Intelligence Feeds

The Intelligence Feeds service collection provides operations for downloading and querying intelligence feed archives. Download feed file contents as a zip archive, list accessible feeds for a customer, and query feeds by name, interval, and time range.

Language	Last Update
Python	v1.6.5
PowerShell
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

Operation	Description
DownloadFeedArchive `download_feed`	Downloads the content as a zip archive for a given feed item ID
ListFeedTypes `list_feeds`	Lists the accessible feed types for a given customer
QueryFeedArchives `query_feeds`	Queries the accessible feed types for a customer.

DownloadFeedArchive

Downloads the content as a zip archive for a given feed item ID

Method GET

Route /indicator-feed/entities/feed-download/v1

Scope Falcon Indicator Graph: READ

PEP 8 download_feed

Parameters

feed_item_id query · string

Feed ID

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

stream body · boolean

Enable streaming download of the returned file.

Code Examples

from falconpy import IntelligenceFeeds

falcon = IntelligenceFeeds(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.download_feed(feed_item_id="string", stream=boolean)
print(response)

from falconpy import IntelligenceFeeds

falcon = IntelligenceFeeds(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.DownloadFeedArchive(feed_item_id="string", stream=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("DownloadFeedArchive",
                          feed_item_id="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intelligence_feeds"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.IntelligenceFeeds.DownloadFeedArchive(
    &intelligence_feeds.DownloadFeedArchiveParams{
      FeedItemID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intelligenceFeeds.downloadFeedArchive("string");  // feedItemId

console.log(response);

use rusty_falcon::apis::intelligence_feeds_api::download_feed_archive;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = download_feed_archive(
        &falcon.cfg,  // configuration
        "string",  // feed_item_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IntelligenceFeeds.new

response = api.download_feed_archive('string')

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

ListFeedTypes

Lists the accessible feed types for a given customer

Method GET

Route /indicator-feed/entities/feed/v1

Scope Falcon Indicator Graph: READ

PEP 8 list_feeds

Code Examples

from falconpy import IntelligenceFeeds

falcon = IntelligenceFeeds(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.list_feeds()
print(response)

from falconpy import IntelligenceFeeds

falcon = IntelligenceFeeds(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.ListFeedTypes()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ListFeedTypes")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intelligence_feeds"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.IntelligenceFeeds.ListFeedTypes(
    &intelligence_feeds.ListFeedTypesParams{
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intelligenceFeeds.listFeedTypes();

console.log(response);

use rusty_falcon::apis::intelligence_feeds_api::list_feed_types;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = list_feed_types(&falcon.cfg).await.expect("API call failed");  // configuration

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IntelligenceFeeds.new

response = api.list_feed_types

puts response

Responses

[
  {
    "description": "string",
    "name": "string",
    "supported_intervals": []
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

QueryFeedArchives

Queries the accessible feed types for a customer.

Method GET

Route /indicator-feed/queries/feed/v1

Scope Falcon Indicator Graph: READ

PEP 8 query_feeds

Parameters

feed_name query · string

Feed Name

feed_interval query · string

Feed interval must be one of:

Available values (4)

`dump`	`daily`	`hourly`
`minutely`

since query · string

Since is a valid timestamp in RFC3399 format. Restrictions: minutely: now()-2h, hourly: now()-2d, daily: now()-5d; dump: now()-7d

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import IntelligenceFeeds

falcon = IntelligenceFeeds(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.query_feeds(feed_name="string",
                              feed_interval="string",
                              since="string")
print(response)

from falconpy import IntelligenceFeeds

falcon = IntelligenceFeeds(client_id=CLIENT_ID,
                           client_secret=CLIENT_SECRET
                           )

response = falcon.QueryFeedArchives(feed_name="string",
                                    feed_interval="string",
                                    since="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryFeedArchives",
                          feed_name="string",
                          feed_interval="string",
                          since="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/intelligence_feeds"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  feedInterval := "string"
  since := "string"

  response, err := client.IntelligenceFeeds.QueryFeedArchives(
    &intelligence_feeds.QueryFeedArchivesParams{
      FeedName: "string",
      FeedInterval: &feedInterval,
      Since: &since,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.intelligenceFeeds.queryFeedArchives(
  "string",  // feedName
  "string",  // feedInterval
  "string"  // since
);

console.log(response);

use rusty_falcon::apis::intelligence_feeds_api::query_feed_archives;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = query_feed_archives(
        &falcon.cfg,  // configuration
        "string",  // feed_name
        Some("string"),  // feed_interval
        Some("string"),  // since
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::IntelligenceFeeds.new

response = api.query_feed_archives('string')

puts response

Responses

[
  {
    "created_timestamp": "string",
    "feed_item_id": "string",
    "interval": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

Intelligence Feeds

Table of Contents

DownloadFeedArchive

Parameters

ListFeedTypes

QueryFeedArchives

Parameters