_mitre_attacks(id: 'string', ids: ['ID1', 'ID2', 'ID3'])

puts response

QueryIntelReportIds

Get report IDs that match provided FQL filters.

GET /intel/queries/reports/v1

Scope Reports (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 query_report_ids

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query expression that should be used to limit the results. Filter parameters include: actors, actors.id, actors.name, actors.slug, actors.url, created_date, description, id, last_modified_date, motivations, motivations.id, motivations.slug, motivations.value, name, name.raw, short_description, slug, sub_type, sub_type.id, sub_type.name, sub_type.slug, tags, tags.id, tags.slug, tags.value, target_countries, target_countries.id, target_countries.slug, target_countries.value, target_industries, target_industries.id, target_industries.slug, target_industries.value, type, type.id, type.name, type.slug, url, actors.animal_classifier, malware, malware.community_identifiers, malware.family_name, malware.slug, summary
include_deleted	query	boolean	Flag indicating if both published and deleted indicators should be returned.
limit	query	integer	Maximum number of records to return. (Max: 5000)
offset	query	string	Starting index of overall result set from which to return ids.
q	query	string	Free text search across all indexed fields.
sort	query	string	The property to sort by. (Ex: created_date\|desc)
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.query_report_ids(filter="string",
                                   limit=integer,
                                   offset=integer,
                                   q="string",
                                   sort="string")
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.QueryIntelReportIds(filter="string",
                                      limit=integer,
                                      offset=integer,
                                      q="string",
                                      sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryIntelReportIds",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          filter="string",
                          q="string")
print(response)

Get-FalconIntel -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  filter := "string"
  q := "string"

  response, err := client.Intel.QueryIntelReportIds(
    &intel.QueryIntelReportIdsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Q: &q,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.queryIntelReportIds(
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string",  // filter
  "string"  // q
);

console.log(response);

use rusty_falcon::apis::intel_api::query_intel_report_ids;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_intel_report_ids(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.query_intel_report_ids(offset: integer,
                                      limit: integer,
                                      sort: 'string',
                                      filter: 'string',
                                      q: 'string')

puts response

QueryIntelRuleIds

Search for rule IDs that match provided filter criteria.

GET /intel/queries/rules/v1

Scope Rules (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 query_rule_ids

Parameters

Name	Type	Data type	Description
limit	query	integer	Maximum number of records to return. (Max: 5000)
name	query	string or list of strings	Search by rule title.
description	query	string or list of strings	Substring match on description field.
offset	query	string	Starting index of overall result set from which to return ids.
q	query	string	Free text search across all indexed fields.
sort	query	string	The property to sort by. (Ex: created_date\|desc)
type	query	string	The rule news report type. Accept values: `snort-suricata-master`, `snort-suricata-update`, `snort-suricata-changelog`, `yara-master`, `yara-update`, `yara-changelog`, `common-event-format`, `netwitness`, `cql-master`, `cql-update`, `cql-changelog`
tags	query	string or list of strings	Search for rules by tag.
min_created_date	query	string	Filter results to those created on or after a certain date.
max_created_date	query	string	Filter results to those created on or before a certain date.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.query_rule_ids(description=["string"],
                                 limit=integer,
                                 max_created_date="string",
                                 min_created_date="string",
                                 name=["string"],
                                 offset=integer,
                                 q="string",
                                 sort="string",
                                 tags=["string"],
                                 type="string")
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.QueryIntelRuleIds(description=["string"],
                                    limit=integer,
                                    max_created_date="string",
                                    min_created_date="string",
                                    name=["string"],
                                    offset=integer,
                                    q="string",
                                    sort="string",
                                    tags=["string"],
                                    type="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryIntelRuleIds",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          name=id_list,
                          type="string",
                          description=id_list,
                          tags=id_list,
                          min_created_date=integer,
                          max_created_date="string",
                          q="string")
print(response)

Get-FalconRule -Type "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := int64(0)
  limit := int64(0)
  sort := "string"
  minCreatedDate := int64(0)
  maxCreatedDate := "string"
  q := "string"

  response, err := client.Intel.QueryIntelRuleIds(
    &intel.QueryIntelRuleIdsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Name: []string{"ID1", "ID2", "ID3"},
      Type: "string",
      Description: []string{"ID1", "ID2", "ID3"},
      Tags: []string{"ID1", "ID2", "ID3"},
      MinCreatedDate: &minCreatedDate,
      MaxCreatedDate: &maxCreatedDate,
      Q: &q,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.queryIntelRuleIds(
  "string",  // type
  integer,  // offset
  integer,  // limit
  "string",  // sort
  ["ID1", "ID2", "ID3"],  // name
  ["ID1", "ID2", "ID3"],  // description
  ["ID1", "ID2", "ID3"],  // tags
  integer,  // minCreatedDate
  "string",  // maxCreatedDate
  "string"  // q
);

console.log(response);

use rusty_falcon::apis::intel_api::query_intel_rule_ids;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_intel_rule_ids(
        &falcon.cfg,  // configuration
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some(vec!["string".to_string()]),  // name
        Some(vec!["string".to_string()]),  // description
        Some(vec!["string".to_string()]),  // tags
        Some(integer),  // min_created_date
        Some("string"),  // max_created_date
        Some("string"),  // q
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.query_intel_rule_ids('string')

puts response

QueryVulnerabilities

Query for vulnerabilities IDs.

GET /intel/queries/vulnerabilities/v1

Scope Vulnerabilities (Falcon Intelligence): READ Consumes · Produces application/json

PEP 8 query_vulnerabilities

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query expression that should be used to limit the results.
limit	query	integer	Maximum number of records to return. (Max: 5000)
offset	query	string	Starting index of overall result set from which to return ids.
q	query	string	Free text search across all indexed fields.
sort	query	string	The property to sort by. (Ex: created_date\|desc)
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.query_vulnerabilities(filter="string",
                                        limit=integer,
                                        offset=integer,
                                        q="string",
                                        sort="string")
print(response)

from falconpy import Intel

falcon = Intel(client_id=CLIENT_ID,
               client_secret=CLIENT_SECRET
               )

response = falcon.QueryVulnerabilities(filter="string",
                                       limit=integer,
                                       offset=integer,
                                       q="string",
                                       sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryVulnerabilities",
                          offset="string",
                          limit=integer,
                          sort="string",
                          filter="string",
                          q="string")
print(response)

Get-FalconCve -Filter "string" `
  -Query "string" `
  -Sort "string" `
  -Limit integer `
  -Offset "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intel"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)
  sort := "string"
  filter := "string"
  q := "string"

  response, err := client.Intel.QueryVulnerabilities(
    &intel.QueryVulnerabilitiesParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Q: &q,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intel.queryVulnerabilities(
  "string",  // offset
  integer,  // limit
  "string",  // sort
  "string",  // filter
  "string"  // q
);

console.log(response);

use rusty_falcon::apis::intel_api::query_vulnerabilities;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_vulnerabilities(
        &falcon.cfg,  // configuration
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
        Some("string"),  // q
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Intel.new

response = api.query_vulnerabilities(offset: 'string',
                                     limit: integer,
                                     sort: 'string',
                                     filter: 'string',
                                     q: 'string')

puts response

Intel

Table of Contents

QueryIntelActorEntities

Parameters

Code Examples

QueryMalwareEntities

Parameters

Code Examples

QueryIntelIndicatorEntities

Parameters

Code Examples

QueryIntelReportEntities

Parameters

Code Examples

GetMalwareMitreReport

Parameters

Code Examples

GetIntelActorEntities

Parameters

Code Examples

GetIntelIndicatorEntities

Parameters

Code Examples

GetMalwareEntities

Parameters

Code Examples

GetMitreReport

Parameters

Code Examples

PostMitreAttacks

Parameters

Code Examples

GetIntelReportPDF

Parameters

Code Examples

GetIntelReportEntities

Parameters

Code Examples

GetIntelRuleFile

Parameters

Code Examples

GetLatestIntelRuleFile

Parameters

Code Examples

GetIntelRuleEntities

Parameters

Code Examples

GetVulnerabilities

Parameters

Code Examples

QueryIntelActorIds

Parameters

Code Examples

QueryIntelIndicatorIds

Parameters

Code Examples

QueryMalware

Parameters

Code Examples

QueryMitreAttacksForMalware

Parameters

Code Examples

QueryMitreAttacks

Parameters

Code Examples

QueryIntelReportIds

Parameters

Code Examples

QueryIntelRuleIds

Parameters

Code Examples

QueryVulnerabilities

Parameters

Code Examples