IOC

The IOC service collection provides operations for managing custom Indicators of Compromise (IOC) within your CrowdStrike environment. Create, update, delete, and search for indicators. Query aggregates, retrieve action and type information, and look up device and process data associated with custom IOCs.

Language	Last Update
Python	v1.4.6
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Sample Code

This service collection has code examples posted to the repository.

Operation	Description
indicator_aggregate_v1 `indicator_aggregate`	Get Indicators aggregates as specified via json in the request body.
indicator_combined_v1 `indicator_combined`	Get Combined for Indicators.
action_get_v1 `action_get`	Get Actions by ids.
GetIndicatorsReport `get_indicators_report`	Launch an indicators report creation job
indicator_get_v1 `indicator_get`	Get Indicators by ids.
indicator_create_v1 `indicator_create`	Create Indicators.
indicator_delete_v1 `indicator_delete`	Delete Indicators by ids.
indicator_update_v1 `indicator_update`	Update Indicators.
action_query_v1 `action_query`	Query Actions.
indicator_search_v1 `indicator_search`	Search for Indicators.
ioc_type_query_v1 `ioc_type_query`	Query IOC Types.
platform_query_v1 `platform_query`	Query Platforms.
severity_query_v1 `severity_query`	Query Severities.
DevicesCount `devices_count_legacy`	Number of hosts in your customer account that have observed a given custom IOC
indicator_get_device_count_v1 `devices_count`	Number of hosts in your customer account that have observed a given custom IOC
DevicesRanOn `devices_ran_on_legacy`	Find hosts that have observed a given custom IOC. For details about those hosts, use GET /devices/entities/devices/v1
indicator_get_devices_ran_on_v1 `devices_ran_on`	Find hosts that have observed a given custom IOC. For details about those hosts, use GET /devices/entities/devices/v1
ProcessesRanOn `processes_ran_on_legacy`	Search for processes associated with a custom IOC (Deprecated)
indicator_get_processes_ran_on_v1 `processes_ran_on`	Search for processes associated with a custom IOC
entities_processes `entities_processes`	For the provided ProcessID retrieve the process details

indicator_aggregate_v1

Get Indicators aggregates as specified via json in the request body.

POST /iocs/aggregates/indicators/v1

Scope IOC Management: READ Consumes · Produces application/json

PEP 8 indicator_aggregate

Parameters

Name	Type	Data type	Description
body	body	list of dictionaries	Full body payload in JSON format.
date_ranges	body	list of dictionaries	Applies to date_range aggregations. Example: [{“from”: “2016-05-28T09:00:31Z”, “to”: “2016-05-30T09:00:31Z”}, {“from”: “2016-06-01T09:00:31Z”, “to”: “2016-06-10T09:00:31Z”}]
exclude	body	string	Elements to exclude.
field	body	string	The field on which to compute the aggregation.
filter	body	string	FQL syntax formatted string to use to filter the results.
from	body	integer	Starting position.
include	body	string	Elements to include.
interval	body	string	Time interval for date histogram aggregations. Valid values include: `year`, `month`, `week`, `day`, `hour`, `minute`.
max_doc_count	body	integer	Only return buckets if values are less than or equal to the value here.
min_doc_count	body	integer	Only return buckets if values are greater than or equal to the value here.
missing	body	string	Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
name	body	string	Name of the aggregate query, as chosen by the user. Used to identify the results returned to you.
q	body	string	Full text search across all metadata fields.
ranges	body	list of dictionaries	Applies to range aggregations. Ranges values will depend on field. For example, if `max_severity` is used, ranges might look like: [{“From”: 0, “To”: 70}, {“From”: 70, “To”: 100}]
size	body	integer	The max number of term buckets to be returned.
sub_aggregates	body	list of dictionaries	A nested aggregation, such as: [{“name”: “max_first_behavior”, “type”: “max”, “field”: “first_behavior”}]. There is a maximum of 3 nested aggregations per request.
sort	body	string	FQL syntax string to sort bucket results. `_count` - sort by document count. `_term` - sort by the string value alphabetically. Supports `asc` and `desc` using `\\|` format. Example: `_count\\|desc`
time_zone	body	string	Time zone for bucket results.
type	body	string	Type of aggregation. Valid values include: `date_histogram`, `date_range`, `terms`, `range`, `cardinality`, `max`, `min`, `avg`, `sum`, `percentiles`.

Code Examples

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

response = falcon.indicator_aggregate(date_ranges="string",
                                      exclude="string",
                                      field="string",
                                      filter="string",
                                      from=integer,
                                      include="string",
                                      interval="string",
                                      max_doc_count=integer,
                                      min_doc_count=integer,
                                      missing="string",
                                      name="string",
                                      q="string",
                                      ranges=ranges,
                                      size=integer,
                                      sort="string",
                                      sub_aggregates=["string"],
                                      time_zone="string",
                                      type="string")
print(response)

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

response = falcon.indicator_aggregate_v1(date_ranges="string",
                                         exclude="string",
                                         field="string",
                                         filter="string",
                                         from=integer,
                                         include="string",
                                         interval="string",
                                         max_doc_count=integer,
                                         min_doc_count=integer,
                                         missing="string",
                                         name="string",
                                         q="string",
                                         ranges=ranges,
                                         size=integer,
                                         sort="string",
                                         sub_aggregates=["string"],
                                         time_zone="string",
                                         type="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "date_ranges": [
        {
            "from": "string",
            "to": "string"
        }
    ],
    "exclude": "string",
    "extended_bounds": {
        "max": "string",
        "min": "string"
    },
    "field": "string",
    "filter": "string",
    "filters_spec": {
        "filters": {},
        "other_bucket": boolean,
        "other_bucket_key": "string"
    },
    "from": integer,
    "include": "string",
    "interval": "string",
    "max_doc_count": integer,
    "min_doc_count": integer,
    "missing": "string",
    "name": "string",
    "percents": ["string"],
    "q": "string",
    "ranges": [
        {
            "from": integer,
            "to": integer
        }
    ],
    "size": integer,
    "sort": "string",
    "sub_aggregates": [
        {
            "date_ranges": [
                {
                    "from": "string",
                    "to": "string"
                }
            ],
            "exclude": "string",
            "extended_bounds": {
                "max": "string",
                "min": "string"
            },
            "field": "string",
            "filter": "string",
            "filters_spec": {
                "filters": {},
                "other_bucket": boolean,
                "other_bucket_key": "string"
            },
            "from": integer,
            "include": "string",
            "interval": "string",
            "max_doc_count": integer,
            "min_doc_count": integer,
            "missing": "string",
            "name": "string",
            "percents": ["string"],
            "q": "string",
            "ranges": [
                {
                    "from": integer,
                    "to": integer
                }
            ],
            "size": integer,
            "sort": "string",
            "sub_aggregates": [
                {
                    "date_ranges": ["string"],
                    "exclude": "string",
                    "extended_bounds": {},
                    "field": "string",
                    "filter": "string",
                    "filters_spec": {},
                    "from": integer,
                    "include": "string",
                    "interval": "string",
                    "max_doc_count": integer,
                    "min_doc_count": integer,
                    "missing": "string",
                    "name": "string",
                    "percents": ["string"],
                    "q": "string",
                    "ranges": ["string"],
                    "size": integer,
                    "sort": "string",
                    "sub_aggregates": ["string"],
                    "time_zone": "string",
                    "type": "string"
                }
            ],
            "time_zone": "string",
            "type": "string"
        }
    ],
    "time_zone": "string",
    "type": "string"
}

response = falcon.command("indicator_aggregate_v1",
                          filter="string",
                          from_parent=boolean,
                          body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from := "string"
  to := "string"
  exclude := "string"
  field := "string"
  filter := "string"
  from := integer
  include := "string"
  interval := "string"
  max_doc_count := integer
  min_doc_count := integer
  missing := "string"
  name := "string"
  q := "string"
  From := integer
  To := integer
  size := integer
  sort := "string"
  time_zone := "string"
  type := "string"
  filter := "string"
  fromParent := boolean

  response, err := client.Ioc.IndicatorAggregateV1(
    &ioc.IndicatorAggregateV1Params{
      Body: &models.MsaAggregateQueryRequest{
        DateRanges: []interface{}{
          {
          From: &from,
          To: &to,
          },
        },
        Exclude: &exclude,
        ExtendedBounds: &struct{}{},
        Field: &field,
        Filter: &filter,
        FiltersSpec: &struct{}{},
        From: &from,
        Include: &include,
        Interval: &interval,
        MaxDocCount: &max_doc_count,
        MinDocCount: &min_doc_count,
        Missing: &missing,
        Name: &name,
        Percents: []interface{}{},
        Q: &q,
        Ranges: []interface{}{
          {
          From: &From,
          To: &To,
          },
        },
        Size: &size,
        Sort: &sort,
        SubAggregates: []interface{}{
          {
          DateRanges: []interface{}{
            {
            From: &from,
            To: &to,
            },
          },
          Exclude: &exclude,
          ExtendedBounds: &struct{}{},
          Field: &field,
          Filter: &filter,
          FiltersSpec: &struct{}{},
          From: &from,
          Include: &include,
          Interval: &interval,
          MaxDocCount: &max_doc_count,
          MinDocCount: &min_doc_count,
          Missing: &missing,
          Name: &name,
          Percents: []interface{}{},
          Q: &q,
          Ranges: []interface{}{
            {
            From: &From,
            To: &To,
            },
          },
          Size: &size,
          Sort: &sort,
          SubAggregates: []interface{}{
            {
            DateRanges: []interface{}{},
            Exclude: &exclude,
            ExtendedBounds: &struct{}{},
            Field: &field,
            Filter: &filter,
            FiltersSpec: &struct{}{},
            From: &from,
            Include: &include,
            Interval: &interval,
            MaxDocCount: &max_doc_count,
            MinDocCount: &min_doc_count,
            Missing: &missing,
            Name: &name,
            Percents: []interface{}{},
            Q: &q,
            Ranges: []interface{}{},
            Size: &size,
            Sort: &sort,
            SubAggregates: []interface{}{},
            TimeZone: &time_zone,
            Type: &type,
            },
          },
          TimeZone: &time_zone,
          Type: &type,
          },
        },
        TimeZone: &time_zone,
        Type: &type,
      },
      Filter: &filter,
      FromParent: &fromParent,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorAggregateV1(
  {  // body
      dateRanges: [{
          from: "string",
          to: "string"
        }],
      exclude: "string",
      extendedBounds: {
        max: "string",
        min: "string"
      },
      field: "string",
      filter: "string",
      filtersSpec: {
        filters: {},
        otherBucket: boolean,
        otherBucketKey: "string"
      },
      from: integer,
      include: "string",
      interval: "string",
      maxDocCount: integer,
      minDocCount: integer,
      missing: "string",
      name: "string",
      percents: [],
      q: "string",
      ranges: [{
          From: integer,
          To: integer
        }],
      size: integer,
      sort: "string",
      subAggregates: [{
          dateRanges: [{
              from: "string",
              to: "string"
            }],
          exclude: "string",
          extendedBounds: {
            max: "string",
            min: "string"
          },
          field: "string",
          filter: "string",
          filtersSpec: {
            filters: {},
            otherBucket: boolean,
            otherBucketKey: "string"
          },
          from: integer,
          include: "string",
          interval: "string",
          maxDocCount: integer,
          minDocCount: integer,
          missing: "string",
          name: "string",
          percents: [],
          q: "string",
          ranges: [{
              From: integer,
              To: integer
            }],
          size: integer,
          sort: "string",
          subAggregates: [{
              dateRanges: [],
              exclude: "string",
              extendedBounds: {},
              field: "string",
              filter: "string",
              filtersSpec: {},
              from: integer,
              include: "string",
              interval: "string",
              maxDocCount: integer,
              minDocCount: integer,
              missing: "string",
              name: "string",
              percents: [],
              q: "string",
              ranges: [],
              size: integer,
              sort: "string",
              subAggregates: [],
              timeZone: "string",
              type: "string"
            }],
          timeZone: "string",
          type: "string"
        }],
      timeZone: "string",
      type: "string"
  },
  "string",  // filter
  boolean  // fromParent
);

console.log(response);

indicator_combined_v1

Get Combined for Indicators.

GET /iocs/combined/indicator/v1

Scope IOC Management: READ Consumes · Produces application/json

PEP 8 indicator_combined

Parameters

Name	Type	Data type	Description
after	query	string	A pagination token used with the `limit` parameter to manage pagination of results. On your first request, don’t provide an `after` token. On subsequent requests, provide the `after` token from the previous response to continue from that place in the results. To access more than 10k indicators, use the `after` parameter instead of `offset`.
filter	query	string	FQL Syntax formatted filter that should be used to limit the results. Available filters: type, value, action, severity, platforms, tags, expiration, expired, applied_globally, host_groups, created_on, created_by, modified_on, modified_by, source.
from_parent	query	boolean	The filter for returning either only indicators for the request customer or its MSSP parents.
limit	query	integer	Maximum number of results to return.
offset	query	integer	The offset to start retrieving records from. Offset and After params are mutually exclusive. If none provided then scrolling will be used by default. To access more than 10k iocs, use the `after` parameter instead of `offset`.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	FQL Syntax formatted sort filter.

Code Examples

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.indicator_combined(after="string",
                                     filter="string",
                                     from_parent="string",
                                     limit="string",
                                     offset="string",
                                     sort="string")
print(response)

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.indicator_combined_v1(after="string",
                                        filter="string",
                                        from_parent="string",
                                        limit="string",
                                        offset="string",
                                        sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("indicator_combined_v1",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          after="string",
                          from_parent=boolean)
print(response)

Get-FalconIoc -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"
  after := "string"
  fromParent := boolean

  response, err := client.Ioc.IndicatorCombinedV1(
    &ioc.IndicatorCombinedV1Params{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      After: &after,
      FromParent: &fromParent,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorCombinedV1(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string",  // after
  boolean  // fromParent
);

console.log(response);

action_get_v1

Get Actions by ids.

GET /iocs/entities/actions/v1

Scope IOC Management: READ Consumes · Produces application/json

PEP 8 action_get

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The ids of the actions to retrieve.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.action_get(ids=id_list)
print(response)

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.action_get_v1(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("action_get_v1",
                          ids=id_list)
print(response)

Get-FalconIocAction -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Ioc.ActionGetV1(
    &ioc.ActionGetV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.actionGetV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

GetIndicatorsReport

Launch an indicators report creation job

POST /iocs/entities/indicators-reports/v1

Scope IOC Management: READ Consumes · Produces application/json

PEP 8 get_indicators_report

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
filter	body	string	FQL formatted string specifying the search filter. Overridden if `search` keyword is provided.
from_parent	body	boolean	Return results for the parent only.
query	body	string	FQL formatted string specifying the search query. Overridden if `search` keyword is provided.
report_format	body	string	Format of the report.
search	body	dictionary	Search parameters provided as a dictionary. Overrides values provided in the `filter`, `query` and `sort` keywords.
sort	body	string	FQL formatted string specifying the sort. Overridden if `search` keyword is provided.

Code Examples

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

search = {
    "filter": "string",
    "query": "string",
    "sort": "string"
}

response = falcon.get_indicators_report(filter="string",
                                        from_parent=boolean,
                                        query="string",
                                        report_format="string",
                                        search=search,
                                        sort="string")
print(response)

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

search = {
    "filter": "string",
    "query": "string",
    "sort": "string"
}

response = falcon.GetIndicatorsReport(filter="string",
                                      from_parent=boolean,
                                      query="string",
                                      report_format="string",
                                      search=search,
                                      sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "from_parent": boolean,
    "report_format": "string",
    "search": {
        "filter": "string",
        "query": "string",
        "sort": "string"
    }
}

response = falcon.command("GetIndicatorsReport", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from_parent := boolean
  report_format := "string"

  response, err := client.Ioc.GetIndicatorsReport(
    &ioc.GetIndicatorsReportParams{
      Body: &models.APIIndicatorsReportRequest{
        FromParent: &from_parent,
        ReportFormat: &report_format,
        Search: &struct{}{},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.getIndicatorsReport(
  {
    fromParent: boolean,
    reportFormat: "string",
    search: {
      filter: "string",
      query: "string",
      sort: "string"
    }
}  // body
);

console.log(response);

use rusty_falcon::apis::ioc_api::get_indicators_report;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiIndicatorsReportRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiIndicatorsReportRequest {
        report_format: Some("string".to_string()),
        search: Default::default(),
        ..Default::default()
    };

    let response = get_indicators_report(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Ioc.new

body = Falcon::ApiIndicatorsReportRequest.new(
  from_parent: boolean,
  report_format: 'string',
  search: {
    filter: 'string',
    query: 'string',
    sort: 'string'
  }
)

response = api.get_indicators_report(body)

puts response

indicator_get_v1

Get Indicators by ids.

GET /iocs/entities/indicators/v1

Scope IOC Management: READ Consumes · Produces application/json

PEP 8 indicator_get

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	The ids of the Indicators to retrieve.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.indicator_get(ids=id_list)
print(response)

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.indicator_get_v1(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("indicator_get_v1",
                          ids=id_list)
print(response)

Get-FalconIoc -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Ioc.IndicatorGetV1(
    &ioc.IndicatorGetV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorGetV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

indicator_create_v1

Create Indicators.

POST /iocs/entities/indicators/v1

Scope IOC Management: WRITE Consumes · Produces application/json

PEP 8 indicator_create

Parameters

Name	Type	Data type	Description
action	body	string	Default action for IOC.
applied_globally	body	boolean	Flag indicating this IOC is applied globally.
body	body	dictionary	Full body payload in JSON format.
comment	body	string	IOC comment.
description	body	string	IOC description.
expiration	body	string	UTC formatted date string.
filename	body	string	Filename to use for the metadata dictionary.
host_groups	body	string or list of strings	List of host groups this IOC applies to.
ignore_warnings	query	boolean	Flag to indicate that warnings are ignored.
indicators	body	list of dictionaries	List of indicators to create. Overrides other keywords excluding `body`. Allows for the creation of multiple indicators at once.
metadata	body	dictionary	Dictionary containing the filename for the IOC. Not required if the `filename` keyword is used.
parameters	query	dictionary	Full query string parameters payload in JSON format.
platforms	body	string or list of strings	Platforms this IOC impacts.
retrodetects	query	boolean	Flag to indicate whether to submit retrodetects.
severity	body	string	IOC severity.
source	body	string	IOC source.
tags	body	string or list of strings	IOC tags.
type	body	string	IOC type.
value	body	string	String representation of the IOC.

Code Examples

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

indicators = [
    {
        "action": "string",
        "applied_globally": true,
        "description": "string",
        "expiration": "2021-10-22T10:40:39.372Z",
        "host_groups": [
            "string"
        ],
        "metadata": {
            "filename": "string"
        },
        "mobile_action": "string",
        "platforms": [
            "string"
        ],
        "severity": "string",
        "source": "string",
        "tags": [
            "string"
        ],
        "type": "string",
        "value": "string"
    }
]

response = falcon.indicator_create(action="string",
                                   applied_globally=boolean,
                                   comment="string",
                                   description="string",
                                   expiration="string",
                                   filename={},
                                   host_groups=["string"],
                                   ignore_warnings=boolean,
                                   indicators=indicators,
                                   metadata={},
                                   mobile_action="string",
                                   platforms="string",
                                   retrodetects=boolean,
                                   severity="string",
                                   source="string",
                                   tags=["string"],
                                   type="string",
                                   value="string")
print(response)

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

indicators = [
    {
        "action": "string",
        "applied_globally": true,
        "description": "string",
        "expiration": "2021-10-22T10:40:39.372Z",
        "host_groups": [
            "string"
        ],
        "metadata": {
            "filename": "string"
        },
        "mobile_action": "string",
        "platforms": [
            "string"
        ],
        "severity": "string",
        "source": "string",
        "tags": [
            "string"
        ],
        "type": "string",
        "value": "string"
    }
]

response = falcon.indicator_create_v1(action="string",
                                      applied_globally=boolean,
                                      comment="string",
                                      description="string",
                                      expiration="string",
                                      filename={},
                                      host_groups=["string"],
                                      ignore_warnings=boolean,
                                      indicators=indicators,
                                      metadata={},
                                      mobile_action="string",
                                      platforms="string",
                                      retrodetects=boolean,
                                      severity="string",
                                      source="string",
                                      tags=["string"],
                                      type="string",
                                      value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "comment": "string",
    "indicators": [
        {
            "action": "string",
            "applied_globally": boolean,
            "description": "string",
            "expiration": "string",
            "host_groups": ["string"],
            "metadata": {
                "filename": "string"
            },
            "mobile_action": "string",
            "platforms": ["string"],
            "severity": "string",
            "source": "string",
            "tags": ["string"],
            "type": "string",
            "value": "string"
        }
    ]
}

response = falcon.command("indicator_create_v1",
                          retrodetects=boolean,
                          ignore_warnings=boolean,
                          body=body_payload)
print(response)

New-FalconIoc -Action "string" `
  -Platform @("ID1", "ID2") `
  -Severity "string" `
  -Type "string" `
  -Value "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  action := "string"
  applied_globally := boolean
  description := "string"
  expiration := "string"
  mobile_action := "string"
  severity := "string"
  source := "string"
  type := "string"
  value := "string"
  retrodetects := boolean
  ignoreWarnings := boolean

  response, err := client.Ioc.IndicatorCreateV1(
    &ioc.IndicatorCreateV1Params{
      Body: &models.APIIndicatorCreateReqsV1{
        Comment: &comment,
        Indicators: []interface{}{
          {
          Action: &action,
          AppliedGlobally: &applied_globally,
          Description: &description,
          Expiration: &expiration,
          HostGroups: []string{"string"},
          Metadata: &struct{}{},
          MobileAction: &mobile_action,
          Platforms: []string{"string"},
          Severity: &severity,
          Source: &source,
          Tags: []string{"string"},
          Type: &type,
          Value: &value,
          },
        },
      },
      Retrodetects: &retrodetects,
      IgnoreWarnings: &ignoreWarnings,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorCreateV1(
  {  // body
      comment: "string",
      indicators: [{
          action: "string",
          appliedGlobally: boolean,
          description: "string",
          expiration: "string",
          hostGroups: [],
          metadata: {
            filename: "string"
          },
          mobileAction: "string",
          platforms: [],
          severity: "string",
          source: "string",
          tags: [],
          type: "string",
          value: "string"
        }]
  },
  boolean,  // retrodetects
  boolean  // ignoreWarnings
);

console.log(response);

indicator_delete_v1

Delete Indicators by ids or a filter.

DELETE /iocs/entities/indicators/v1

Scope IOC Management: WRITE Consumes · Produces application/json

PEP 8 indicator_delete

Parameters

Name	Type	Data type	Description
filter	query	string	FQL Syntax formatted filter that should be used to delete indicators in bulk. If both `filter` and `ids` are provided, then `filter` takes precedence and `ids` is ignored.
from_parent	query	boolean	Limit action to IOCs originating from the MSSP parent.
ids	query	string or list of strings	The ids of the Indicators to delete. If both `filter` and `ids` are provided, then `filter` takes precedence and `ids` is ignored.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.indicator_delete(ids=id_list, from_parent="string")
print(response)

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.indicator_delete_v1(ids=id_list, from_parent="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("indicator_delete_v1",
                          filter="string",
                          ids=id_list,
                          comment="string",
                          from_parent=boolean)
print(response)

Remove-FalconIoc

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  comment := "string"
  fromParent := boolean

  response, err := client.Ioc.IndicatorDeleteV1(
    &ioc.IndicatorDeleteV1Params{
      Filter: &filter,
      Ids: []string{"ID1", "ID2", "ID3"},
      Comment: &comment,
      FromParent: &fromParent,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorDeleteV1(
  "string",  // filter
  ["ID1", "ID2", "ID3"],  // ids
  "string",  // comment
  boolean  // fromParent
);

console.log(response);

indicator_update_v1

Update Indicators.

PATCH /iocs/entities/indicators/v1

Scope IOC Management: WRITE Consumes · Produces application/json

PEP 8 indicator_update

Parameters

Name	Type	Data type	Description
action	body	string	Default action for IOC.
applied_globally	body	boolean	Flag indicating this IOC is applied globally.
body	body	dictionary	Full body payload in JSON format.
bulk_update	body	dictionary	Dictionary containing the indicator update in JSON format. Not necessary when using other keywords.
comment	body	string	IOC comment.
description	body	string	IOC description.
expiration	body	string	UTC formatted date string.
filename	body	string	Filename to use for the metadata dictionary.
from_parent	body	boolean	Return results for the parent only.
host_groups	body	string or list of strings	List of host groups this IOC applies to.
id	body	string	The Indicator ID to be updated. At least one ID must be specified using this keyword, or as part of the indicators list using the `indicators` keyword.
ignore_warnings	query	boolean	Flag to indicate that warnings are ignored.
indicators	body	list of dictionaries	List of indicators to create. Overrides other keywords excluding `body`. Allows for the creation of multiple indicators at once.
metadata	body	dictionary	Dictionary containing the filename for the IOC. Not required if the `filename` keyword is used.
mobile_action	body	string	Mobile action to perform.
parameters	query	dictionary	Full query string parameters payload in JSON format.
platforms	body	string or list of strings	Platforms this IOC impacts.
retrodetects	query	boolean	Flag to indicate whether to submit retrodetects.
severity	body	string	IOC severity.
source	body	string	IOC source.
tags	body	string or list of strings	IOC tags.
type	body	string	IOC type.
value	body	string	String representation of the IOC.

Code Examples

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

bulk_update = {
    "action": "string",
    "applied_globally": true,
    "description": "string",
    "expiration": "2021-10-22T11:03:16.123Z",
    "filter": "string",
    "from_parent": true,
    "host_groups": [
        "string"
    ],
    "mobile_action": "string",
    "platforms": [
        "string"
    ],
    "severity": "string",
    "source": "string",
    "tags": [
        "string"
    ]
}

indicators = [
    {
        "action": "string",
        "applied_globally": true,
        "description": "string",
        "expiration": "2021-10-22T11:03:16.123Z",
        "host_groups": [
            "string"
        ],
        "id": "string",
        "metadata": {
            "filename": "string"
        },
        "mobile_action": "string",
        "platforms": [
            "string"
        ],
        "severity": "string",
        "source": "string",
        "tags": [
            "string"
        ]
    }
]

response = falcon.indicator_update(action="string",
                                   applied_globally=boolean,
                                   bulk_update=bulk_update,
                                   comment="string",
                                   description="string",
                                   expiration="string",
                                   filename={},
                                   from_parent=boolean,
                                   host_groups=["string"],
                                   id="string",
                                   indicators=indicators,
                                   ignore_warnings=boolean,
                                   metadata={},
                                   mobile_action="string",
                                   platforms="string",
                                   retrodetects=boolean,
                                   severity="string",
                                   source="string",
                                   tags=["string"],
                                   type="string",
                                   value="string")
print(response)

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

bulk_update = {
    "action": "string",
    "applied_globally": true,
    "description": "string",
    "expiration": "2021-10-22T11:03:16.123Z",
    "filter": "string",
    "from_parent": true,
    "host_groups": [
        "string"
    ],
    "mobile_action": "string",
    "platforms": [
        "string"
    ],
    "severity": "string",
    "source": "string",
    "tags": [
        "string"
    ]
}

indicators = [
    {
        "action": "string",
        "applied_globally": true,
        "description": "string",
        "expiration": "2021-10-22T11:03:16.123Z",
        "host_groups": [
            "string"
        ],
        "id": "string",
        "metadata": {
            "filename": "string"
        },
        "mobile_action": "string",
        "platforms": [
            "string"
        ],
        "severity": "string",
        "source": "string",
        "tags": [
            "string"
        ]
    }
]

response = falcon.indicator_update_v1(action="string",
                                      applied_globally=boolean,
                                      bulk_update=bulk_update,
                                      comment="string",
                                      description="string",
                                      expiration="string",
                                      filename={},
                                      from_parent=boolean,
                                      host_groups=["string"],
                                      id="string",
                                      indicators=indicators,
                                      ignore_warnings=boolean,
                                      metadata={},
                                      mobile_action="string",
                                      platforms="string",
                                      retrodetects=boolean,
                                      severity="string",
                                      source="string",
                                      tags=["string"],
                                      type="string",
                                      value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "bulk_update": {
        "action": "string",
        "applied_globally": boolean,
        "description": "string",
        "expiration": "string",
        "filter": "string",
        "from_parent": boolean,
        "host_groups": ["string"],
        "metadata": {
            "filename": "string"
        },
        "mobile_action": "string",
        "platforms": ["string"],
        "severity": "string",
        "source": "string",
        "tags": ["string"]
    },
    "comment": "string",
    "indicators": [
        {
            "action": "string",
            "applied_globally": boolean,
            "description": "string",
            "expiration": "string",
            "host_groups": ["string"],
            "id": "string",
            "metadata": {
                "filename": "string"
            },
            "mobile_action": "string",
            "platforms": ["string"],
            "severity": "string",
            "source": "string",
            "tags": ["string"]
        }
    ]
}

response = falcon.command("indicator_update_v1",
                          retrodetects=boolean,
                          ignore_warnings=boolean,
                          body=body_payload)
print(response)

Edit-FalconIoc -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  action := "string"
  applied_globally := boolean
  description := "string"
  expiration := "string"
  id := "string"
  mobile_action := "string"
  severity := "string"
  source := "string"
  retrodetects := boolean
  ignoreWarnings := boolean

  response, err := client.Ioc.IndicatorUpdateV1(
    &ioc.IndicatorUpdateV1Params{
      Body: &models.APIIndicatorUpdateReqsV1{
        BulkUpdate: &struct{}{},
        Comment: &comment,
        Indicators: []interface{}{
          {
          Action: &action,
          AppliedGlobally: &applied_globally,
          Description: &description,
          Expiration: &expiration,
          HostGroups: []string{"string"},
          ID: &id,
          Metadata: &struct{}{},
          MobileAction: &mobile_action,
          Platforms: []string{"string"},
          Severity: &severity,
          Source: &source,
          Tags: []string{"string"},
          },
        },
      },
      Retrodetects: &retrodetects,
      IgnoreWarnings: &ignoreWarnings,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorUpdateV1(
  {  // body
      bulkUpdate: {
        action: "string",
        appliedGlobally: boolean,
        description: "string",
        expiration: "string",
        filter: "string",
        fromParent: boolean,
        hostGroups: [],
        metadata: {
          filename: "string"
        },
        mobileAction: "string",
        platforms: [],
        severity: "string",
        source: "string",
        tags: []
      },
      comment: "string",
      indicators: [{
          action: "string",
          appliedGlobally: boolean,
          description: "string",
          expiration: "string",
          hostGroups: [],
          id: "string",
          metadata: {
            filename: "string"
          },
          mobileAction: "string",
          platforms: [],
          severity: "string",
          source: "string",
          tags: []
        }]
  },
  boolean,  // retrodetects
  boolean  // ignoreWarnings
);

console.log(response);

action_query_v1

Query Actions.

GET /iocs/queries/actions/v1

Scope IOC Management: READ Consumes · Produces application/json

PEP 8 action_query

Parameters

Name	Type	Data type	Description
limit	query	integer	Maximum number of results to return.
offset	query	string	The offset to start retrieving records from.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.action_query(limit=integer, offset="string")
print(response)

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.action_query_v1(limit=integer, offset="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("action_query_v1",
                          offset="string",
                          limit=integer)
print(response)

Get-FalconIocAction -Limit integer -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)

  response, err := client.Ioc.ActionQueryV1(
    &ioc.ActionQueryV1Params{
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.actionQueryV1(
  "string",  // offset
  integer  // limit
);

console.log(response);

indicator_search_v1

Search for Indicators.

GET /iocs/queries/indicators/v1

Scope IOC Management: READ Consumes · Produces application/json

PEP 8 indicator_search

Parameters

Name	Type	Data type	Description
after	query	string	A pagination token used with the `limit` parameter to manage pagination of results. On your first request, don’t provide an `after` token. On subsequent requests, provide the `after` token from the previous response to continue from that place in the results. To access more than 10k indicators, use the `after` parameter instead of `offset`.
filter	query	string	FQL Syntax formatted filter that should be used to limit the results. Available filters: type, value, action, severity, platforms, tags, expiration, expired, applied_globally, host_groups, created_on, created_by, modified_on, modified_by, source.
from_parent	query	boolean	Return results for the parent only.
limit	query	integer	Maximum number of results to return.
offset	query	integer	The offset to start retrieving records from. Offset and After params are mutually exclusive. If none provided then scrolling will be used by default. To access more than 10k iocs, use the `after` parameter instead of `offset`.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sort	query	string	FQL Syntax formatted sort filter.

Code Examples

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.indicator_search(after="string",
                                   filter="string",
                                   from_parent="string",
                                   limit="string",
                                   offset="string",
                                   sort="string")
print(response)

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.indicator_search_v1(after="string",
                                      filter="string",
                                      from_parent="string",
                                      limit="string",
                                      offset="string",
                                      sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("indicator_search_v1",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          after="string",
                          from_parent=boolean)
print(response)

Get-FalconIoc -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"
  after := "string"
  fromParent := boolean

  response, err := client.Ioc.IndicatorSearchV1(
    &ioc.IndicatorSearchV1Params{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      After: &after,
      FromParent: &fromParent,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorSearchV1(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string",  // after
  boolean  // fromParent
);

console.log(response);

ioc_type_query_v1

Query IOC Types.

GET /iocs/queries/ioc-types/v1

Scope IOC Management: READ Consumes · Produces application/json

PEP 8 ioc_type_query

Parameters

Name	Type	Data type	Description
limit	query	integer	Maximum number of results to return.
offset	query	string	The offset to start retrieving records from.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.ioc_type_query(limit=integer, offset="string")
print(response)

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.ioc_type_query_v1(limit=integer, offset="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ioc_type_query_v1",
                          offset="string",
                          limit=integer)
print(response)

Get-FalconIocType -Limit integer -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)

  response, err := client.Ioc.IocTypeQueryV1(
    &ioc.IocTypeQueryV1Params{
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.iocTypeQueryV1(
  "string",  // offset
  integer  // limit
);

console.log(response);

platform_query_v1

Query Platforms.

GET /iocs/queries/platforms/v1

Scope IOC Management: READ Consumes · Produces application/json

PEP 8 platform_query

Parameters

Name	Type	Data type	Description
limit	query	integer	Maximum number of results to return.
offset	query	string	The offset to start retrieving records from.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.platform_query(limit=integer, offset="string")
print(response)

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.platform_query_v1(limit=integer, offset="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("platform_query_v1",
                          offset="string",
                          limit=integer)
print(response)

Get-FalconIocPlatform -Limit integer -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)

  response, err := client.Ioc.PlatformQueryV1(
    &ioc.PlatformQueryV1Params{
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.platformQueryV1(
  "string",  // offset
  integer  // limit
);

console.log(response);

severity_query_v1

Query Severities.

GET /iocs/queries/severities/v1

Scope IOC Management: READ Consumes · Produces application/json

PEP 8 severity_query

Parameters

Name	Type	Data type	Description
limit	query	integer	Maximum number of results to return.
offset	query	string	The offset to start retrieving records from.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.severity_query(limit=integer, offset="string")
print(response)

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.severity_query_v1(limit=integer, offset="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("severity_query_v1",
                          offset="string",
                          limit=integer)
print(response)

Get-FalconIocSeverity -Limit integer -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)

  response, err := client.Ioc.SeverityQueryV1(
    &ioc.SeverityQueryV1Params{
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.severityQueryV1(
  "string",  // offset
  integer  // limit
);

console.log(response);

indicator_get_device_count_v1

Number of hosts in your customer account that have observed a given custom IOC

PEP8 method name

devices_count (or indicator_get_device_count_v1)

GET /iocs/aggregates/indicators/device-count/v1

Scope IOC Management: READ Consumes · Produces application/json

PEP 8 devices_count

Parameters

Name	Type	Data type	Description
type	query	string	The type of the indicator. Valid types include: `sha256` (hex-encoded sha256 hash, length 64), `md5` (hex-encoded md5 hash, length 32), `domain` (domain name, length 1-200), `ipv4` (valid IPv4 address), `ipv6` (valid IPv6 address).
value	query	string	The string representation of the indicator.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.devices_count(type="string", value="string")
print(response)

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.indicator_get_device_count_v1(type="string", value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("indicator_get_device_count_v1",
                          type="string",
                          value="string")
print(response)

Get-FalconIocHost -Type "string" -Value "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Ioc.IndicatorGetDeviceCountV1(
    &ioc.IndicatorGetDeviceCountV1Params{
      Type: "string",
      Value: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorGetDeviceCountV1(
  "string",  // type
  "string"  // value
);

console.log(response);

indicator_get_devices_ran_on_v1

Find hosts that have observed a given custom IOC.

PEP8 method name

devices_ran_on (or indicator_get_devices_ran_on_v1)

GET /iocs/queries/indicators/devices/v1

Scope IOC Management: READ Consumes · Produces application/json

PEP 8 devices_ran_on

Parameters

Name	Type	Data type	Description
type	query	string	The type of the indicator. Valid types include: `sha256` (hex-encoded sha256 hash, length 64), `md5` (hex-encoded md5 hash, length 32), `domain` (domain name, length 1-200), `ipv4` (valid IPv4 address), `ipv6` (valid IPv6 address).
value	query	string	The string representation of the indicator.
limit	query	integer	Maximum number of results to return.
offset	query	integer	Starting offset to begin returning results.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.devices_ran_on(type="string",
                                 limit="string",
                                 offset="string",
                                 value="string")
print(response)

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.indicator_get_devices_ran_on_v1(type="string",
                                                  limit="string",
                                                  offset="string",
                                                  value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("indicator_get_devices_ran_on_v1",
                          type="string",
                          value="string",
                          limit="string",
                          offset="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := "string"
  offset := "string"

  response, err := client.Ioc.IndicatorGetDevicesRanOnV1(
    &ioc.IndicatorGetDevicesRanOnV1Params{
      Type: "string",
      Value: "string",
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorGetDevicesRanOnV1(
  "string",  // type
  "string",  // value
  "string",  // limit
  "string"  // offset
);

console.log(response);

indicator_get_processes_ran_on_v1

Search for processes associated with a custom IOC

PEP8 method name

processes_ran_on or (indicator_get_processes_ran_on_v1)

GET /iocs/queries/indicators/processes/v1

Scope IOC Management: READ Consumes · Produces application/json

PEP 8 processes_ran_on

Parameters

Name	Type	Data type	Description
type	query	string	The type of the indicator. Valid types include: `sha256` (hex-encoded sha256 hash, length 64), `md5` (hex-encoded md5 hash, length 32), `domain` (domain name, length 1-200), `ipv4` (valid IPv4 address), `ipv6` (valid IPv6 address).
value	query	string	The string representation of the indicator.
device_id	query	string	Specify a Host AID to return only processes from that host.
limit	query	integer	Maximum number of results to return.
offset	query	integer	Starting offset to begin returning results.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.processes_ran_on(type="string",
                                   limit="string",
                                   offset="string",
                                   device_id="string",
                                   value="string")
print(response)

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.indicator_get_processes_ran_on_v1(type="string",
                                                    limit="string",
                                                    offset="string",
                                                    device_id="string",
                                                    value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("indicator_get_processes_ran_on_v1",
                          type="string",
                          value="string",
                          device_id="string",
                          limit="string",
                          offset="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := "string"
  offset := "string"

  response, err := client.Ioc.IndicatorGetProcessesRanOnV1(
    &ioc.IndicatorGetProcessesRanOnV1Params{
      Type: "string",
      Value: "string",
      DeviceID: "string",
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorGetProcessesRanOnV1(
  "string",  // type
  "string",  // value
  "string",  // deviceId
  "string",  // limit
  "string"  // offset
);

console.log(response);

entities_processes

For the provided ProcessID retrieve the process details

GET /processes/entities/processes/v1

Scope IOCs (Indicators of Compromise): READ Consumes · Produces application/json

PEP 8 entities_processes

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	ProcessID for the running process you want to lookup.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_processes(ids=id_list)
print(response)

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_processes(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_processes",
                          ids=id_list)
print(response)

Get-FalconIocProcess -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/iocs"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Iocs.EntitiesProcesses(
    &iocs.EntitiesProcessesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.iocs.entitiesProcesses(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

IOC

Table of Contents

indicator_aggregate_v1

Parameters

Code Examples

indicator_combined_v1

Parameters

Code Examples

action_get_v1

Parameters

Code Examples

GetIndicatorsReport

Parameters

Code Examples

indicator_get_v1

Parameters

Code Examples

indicator_create_v1

Parameters

Code Examples

indicator_delete_v1

Parameters

Code Examples

indicator_update_v1

Parameters

Code Examples

action_query_v1

Parameters

Code Examples

indicator_search_v1

Parameters

Code Examples

ioc_type_query_v1

Parameters

Code Examples

platform_query_v1

Parameters

Code Examples

severity_query_v1

Parameters

Code Examples

indicator_get_device_count_v1

PEP8 method name

Parameters

Code Examples

indicator_get_devices_ran_on_v1

PEP8 method name

Parameters

Code Examples

indicator_get_processes_ran_on_v1

PEP8 method name

Parameters

Code Examples

entities_processes

Parameters

Code Examples