IOC

The IOC service collection provides operations for managing custom Indicators of Compromise (IOC) within your CrowdStrike environment. Create, update, delete, and search for indicators. Query aggregates, retrieve action and type information, and look up device and process data associated with custom IOCs.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
action.get.v1 action_get	Get Actions by ids.
action.query.v1 action_query	Query Actions.
GetIndicatorsReport get_indicators_report	Launch an indicators report creation job
indicator.aggregate.v1 indicator_aggregate	Get Indicators aggregates as specified via json in the request body.
indicator.combined.v1 indicator_combined	Get Combined for Indicators.
indicator.create.v1 indicator_create	Create Indicators.
indicator.delete.v1 indicator_delete	Delete Indicators by ids.
indicator.get.device_count.v1 devices_count	Get the number of devices the indicator has run on
indicator.get.devices_ran_on.v1 devices_ran_on	Get the IDs of devices the indicator has run on
indicator.get.processes_ran_on.v1 processes_ran_on	Get the number of processes the indicator has run on
indicator.get.v1 indicator_get	Get Indicators by ids.
indicator.sdmf-query.v1 indicator_sdmf_query_v1	Executes an SDMF data frame query against IOC indicators
indicator.search.v1 indicator_search	Search for Indicators.
indicator.update.v1 indicator_update	Update Indicators.
ioc_type.query.v1 ioc_type_query	Query IOC Types.
platform.query.v1 platform_query	Query Platforms.
severity.query.v1 severity_query	Query Severities.

---

action.get.v1

Get Actions by ids.

Method GET

Route /iocs/entities/actions/v1

Scope IOC Management: READ

PEP 8 action_get

Parameters

ids query · string or list of strings

The ids of the Actions to retrieve

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.action_get(ids=id_list)
print(response)

Operation ID

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.action_get_v1(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("action_get_v1",
                          ids=id_list)
print(response)

PowerShell

Get-FalconIocAction -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Ioc.ActionGetV1(
    &ioc.ActionGetV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.actionGetV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::ioc_api::action_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = action_get_v1(
        &falcon.cfg,  // configuration
        Some(vec!["string".to_string()]),  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Ioc.new

response = api.action_get_v1(ids: ['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "id": "string",
    "platforms_by_type": {},
    "severities": []
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

action.query.v1

Query Actions.

Method GET

Route /iocs/queries/actions/v1

Scope IOC Management: READ

PEP 8 action_query

Parameters

offset query · string

Starting index of overall result set from which to return ids.

limit query · integer

Number of ids to return.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.action_query(limit=integer, offset="string")
print(response)

Operation ID

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.action_query_v1(limit=integer, offset="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("action_query_v1",
                          offset="string",
                          limit=integer)
print(response)

PowerShell

Get-FalconIocAction -Limit integer -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)

  response, err := client.Ioc.ActionQueryV1(
    &ioc.ActionQueryV1Params{
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.actionQueryV1(
  "string",  // offset
  integer  // limit
);

console.log(response);

Rust

use rusty_falcon::apis::ioc_api::action_query_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = action_query_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Ioc.new

response = api.action_query_v1(offset: 'string', limit: integer)

puts response

Responses

200 OK

[
  "string"
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

GetIndicatorsReport

Launch an indicators report creation job

Method POST

Route /iocs/entities/indicators-reports/v1

Scope IOC Management: READ

PEP 8 get_indicators_report

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

from_parent body · boolean

Flag indicating if this indicator is defined in the parent.

report_format body · string

Format of the report.

search body · object

Search parameters. Strings are in FQL format.

filter body · string

FQL formatted string specifying the search filter. Overridden if ‘search’ keyword is provided.

query body · string

FQL formatted string specifying the search query. Overridden if ‘search’ keyword is provided.

sort body · string

FQL formatted string specifying the search sort. Overridden if ‘search’ keyword is provided.

Code Examples

Python

PEP 8

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

search = {
    "filter": "string",
    "query": "string",
    "sort": "string"
}

response = falcon.get_indicators_report(filter="string",
                                        from_parent=boolean,
                                        query="string",
                                        report_format="string",
                                        search=search,
                                        sort="string")
print(response)

Operation ID

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

search = {
    "filter": "string",
    "query": "string",
    "sort": "string"
}

response = falcon.GetIndicatorsReport(filter="string",
                                      from_parent=boolean,
                                      query="string",
                                      report_format="string",
                                      search=search,
                                      sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "from_parent": boolean,
    "report_format": "string",
    "search": {
        "filter": "string",
        "query": "string",
        "sort": "string"
    }
}

response = falcon.command("GetIndicatorsReport", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from_parent := boolean
  report_format := "string"

  response, err := client.Ioc.GetIndicatorsReport(
    &ioc.GetIndicatorsReportParams{
      Body: &models.APIIndicatorsReportRequest{
        FromParent: &from_parent,
        ReportFormat: &report_format,
        Search: &struct{}{},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.getIndicatorsReport(
  {
    fromParent: boolean,
    reportFormat: "string",
    search: {
      filter: "string",
      query: "string",
      sort: "string"
    }
}  // body
);

console.log(response);

Rust

use rusty_falcon::apis::ioc_api::get_indicators_report;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiIndicatorsReportRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiIndicatorsReportRequest {
        report_format: Some("string".to_string()),
        search: Default::default(),
        ..Default::default()
    };

    let response = get_indicators_report(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Ioc.new

body = Falcon::ApiIndicatorsReportRequest.new(
  from_parent: boolean,
  report_format: 'string',
  search: {
    filter: 'string',
    query: 'string',
    sort: 'string'
  }
)

response = api.get_indicators_report(body)

puts response

Responses

200 OK

{}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

indicator.aggregate.v1

Get Indicators aggregates as specified via json in the request body.

Method POST

Route /iocs/aggregates/indicators/v1

Scope IOC Management: READ

PEP 8 indicator_aggregate

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

date_ranges body · array

If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.

exclude body · string

Fields to exclude.

extended_bounds body · object

field body · string

Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.

filters_spec body · object

from body · integer

include body · string

Fields to include.

interval body · string

Available values (6)

year	month	week
day	hour	minute

max_doc_count body · integer

Maximum number of documents.

min_doc_count body · integer

Minimum number of documents.

missing body · string

name body · string

Scan name.

percents body · array

q body · string

FQL syntax.

ranges body · array

size body · integer

sort body · string

FQL syntax.

Available values (2)

_count

sort by document count

_term

sort by the string value alphabetically

sub_aggregates body · array

time_zone body · string

type body · string

Available values (10)

date_histogram

Aggregates counts on a specified time interval. Requires use of “interval” field.

date_range

Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601.

terms

Buckets alerts by the value of a specified field. For example, if field used is scenario, then alerts will be bucketed by the various alert scenario names.

range

Buckets alerts by specified (numeric) ranges of a specified field. For example, if doing a range aggregation on the max_severity field, the alerts will be counted by the specified ranges of severity.

cardinality

Returns the count of distinct values in a specified field.

max

Returns the maximum value of a specified field.

min

Returns the minimum value of a specified field.

avg

Returns the average value of the specified field.

sum

Returns the total sum of all values for the specified field.

percentiles

Returns the following percentiles for the specified field: 1, 5, 25, 50, 75, 95, 99.

filter query · string

FQL syntax formatted string to use to filter the results.

from_parent query · boolean

The filter for returning either only indicators for the request customer or its MSSP parents

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

response = falcon.indicator_aggregate(date_ranges=date_ranges,
                                      exclude="string",
                                      field="string",
                                      filter="string",
                                      from=integer,
                                      include="string",
                                      interval="string",
                                      max_doc_count=integer,
                                      min_doc_count=integer,
                                      missing="string",
                                      name="string",
                                      q="string",
                                      ranges=ranges,
                                      size=integer,
                                      sort="string",
                                      sub_aggregates=["string"],
                                      time_zone="string",
                                      type="string")
print(response)

Operation ID

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

response = falcon.indicator_aggregate_v1(date_ranges=date_ranges,
                                         exclude="string",
                                         field="string",
                                         filter="string",
                                         from=integer,
                                         include="string",
                                         interval="string",
                                         max_doc_count=integer,
                                         min_doc_count=integer,
                                         missing="string",
                                         name="string",
                                         q="string",
                                         ranges=ranges,
                                         size=integer,
                                         sort="string",
                                         sub_aggregates=["string"],
                                         time_zone="string",
                                         type="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "date_ranges": [
        {
            "from": "string",
            "to": "string"
        }
    ],
    "exclude": "string",
    "extended_bounds": {
        "max": "string",
        "min": "string"
    },
    "field": "string",
    "filter": "string",
    "filters_spec": {
        "filters": {},
        "other_bucket": boolean,
        "other_bucket_key": "string"
    },
    "from": integer,
    "include": "string",
    "interval": "string",
    "max_doc_count": integer,
    "min_doc_count": integer,
    "missing": "string",
    "name": "string",
    "percents": ["string"],
    "q": "string",
    "ranges": [
        {
            "from": integer,
            "to": integer
        }
    ],
    "size": integer,
    "sort": "string",
    "sub_aggregates": [
        {
            "date_ranges": [
                {
                    "from": "string",
                    "to": "string"
                }
            ],
            "exclude": "string",
            "extended_bounds": {
                "max": "string",
                "min": "string"
            },
            "field": "string",
            "filter": "string",
            "filters_spec": {
                "filters": {},
                "other_bucket": boolean,
                "other_bucket_key": "string"
            },
            "from": integer,
            "include": "string",
            "interval": "string",
            "max_doc_count": integer,
            "min_doc_count": integer,
            "missing": "string",
            "name": "string",
            "percents": ["string"],
            "q": "string",
            "ranges": [
                {
                    "from": integer,
                    "to": integer
                }
            ],
            "size": integer,
            "sort": "string",
            "sub_aggregates": [
                {
                    "date_ranges": ["string"],
                    "exclude": "string",
                    "extended_bounds": {},
                    "field": "string",
                    "filter": "string",
                    "filters_spec": {},
                    "from": integer,
                    "include": "string",
                    "interval": "string",
                    "max_doc_count": integer,
                    "min_doc_count": integer,
                    "missing": "string",
                    "name": "string",
                    "percents": ["string"],
                    "q": "string",
                    "ranges": ["string"],
                    "size": integer,
                    "sort": "string",
                    "sub_aggregates": ["string"],
                    "time_zone": "string",
                    "type": "string"
                }
            ],
            "time_zone": "string",
            "type": "string"
        }
    ],
    "time_zone": "string",
    "type": "string"
}

response = falcon.command("indicator_aggregate_v1",
                          filter="string",
                          from_parent=boolean,
                          body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from := "string"
  to := "string"
  exclude := "string"
  field := "string"
  filter := "string"
  from := integer
  include := "string"
  interval := "string"
  max_doc_count := integer
  min_doc_count := integer
  missing := "string"
  name := "string"
  q := "string"
  From := integer
  To := integer
  size := integer
  sort := "string"
  time_zone := "string"
  typeVar := "string"
  filter := "string"
  fromParent := boolean

  response, err := client.Ioc.IndicatorAggregateV1(
    &ioc.IndicatorAggregateV1Params{
      Body: &models.MsaAggregateQueryRequest{
        DateRanges: []interface{}{
          {
          From: &from,
          To: &to,
          },
        },
        Exclude: &exclude,
        ExtendedBounds: &struct{}{},
        Field: &field,
        Filter: &filter,
        FiltersSpec: &struct{}{},
        From: &from,
        Include: &include,
        Interval: &interval,
        MaxDocCount: &max_doc_count,
        MinDocCount: &min_doc_count,
        Missing: &missing,
        Name: &name,
        Percents: []interface{}{},
        Q: &q,
        Ranges: []interface{}{
          {
          From: &From,
          To: &To,
          },
        },
        Size: &size,
        Sort: &sort,
        SubAggregates: []interface{}{
          {
          DateRanges: []interface{}{
            {
            From: &from,
            To: &to,
            },
          },
          Exclude: &exclude,
          ExtendedBounds: &struct{}{},
          Field: &field,
          Filter: &filter,
          FiltersSpec: &struct{}{},
          From: &from,
          Include: &include,
          Interval: &interval,
          MaxDocCount: &max_doc_count,
          MinDocCount: &min_doc_count,
          Missing: &missing,
          Name: &name,
          Percents: []interface{}{},
          Q: &q,
          Ranges: []interface{}{
            {
            From: &From,
            To: &To,
            },
          },
          Size: &size,
          Sort: &sort,
          SubAggregates: []interface{}{
            {
            DateRanges: []interface{}{},
            Exclude: &exclude,
            ExtendedBounds: &struct{}{},
            Field: &field,
            Filter: &filter,
            FiltersSpec: &struct{}{},
            From: &from,
            Include: &include,
            Interval: &interval,
            MaxDocCount: &max_doc_count,
            MinDocCount: &min_doc_count,
            Missing: &missing,
            Name: &name,
            Percents: []interface{}{},
            Q: &q,
            Ranges: []interface{}{},
            Size: &size,
            Sort: &sort,
            SubAggregates: []interface{}{},
            TimeZone: &time_zone,
            Type: &typeVar,
            },
          },
          TimeZone: &time_zone,
          Type: &typeVar,
          },
        },
        TimeZone: &time_zone,
        Type: &typeVar,
      },
      Filter: &filter,
      FromParent: &fromParent,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorAggregateV1(
  {  // body
      dateRanges: [{
          from: "string",
          to: "string"
        }],
      exclude: "string",
      extendedBounds: {
        max: "string",
        min: "string"
      },
      field: "string",
      filter: "string",
      filtersSpec: {
        filters: {},
        otherBucket: boolean,
        otherBucketKey: "string"
      },
      from: integer,
      include: "string",
      interval: "string",
      maxDocCount: integer,
      minDocCount: integer,
      missing: "string",
      name: "string",
      percents: [],
      q: "string",
      ranges: [{
          From: integer,
          To: integer
        }],
      size: integer,
      sort: "string",
      subAggregates: [{
          dateRanges: [{
              from: "string",
              to: "string"
            }],
          exclude: "string",
          extendedBounds: {
            max: "string",
            min: "string"
          },
          field: "string",
          filter: "string",
          filtersSpec: {
            filters: {},
            otherBucket: boolean,
            otherBucketKey: "string"
          },
          from: integer,
          include: "string",
          interval: "string",
          maxDocCount: integer,
          minDocCount: integer,
          missing: "string",
          name: "string",
          percents: [],
          q: "string",
          ranges: [{
              From: integer,
              To: integer
            }],
          size: integer,
          sort: "string",
          subAggregates: [{
              dateRanges: [],
              exclude: "string",
              extendedBounds: {},
              field: "string",
              filter: "string",
              filtersSpec: {},
              from: integer,
              include: "string",
              interval: "string",
              maxDocCount: integer,
              minDocCount: integer,
              missing: "string",
              name: "string",
              percents: [],
              q: "string",
              ranges: [],
              size: integer,
              sort: "string",
              subAggregates: [],
              timeZone: "string",
              type: "string"
            }],
          timeZone: "string",
          type: "string"
        }],
      timeZone: "string",
      type: "string"
  },
  "string",  // filter
  boolean  // fromParent
);

console.log(response);

Rust

use rusty_falcon::apis::ioc_api::indicator_aggregate_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaAggregateQueryRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaAggregateQueryRequest {
        date_ranges: vec![DateRangeSpec {
            from: Some("string".to_string()),
            to: Some("string".to_string()),
            ..Default::default()
        }],
        exclude: Some("string".to_string()),
        field: Some("string".to_string()),
        filter: Some("string".to_string()),
        filters_spec: Default::default(),
        from: Some(integer),
        include: Some("string".to_string()),
        interval: Some("string".to_string()),
        missing: Some("string".to_string()),
        name: Some("string".to_string()),
        percents: vec![],
        q: Some("string".to_string()),
        ranges: vec![RangeSpec {
            from: Some(integer),
            to: Some(integer),
            ..Default::default()
        }],
        size: Some(integer),
        sort: Some("string".to_string()),
        sub_aggregates: vec![AggregateQueryRequest {
            date_ranges: vec![DateRangeSpec {
                from: Some("string".to_string()),
                to: Some("string".to_string()),
                ..Default::default()
            }],
            exclude: Some("string".to_string()),
            field: Some("string".to_string()),
            filter: Some("string".to_string()),
            filters_spec: Default::default(),
            from: Some(integer),
            include: Some("string".to_string()),
            interval: Some("string".to_string()),
            missing: Some("string".to_string()),
            name: Some("string".to_string()),
            percents: vec![],
            q: Some("string".to_string()),
            ranges: vec![RangeSpec {
                from: Some(integer),
                to: Some(integer),
                ..Default::default()
            }],
            size: Some(integer),
            sort: Some("string".to_string()),
            sub_aggregates: vec![AggregateQueryRequest {
                date_ranges: vec![],
                exclude: Some("string".to_string()),
                field: Some("string".to_string()),
                filter: Some("string".to_string()),
                filters_spec: Default::default(),
                from: Some(integer),
                include: Some("string".to_string()),
                interval: Some("string".to_string()),
                missing: Some("string".to_string()),
                name: Some("string".to_string()),
                percents: vec![],
                q: Some("string".to_string()),
                ranges: vec![],
                size: Some(integer),
                sort: Some("string".to_string()),
                sub_aggregates: vec![],
                time_zone: Some("string".to_string()),
                type: Some("string".to_string()),
                ..Default::default()
            }],
            time_zone: Some("string".to_string()),
            type: Some("string".to_string()),
            ..Default::default()
        }],
        time_zone: Some("string".to_string()),
        type: Some("string".to_string()),
        ..Default::default()
    };

    let response = indicator_aggregate_v1(
        &falcon.cfg,  // configuration
        body,  // body
        Some("string"),  // filter
        Some(boolean),  // from_parent
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Ioc.new

body = Falcon::MsaAggregateQueryRequest.new(
  date_ranges: [{
      from: 'string',
      to: 'string'
    }],
  exclude: 'string',
  extended_bounds: {
    max: 'string',
    min: 'string'
  },
  field: 'string',
  filter: 'string',
  filters_spec: {
    filters: {},
    other_bucket: boolean,
    other_bucket_key: 'string'
  },
  from: integer,
  include: 'string',
  interval: 'string',
  max_doc_count: integer,
  min_doc_count: integer,
  missing: 'string',
  name: 'string',
  percents: [],
  q: 'string',
  ranges: [{
      From: integer,
      To: integer
    }],
  size: integer,
  sort: 'string',
  sub_aggregates: [{
      date_ranges: [{
          from: 'string',
          to: 'string'
        }],
      exclude: 'string',
      extended_bounds: {
        max: 'string',
        min: 'string'
      },
      field: 'string',
      filter: 'string',
      filters_spec: {
        filters: {},
        other_bucket: boolean,
        other_bucket_key: 'string'
      },
      from: integer,
      include: 'string',
      interval: 'string',
      max_doc_count: integer,
      min_doc_count: integer,
      missing: 'string',
      name: 'string',
      percents: [],
      q: 'string',
      ranges: [{
          From: integer,
          To: integer
        }],
      size: integer,
      sort: 'string',
      sub_aggregates: [{
          date_ranges: [],
          exclude: 'string',
          extended_bounds: {},
          field: 'string',
          filter: 'string',
          filters_spec: {},
          from: integer,
          include: 'string',
          interval: 'string',
          max_doc_count: integer,
          min_doc_count: integer,
          missing: 'string',
          name: 'string',
          percents: [],
          q: 'string',
          ranges: [],
          size: integer,
          sort: 'string',
          sub_aggregates: [],
          time_zone: 'string',
          type: 'string'
        }],
      time_zone: 'string',
      type: 'string'
    }],
  time_zone: 'string',
  type: 'string'
)

response = api.indicator_aggregate_v1(body)

puts response

Responses

200 OK

[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

indicator.combined.v1

Get Combined for Indicators.

Method GET

Route /iocs/combined/indicator/v1

Scope IOC Management: READ

PEP 8 indicator_combined

Parameters

filter query · string

The filter expression that should be used to limit the results.

Available values (15)

type	value	action
severity	platforms	tags
expiration	expired	applied_globally
host_groups	created_on	created_by
modified_on	modified_by	source

offset query · integer

The offset to start retrieving records from. Offset and After params are mutually exclusive. If none provided then scrolling will be used by default. To access more than 10k iocs, use the ‘after’ parameter instead of ‘offset’.

limit query · integer

The maximum records to return.

sort query · string

FQL Syntax formatted sort filter.

Available values (18)

action	applied_globally	metadata.av_hits
metadata.company_name.raw	created_by	created_on
expiration	expired	metadata.filename.raw
modified_by	modified_on	metadata.original_filename.raw
metadata.product_name.raw	metadata.product_version	severity_number
source	type	value

after query · string

A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an ‘after’ token. On subsequent requests, provide the ‘after’ token from the previous response to continue from that place in the results. To access more than 10k indicators, use the ‘after’ parameter instead of ‘offset’.

from_parent query · boolean

The filter for returning either only indicators for the request customer or its MSSP parents

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.indicator_combined(after="string",
                                     filter="string",
                                     from_parent=boolean,
                                     limit=integer,
                                     offset=integer,
                                     sort="string")
print(response)

Operation ID

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.indicator_combined_v1(after="string",
                                        filter="string",
                                        from_parent=boolean,
                                        limit=integer,
                                        offset=integer,
                                        sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("indicator_combined_v1",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          after="string",
                          from_parent=boolean)
print(response)

PowerShell

Get-FalconIoc -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"
  after := "string"
  fromParent := boolean

  response, err := client.Ioc.IndicatorCombinedV1(
    &ioc.IndicatorCombinedV1Params{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      After: &after,
      FromParent: &fromParent,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorCombinedV1(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string",  // after
  boolean  // fromParent
);

console.log(response);

Rust

use rusty_falcon::apis::ioc_api::indicator_combined_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = indicator_combined_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // after
        Some(boolean),  // from_parent
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

Examples coming soon.

Responses

200 OK

[
  {
    "action": "string",
    "applied_globally": false,
    "created_by": "string",
    "created_on": "string",
    "deleted": false,
    "description": "string",
    "expiration": "string",
    "expired": false,
    "from_parent": false,
    "host_groups": [],
    "id": "string",
    "metadata": {},
    "mobile_action": "string",
    "modified_by": "string",
    "modified_on": "string",
    "parent_cid_name": "string",
    "platforms": [],
    "severity": "string",
    "source": "string",
    "tags": [],
    "type": "string",
    "value": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

indicator.create.v1

Create Indicators.

Method POST

Route /iocs/entities/indicators/v1

Scope IOC Management: WRITE

PEP 8 indicator_create

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

comment body · string

Audit log comment for the update.

indicators body · array

List of indicators to create.

retrodetects query · boolean

Whether to submit to retrodetects

ignore_warnings query · boolean

Set to true to ignore warnings and add all IOCs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

action body · string

Default action for the IOC.

applied_globally body · boolean

Is this IOC applied globally?

description body · string

Description for the IOC.

expiration body · string

UTC formatted date.

filename body · string

Filename to use in the metadata.

host_groups body · list of strings

List of host groups to apply this IOC to.

metadata body · string

Dictionary containing the filename for the IOC. Not required if filename is used.

mobile_action body · string

Action to perform for mobile.

platforms body · string

Platforms this IOC applies to.

severity body · string

Severity this IOC generates.

source body · string

Source of the IOC.

tags body · list of strings

List of Falcon Grouping Tags to apply this IOC to.

type body · string

Type of indicator.

value body · string

Value of the indicator.

Code Examples

Python

PEP 8

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

indicators = [
    {
        "action": "string",
        "applied_globally": True,
        "description": "string",
        "expiration": "2021-10-22T10:40:39.372Z",
        "host_groups": [
            "string"
        ],
        "metadata": {
            "filename": "string"
        },
        "mobile_action": "string",
        "platforms": [
            "string"
        ],
        "severity": "string",
        "source": "string",
        "tags": [
            "string"
        ],
        "type": "string",
        "value": "string"
    }
]

response = falcon.indicator_create(action="string",
                                   applied_globally=boolean,
                                   comment="string",
                                   description="string",
                                   expiration="string",
                                   filename="string",
                                   host_groups=["string"],
                                   ignore_warnings=boolean,
                                   indicators=indicators,
                                   metadata="string",
                                   mobile_action="string",
                                   platforms="string",
                                   retrodetects=boolean,
                                   severity="string",
                                   source="string",
                                   tags=["string"],
                                   type="string",
                                   value="string")
print(response)

Operation ID

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

indicators = [
    {
        "action": "string",
        "applied_globally": True,
        "description": "string",
        "expiration": "2021-10-22T10:40:39.372Z",
        "host_groups": [
            "string"
        ],
        "metadata": {
            "filename": "string"
        },
        "mobile_action": "string",
        "platforms": [
            "string"
        ],
        "severity": "string",
        "source": "string",
        "tags": [
            "string"
        ],
        "type": "string",
        "value": "string"
    }
]

response = falcon.indicator_create_v1(action="string",
                                      applied_globally=boolean,
                                      comment="string",
                                      description="string",
                                      expiration="string",
                                      filename="string",
                                      host_groups=["string"],
                                      ignore_warnings=boolean,
                                      indicators=indicators,
                                      metadata="string",
                                      mobile_action="string",
                                      platforms="string",
                                      retrodetects=boolean,
                                      severity="string",
                                      source="string",
                                      tags=["string"],
                                      type="string",
                                      value="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "comment": "string",
    "indicators": [
        {
            "action": "string",
            "applied_globally": boolean,
            "description": "string",
            "expiration": "string",
            "host_groups": ["string"],
            "metadata": {
                "filename": "string"
            },
            "mobile_action": "string",
            "platforms": ["string"],
            "severity": "string",
            "source": "string",
            "tags": ["string"],
            "type": "string",
            "value": "string"
        }
    ]
}

response = falcon.command("indicator_create_v1",
                          retrodetects=boolean,
                          ignore_warnings=boolean,
                          body=body_payload)
print(response)

PowerShell

New-FalconIoc -Action "string" `
  -Platform @("ID1", "ID2") `
  -Severity "string" `
  -Type "string" `
  -Value "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  action := "string"
  applied_globally := boolean
  description := "string"
  expiration := "string"
  mobile_action := "string"
  severity := "string"
  source := "string"
  typeVar := "string"
  value := "string"
  retrodetects := boolean
  ignoreWarnings := boolean

  response, err := client.Ioc.IndicatorCreateV1(
    &ioc.IndicatorCreateV1Params{
      Body: &models.APIIndicatorCreateReqsV1{
        Comment: &comment,
        Indicators: []interface{}{
          {
          Action: &action,
          AppliedGlobally: &applied_globally,
          Description: &description,
          Expiration: &expiration,
          HostGroups: []string{"string"},
          Metadata: &struct{}{},
          MobileAction: &mobile_action,
          Platforms: []string{"string"},
          Severity: &severity,
          Source: &source,
          Tags: []string{"string"},
          Type: &typeVar,
          Value: &value,
          },
        },
      },
      Retrodetects: &retrodetects,
      IgnoreWarnings: &ignoreWarnings,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorCreateV1(
  {  // body
      comment: "string",
      indicators: [{
          action: "string",
          appliedGlobally: boolean,
          description: "string",
          expiration: "string",
          hostGroups: [],
          metadata: {
            filename: "string"
          },
          mobileAction: "string",
          platforms: [],
          severity: "string",
          source: "string",
          tags: [],
          type: "string",
          value: "string"
        }]
  },
  boolean,  // retrodetects
  boolean  // ignoreWarnings
);

console.log(response);

Rust

use rusty_falcon::apis::ioc_api::indicator_create_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiIndicatorCreateReqsV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiIndicatorCreateReqsV1 {
        indicators: vec![IndicatorCreateReqV1 {
            applied_globally: Some(boolean),
            ..Default::default()
        }],
        ..Default::default()
    };

    let response = indicator_create_v1(
        &falcon.cfg,  // configuration
        body,  // body
        Some(boolean),  // retrodetects
        Some(boolean),  // ignore_warnings
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Ioc.new

body = Falcon::ApiIndicatorCreateReqsV1.new(
  comment: 'string',
  indicators: [{
      action: 'string',
      applied_globally: boolean,
      description: 'string',
      expiration: 'string',
      host_groups: [],
      metadata: {
        filename: 'string'
      },
      mobile_action: 'string',
      platforms: [],
      severity: 'string',
      source: 'string',
      tags: [],
      type: 'string',
      value: 'string'
    }]
)

response = api.indicator_create_v1(body)

puts response

Responses

201 Created

[
  {
    "action": "string",
    "applied_globally": false,
    "created_by": "string",
    "created_on": "string",
    "deleted": false,
    "description": "string",
    "expiration": "string",
    "expired": false,
    "from_parent": false,
    "host_groups": [],
    "id": "string",
    "metadata": {},
    "mobile_action": "string",
    "modified_by": "string",
    "modified_on": "string",
    "parent_cid_name": "string",
    "platforms": [],
    "severity": "string",
    "source": "string",
    "tags": [],
    "type": "string",
    "value": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

indicator.delete.v1

Delete Indicators by ids.

Method DELETE

Route /iocs/entities/indicators/v1

Scope IOC Management: WRITE

PEP 8 indicator_delete

Parameters

filter query · string

The FQL expression to delete Indicators in bulk. If both ‘filter’ and ‘ids’ are provided, then filter takes precedence and ignores ids.

Available values (4)

filter	ids	filter
ids

ids query · string or list of strings

The ids of the Indicators to delete. If both ‘filter’ and ‘ids’ are provided, then filter takes precedence and ignores ids

comment query · string

The comment why these indicators were deleted

from_parent query · boolean

The filter for returning either only indicators for the request customer or its MSSP parents

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.indicator_delete(ids=id_list, from_parent=boolean)
print(response)

Operation ID

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.indicator_delete_v1(ids=id_list, from_parent=boolean)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("indicator_delete_v1",
                          filter="string",
                          ids=id_list,
                          comment="string",
                          from_parent=boolean)
print(response)

PowerShell

Remove-FalconIoc

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  comment := "string"
  fromParent := boolean

  response, err := client.Ioc.IndicatorDeleteV1(
    &ioc.IndicatorDeleteV1Params{
      Filter: &filter,
      Ids: []string{"ID1", "ID2", "ID3"},
      Comment: &comment,
      FromParent: &fromParent,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorDeleteV1(
  "string",  // filter
  ["ID1", "ID2", "ID3"],  // ids
  "string",  // comment
  boolean  // fromParent
);

console.log(response);

Rust

use rusty_falcon::apis::ioc_api::indicator_delete_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = indicator_delete_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(vec!["string".to_string()]),  // ids
        Some("string"),  // comment
        Some(boolean),  // from_parent
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Ioc.new

response = api.indicator_delete_v1(filter: 'string',
                                   ids: ['ID1', 'ID2', 'ID3'],
                                   comment: 'string',
                                   from_parent: boolean)

puts response

Responses

200 OK

[
  "string"
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

indicator.get.device_count.v1

Get the number of devices the indicator has run on

Method GET

Route /iocs/aggregates/indicators/device-count/v1

Scope IOC Management: READ

PEP 8 devices_count

Parameters

type query · string

The type of the indicator. Valid types include: sha256: A hex-encoded sha256 hash string. Length - min: 64, max: 64. md5: A hex-encoded md5 hash string. Length - min 32, max: 32. domain: A domain name. Length - min: 1, max: 200. ipv4: An IPv4 address. Must be a valid IP address. ipv6: An IPv6 address. Must be a valid IP address.

Available values (5)

sha256

A hex-encoded sha256 hash string. Length - min: 64, max: 64.

md5

A hex-encoded md5 hash string. Length - min 32, max: 32.

domain

A domain name. Length - min: 1, max: 200.

ipv4

An IPv4 address. Must be a valid IP address.

ipv6

An IPv6 address. Must be a valid IP address.

value query · string

The string representation of the indicator

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.devices_count(type="string", value="string")
print(response)

Operation ID

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.indicator_get_device_count_v1(type="string", value="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("indicator_get_device_count_v1",
                          type="string",
                          value="string")
print(response)

PowerShell

Get-FalconIocHost -Type "string" -Value "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Ioc.IndicatorGetDeviceCountV1(
    &ioc.IndicatorGetDeviceCountV1Params{
      Type: "string",
      Value: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorGetDeviceCountV1(
  "string",  // type
  "string"  // value
);

console.log(response);

Rust

use rusty_falcon::apis::ioc_api::indicator_get_device_count_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = indicator_get_device_count_v1(
        &falcon.cfg,  // configuration
        "string",  // value
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Ioc.new

response = api.indicator_get_device_count_v1('string', 'string')

puts response

Responses

200 OK

[
  {
    "device_count": 0,
    "limit_exceeded": false,
    "type": "string",
    "value": "string"
  }
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

indicator.get.devices_ran_on.v1

Get the IDs of devices the indicator has run on

Method GET

Route /iocs/queries/indicators/devices/v1

Scope IOC Management: READ

PEP 8 devices_ran_on

Parameters

type query · string

The type of the indicator. Valid types include: sha256: A hex-encoded sha256 hash string. Length - min: 64, max: 64. md5: A hex-encoded md5 hash string. Length - min 32, max: 32. domain: A domain name. Length - min: 1, max: 200. ipv4: An IPv4 address. Must be a valid IP address. ipv6: An IPv6 address. Must be a valid IP address.

Available values (5)

sha256

A hex-encoded sha256 hash string. Length - min: 64, max: 64.

md5

A hex-encoded md5 hash string. Length - min 32, max: 32.

domain

A domain name. Length - min: 1, max: 200.

ipv4

An IPv4 address. Must be a valid IP address.

ipv6

An IPv6 address. Must be a valid IP address.

value query · string

The string representation of the indicator

limit query · string

The maximum number of results to return. Use with the offset parameter to manage pagination of results.

offset query · string

The first process to return, where 0 is the latest offset. Use with the limit parameter to manage pagination of results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.devices_ran_on(type="string",
                                 limit="string",
                                 offset="string",
                                 value="string")
print(response)

Operation ID

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.indicator_get_devices_ran_on_v1(type="string",
                                                  limit="string",
                                                  offset="string",
                                                  value="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("indicator_get_devices_ran_on_v1",
                          type="string",
                          value="string",
                          limit="string",
                          offset="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := "string"
  offset := "string"

  response, err := client.Ioc.IndicatorGetDevicesRanOnV1(
    &ioc.IndicatorGetDevicesRanOnV1Params{
      Type: "string",
      Value: "string",
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorGetDevicesRanOnV1(
  "string",  // type
  "string",  // value
  "string",  // limit
  "string"  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::ioc_api::indicator_get_devices_ran_on_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = indicator_get_devices_ran_on_v1(
        &falcon.cfg,  // configuration
        "string",  // value
        Some("string"),  // limit
        Some("string"),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

Examples coming soon.

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

indicator.get.processes_ran_on.v1

Get the number of processes the indicator has run on

Method GET

Route /iocs/queries/indicators/processes/v1

Scope IOC Management: READ

PEP 8 processes_ran_on

Parameters

type query · string

The type of the indicator. Valid types include: sha256: A hex-encoded sha256 hash string. Length - min: 64, max: 64. md5: A hex-encoded md5 hash string. Length - min 32, max: 32. domain: A domain name. Length - min: 1, max: 200. ipv4: An IPv4 address. Must be a valid IP address. ipv6: An IPv6 address. Must be a valid IP address.

Available values (5)

sha256

A hex-encoded sha256 hash string. Length - min: 64, max: 64.

md5

A hex-encoded md5 hash string. Length - min 32, max: 32.

domain

A domain name. Length - min: 1, max: 200.

ipv4

An IPv4 address. Must be a valid IP address.

ipv6

An IPv6 address. Must be a valid IP address.

value query · string

The string representation of the indicator

device_id query · string

Specify a host’s ID to return only processes from that host. Get a host’s ID from GET /devices/queries/devices/v1, the Falcon console, or the Streaming API.

limit query · string

The maximum number of results to return. Use with the offset parameter to manage pagination of results.

offset query · string

The first process to return, where 0 is the latest offset. Use with the limit parameter to manage pagination of results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.processes_ran_on(type="string",
                                   limit="string",
                                   offset="string",
                                   device_id="string",
                                   value="string")
print(response)

Operation ID

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.indicator_get_processes_ran_on_v1(type="string",
                                                    limit="string",
                                                    offset="string",
                                                    device_id="string",
                                                    value="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("indicator_get_processes_ran_on_v1",
                          type="string",
                          value="string",
                          device_id="string",
                          limit="string",
                          offset="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := "string"
  offset := "string"

  response, err := client.Ioc.IndicatorGetProcessesRanOnV1(
    &ioc.IndicatorGetProcessesRanOnV1Params{
      Type: "string",
      Value: "string",
      DeviceID: "string",
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorGetProcessesRanOnV1(
  "string",  // type
  "string",  // value
  "string",  // deviceId
  "string",  // limit
  "string"  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::ioc_api::indicator_get_processes_ran_on_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = indicator_get_processes_ran_on_v1(
        &falcon.cfg,  // configuration
        "string",  // value
        "string",  // device_id
        Some("string"),  // limit
        Some("string"),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

Examples coming soon.

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

indicator.get.v1

Get Indicators by ids.

Method GET

Route /iocs/entities/indicators/v1

Scope IOC Management: READ

PEP 8 indicator_get

Parameters

ids query · string or list of strings

The ids of the Indicators to retrieve

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.indicator_get(ids=id_list)
print(response)

Operation ID

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.indicator_get_v1(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("indicator_get_v1",
                          ids=id_list)
print(response)

PowerShell

Get-FalconIoc -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Ioc.IndicatorGetV1(
    &ioc.IndicatorGetV1Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorGetV1(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::ioc_api::indicator_get_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = indicator_get_v1(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Ioc.new

response = api.indicator_get_v1(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "action": "string",
    "applied_globally": false,
    "created_by": "string",
    "created_on": "string",
    "deleted": false,
    "description": "string",
    "expiration": "string",
    "expired": false,
    "from_parent": false,
    "host_groups": [],
    "id": "string",
    "metadata": {},
    "mobile_action": "string",
    "modified_by": "string",
    "modified_on": "string",
    "parent_cid_name": "string",
    "platforms": [],
    "severity": "string",
    "source": "string",
    "tags": [],
    "type": "string",
    "value": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

indicator.sdmf-query.v1

Executes an SDMF data frame query against IOC indicators

Method POST

Route /iocs/sdmf/query/v1

Scope IOC Management: WRITE

PEP 8 indicator_sdmf_query_v1

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

control_info body · object

The control_info value.

id body · string

The id value.

nodes body · array

The nodes value.

res_id body · string

The res_id value.

Code Examples

Python

PEP 8

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

control_info = {
    "deadline": "string",
    "duration": "string",
    "execution_context": {
        "catalog_version": "string",
        "execution_options": "string",
        "extensions": "string",
        "queried_cids": [
            "string"
        ]
    },
    "execution_details": {
        "driver_calls": "string"
    },
    "is_export_request": True,
    "pagination_info": {
        "limit": 0,
        "offset": "string"
    },
    "partial_results": True,
    "query_stats": {
        "execution_stats": {
            "visited_entities": 0,
            "visited_relationships": 0
        },
        "total_hits": {
            "relation": "string",
            "total": 0
        }
    },
    "store_headers": "string"
}

response = falcon.indicator_sdmf_query_v1(control_info=control_info,
                                          id="string",
                                          nodes=["string"],
                                          res_id="string")
print(response)

Operation ID

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

control_info = {
    "deadline": "string",
    "duration": "string",
    "execution_context": {
        "catalog_version": "string",
        "execution_options": "string",
        "extensions": "string",
        "queried_cids": [
            "string"
        ]
    },
    "execution_details": {
        "driver_calls": "string"
    },
    "is_export_request": True,
    "pagination_info": {
        "limit": 0,
        "offset": "string"
    },
    "partial_results": True,
    "query_stats": {
        "execution_stats": {
            "visited_entities": 0,
            "visited_relationships": 0
        },
        "total_hits": {
            "relation": "string",
            "total": 0
        }
    },
    "store_headers": "string"
}

response = falcon.indicator_sdmf_query_v1(control_info=control_info,
                                          id="string",
                                          nodes=["string"],
                                          res_id="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "control_info": {
        "deadline": "string",
        "duration": "string",
        "execution_context": {
            "catalog_version": "string",
            "execution_options": {},
            "extensions": {},
            "queried_cids": ["string"]
        },
        "execution_details": {
            "driver_calls": {}
        },
        "is_export_request": boolean,
        "pagination_info": {
            "limit": integer,
            "offset": {}
        },
        "partial_results": boolean,
        "query_stats": {
            "execution_stats": {},
            "total_hits": {}
        },
        "store_headers": {}
    },
    "id": "string",
    "nodes": [
        {
            "alias": "string",
            "id": "string",
            "operator": {},
            "res_id": "string",
            "schema": {
                "base": ["string"],
                "facets": ["string"],
                "fields": ["string"],
                "res_id": "string"
            }
        }
    ],
    "res_id": "string"
}

response = falcon.command("indicator_sdmf_query_v1", body=body_payload)
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  id := "string"
  alias := "string"
  res_id := "string"

  response, err := client.Ioc.IndicatorSdmfQueryV1(
    &ioc.IndicatorSdmfQueryV1Params{
      Body: &models.APISdmfQuery{
        ControlInfo: &struct{}{},
        ID: &id,
        Nodes: []interface{}{
          {
          Alias: &alias,
          ID: &id,
          Operator: &struct{}{},
          ResID: &res_id,
          Schema: &struct{}{},
          },
        },
        ResID: &res_id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorSdmfQueryV1(
  {
    controlInfo: {
      deadline: "string",
      duration: "string",
      executionContext: {
        catalogVersion: "string",
        executionOptions: {},
        extensions: {},
        queriedCids: []
      },
      executionDetails: {
        driverCalls: {}
      },
      isExportRequest: boolean,
      paginationInfo: {
        limit: integer,
        offset: {}
      },
      partialResults: boolean,
      queryStats: {
        executionStats: {},
        totalHits: {}
      },
      storeHeaders: {}
    },
    id: "string",
    nodes: [{
        alias: "string",
        id: "string",
        operator: {},
        resId: "string",
        schema: {
          base: [],
          facets: [],
          fields: [],
          resId: "string"
        }
      }],
    resId: "string"
}  // body
);

console.log(response);

Rust

Examples coming soon.

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Ioc.new

body = Falcon::ApiSdmfQuery.new(
  control_info: {
    deadline: 'string',
    duration: 'string',
    execution_context: {
      catalog_version: 'string',
      execution_options: {},
      extensions: {},
      queried_cids: []
    },
    execution_details: {
      driver_calls: {}
    },
    is_export_request: boolean,
    pagination_info: {
      limit: integer,
      offset: {}
    },
    partial_results: boolean,
    query_stats: {
      execution_stats: {},
      total_hits: {}
    },
    store_headers: {}
  },
  id: 'string',
  nodes: [{
      alias: 'string',
      id: 'string',
      operator: {},
      res_id: 'string',
      schema: {
        base: [],
        facets: [],
        fields: [],
        res_id: 'string'
      }
    }],
  res_id: 'string'
)

response = api.indicator_sdmf_query_v1(body)

puts response

Responses

200 OK

[
  {}
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

indicator.search.v1

Search for Indicators.

Method GET

Route /iocs/queries/indicators/v1

Scope IOC Management: READ

PEP 8 indicator_search

Parameters

filter query · string

The filter expression that should be used to limit the results.

Available values (15)

type	value	action
severity	platforms	tags
expiration	expired	applied_globally
host_groups	created_on	created_by
modified_on	modified_by	source

offset query · integer

The offset to start retrieving records from. Offset and After params are mutually exclusive. If none provided then scrolling will be used by default. To access more than 10k iocs, use the ‘after’ parameter instead of ‘offset’.

limit query · integer

The maximum records to return.

sort query · string

FQL Syntax formatted sort filter.

Available values (18)

action	applied_globally	metadata.av_hits
metadata.company_name.raw	created_by	created_on
expiration	expired	metadata.filename.raw
modified_by	modified_on	metadata.original_filename.raw
metadata.product_name.raw	metadata.product_version	severity_number
source	type	value

after query · string

A pagination token used with the limit parameter to manage pagination of results. On your first request, don’t provide an ‘after’ token. On subsequent requests, provide the ‘after’ token from the previous response to continue from that place in the results. To access more than 10k indicators, use the ‘after’ parameter instead of ‘offset’.

from_parent query · boolean

The filter for returning either only indicators for the request customer or its MSSP parents

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.indicator_search(after="string",
                                   filter="string",
                                   from_parent=boolean,
                                   limit=integer,
                                   offset=integer,
                                   sort="string")
print(response)

Operation ID

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.indicator_search_v1(after="string",
                                      filter="string",
                                      from_parent=boolean,
                                      limit=integer,
                                      offset=integer,
                                      sort="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("indicator_search_v1",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string",
                          after="string",
                          from_parent=boolean)
print(response)

PowerShell

Get-FalconIoc -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"
  after := "string"
  fromParent := boolean

  response, err := client.Ioc.IndicatorSearchV1(
    &ioc.IndicatorSearchV1Params{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      After: &after,
      FromParent: &fromParent,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorSearchV1(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string",  // sort
  "string",  // after
  boolean  // fromParent
);

console.log(response);

Rust

use rusty_falcon::apis::ioc_api::indicator_search_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = indicator_search_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // after
        Some(boolean),  // from_parent
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

Examples coming soon.

Responses

200 OK

[
  "string"
]

400 Bad Request

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

indicator.update.v1

Update Indicators.

Method PATCH

Route /iocs/entities/indicators/v1

Scope IOC Management: WRITE

PEP 8 indicator_update

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

bulk_update body · object

Dictionary representing the indicator values to update in bulk.

comment body · string

Audit log comment for the update.

indicators body · array

List of indicators to update.

retrodetects query · boolean

Whether to submit to retrodetects

ignore_warnings query · boolean

Set to true to ignore warnings and add all IOCs

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

action body · string

Default action for the IOC.

applied_globally body · boolean

Is this IOC applied globally?

description body · string

Description for the IOC.

expiration body · string

UTC formatted date.

filename body · string

Filename to use in the metadata.

from_parent body · boolean

Flag indicating if this indicator originates from the parent.

host_groups body · list of strings

List of host groups to apply this IOC to.

id body · string

ID of the indicator to be updated. At least one ID must be specified using this keyword, or as part of the indicators list using the indicators keyword.

metadata body · string

Dictionary containing the filename for the IOC. Not required if filename is used.

mobile_action body · string

Action to perform for mobile.

platforms body · string

Platforms this IOC applies to.

severity body · string

Severity this IOC generates.

source body · string

Source of the IOC.

tags body · list of strings

List of Falcon Grouping Tags to apply this IOC to.

type body · string

Type of indicator.

value body · string

Value of the indicator.

Code Examples

Python

PEP 8

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

bulk_update = {
    "action": "string",
    "applied_globally": True,
    "description": "string",
    "expiration": "2021-10-22T11:03:16.123Z",
    "filter": "string",
    "from_parent": True,
    "host_groups": [
        "string"
    ],
    "mobile_action": "string",
    "platforms": [
        "string"
    ],
    "severity": "string",
    "source": "string",
    "tags": [
        "string"
    ]
}

indicators = [
    {
        "action": "string",
        "applied_globally": True,
        "description": "string",
        "expiration": "2021-10-22T11:03:16.123Z",
        "host_groups": [
            "string"
        ],
        "id": "string",
        "metadata": {
            "filename": "string"
        },
        "mobile_action": "string",
        "platforms": [
            "string"
        ],
        "severity": "string",
        "source": "string",
        "tags": [
            "string"
        ]
    }
]

response = falcon.indicator_update(action="string",
                                   applied_globally=boolean,
                                   bulk_update=bulk_update,
                                   comment="string",
                                   description="string",
                                   expiration="string",
                                   filename="string",
                                   from_parent=boolean,
                                   host_groups=["string"],
                                   id="string",
                                   indicators=indicators,
                                   ignore_warnings=boolean,
                                   metadata="string",
                                   mobile_action="string",
                                   platforms="string",
                                   retrodetects=boolean,
                                   severity="string",
                                   source="string",
                                   tags=["string"],
                                   type="string",
                                   value="string")
print(response)

Operation ID

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

bulk_update = {
    "action": "string",
    "applied_globally": True,
    "description": "string",
    "expiration": "2021-10-22T11:03:16.123Z",
    "filter": "string",
    "from_parent": True,
    "host_groups": [
        "string"
    ],
    "mobile_action": "string",
    "platforms": [
        "string"
    ],
    "severity": "string",
    "source": "string",
    "tags": [
        "string"
    ]
}

indicators = [
    {
        "action": "string",
        "applied_globally": True,
        "description": "string",
        "expiration": "2021-10-22T11:03:16.123Z",
        "host_groups": [
            "string"
        ],
        "id": "string",
        "metadata": {
            "filename": "string"
        },
        "mobile_action": "string",
        "platforms": [
            "string"
        ],
        "severity": "string",
        "source": "string",
        "tags": [
            "string"
        ]
    }
]

response = falcon.indicator_update_v1(action="string",
                                      applied_globally=boolean,
                                      bulk_update=bulk_update,
                                      comment="string",
                                      description="string",
                                      expiration="string",
                                      filename="string",
                                      from_parent=boolean,
                                      host_groups=["string"],
                                      id="string",
                                      indicators=indicators,
                                      ignore_warnings=boolean,
                                      metadata="string",
                                      mobile_action="string",
                                      platforms="string",
                                      retrodetects=boolean,
                                      severity="string",
                                      source="string",
                                      tags=["string"],
                                      type="string",
                                      value="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "bulk_update": {
        "action": "string",
        "applied_globally": boolean,
        "description": "string",
        "expiration": "string",
        "filter": "string",
        "from_parent": boolean,
        "host_groups": ["string"],
        "metadata": {
            "filename": "string"
        },
        "mobile_action": "string",
        "platforms": ["string"],
        "severity": "string",
        "source": "string",
        "tags": ["string"]
    },
    "comment": "string",
    "indicators": [
        {
            "action": "string",
            "applied_globally": boolean,
            "description": "string",
            "expiration": "string",
            "host_groups": ["string"],
            "id": "string",
            "metadata": {
                "filename": "string"
            },
            "mobile_action": "string",
            "platforms": ["string"],
            "severity": "string",
            "source": "string",
            "tags": ["string"]
        }
    ]
}

response = falcon.command("indicator_update_v1",
                          retrodetects=boolean,
                          ignore_warnings=boolean,
                          body=body_payload)
print(response)

PowerShell

Edit-FalconIoc -Id "string"

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  comment := "string"
  action := "string"
  applied_globally := boolean
  description := "string"
  expiration := "string"
  id := "string"
  mobile_action := "string"
  severity := "string"
  source := "string"
  retrodetects := boolean
  ignoreWarnings := boolean

  response, err := client.Ioc.IndicatorUpdateV1(
    &ioc.IndicatorUpdateV1Params{
      Body: &models.APIIndicatorUpdateReqsV1{
        BulkUpdate: &struct{}{},
        Comment: &comment,
        Indicators: []interface{}{
          {
          Action: &action,
          AppliedGlobally: &applied_globally,
          Description: &description,
          Expiration: &expiration,
          HostGroups: []string{"string"},
          ID: &id,
          Metadata: &struct{}{},
          MobileAction: &mobile_action,
          Platforms: []string{"string"},
          Severity: &severity,
          Source: &source,
          Tags: []string{"string"},
          },
        },
      },
      Retrodetects: &retrodetects,
      IgnoreWarnings: &ignoreWarnings,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.indicatorUpdateV1(
  {  // body
      bulkUpdate: {
        action: "string",
        appliedGlobally: boolean,
        description: "string",
        expiration: "string",
        filter: "string",
        fromParent: boolean,
        hostGroups: [],
        metadata: {
          filename: "string"
        },
        mobileAction: "string",
        platforms: [],
        severity: "string",
        source: "string",
        tags: []
      },
      comment: "string",
      indicators: [{
          action: "string",
          appliedGlobally: boolean,
          description: "string",
          expiration: "string",
          hostGroups: [],
          id: "string",
          metadata: {
            filename: "string"
          },
          mobileAction: "string",
          platforms: [],
          severity: "string",
          source: "string",
          tags: []
        }]
  },
  boolean,  // retrodetects
  boolean  // ignoreWarnings
);

console.log(response);

Rust

use rusty_falcon::apis::ioc_api::indicator_update_v1;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::ApiIndicatorUpdateReqsV1;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = ApiIndicatorUpdateReqsV1 {
        bulk_update: Default::default(),
        indicators: vec![],
        ..Default::default()
    };

    let response = indicator_update_v1(
        &falcon.cfg,  // configuration
        body,  // body
        Some(boolean),  // retrodetects
        Some(boolean),  // ignore_warnings
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Ioc.new

body = Falcon::ApiIndicatorUpdateReqsV1.new(
  bulk_update: {
    action: 'string',
    applied_globally: boolean,
    description: 'string',
    expiration: 'string',
    filter: 'string',
    from_parent: boolean,
    host_groups: [],
    metadata: {
      filename: 'string'
    },
    mobile_action: 'string',
    platforms: [],
    severity: 'string',
    source: 'string',
    tags: []
  },
  comment: 'string',
  indicators: [{
      action: 'string',
      applied_globally: boolean,
      description: 'string',
      expiration: 'string',
      host_groups: [],
      id: 'string',
      metadata: {
        filename: 'string'
      },
      mobile_action: 'string',
      platforms: [],
      severity: 'string',
      source: 'string',
      tags: []
    }]
)

response = api.indicator_update_v1(body)

puts response

Responses

200 OK

[
  {
    "action": "string",
    "applied_globally": false,
    "created_by": "string",
    "created_on": "string",
    "deleted": false,
    "description": "string",
    "expiration": "string",
    "expired": false,
    "from_parent": false,
    "host_groups": [],
    "id": "string",
    "metadata": {},
    "mobile_action": "string",
    "modified_by": "string",
    "modified_on": "string",
    "parent_cid_name": "string",
    "platforms": [],
    "severity": "string",
    "source": "string",
    "tags": [],
    "type": "string",
    "value": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

ioc_type.query.v1

Query IOC Types.

Method GET

Route /iocs/queries/ioc-types/v1

Scope IOC Management: READ

PEP 8 ioc_type_query

Parameters

offset query · string

Starting index of overall result set from which to return ids.

limit query · integer

Number of ids to return.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.ioc_type_query(limit=integer, offset="string")
print(response)

Operation ID

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.ioc_type_query_v1(limit=integer, offset="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ioc_type_query_v1",
                          offset="string",
                          limit=integer)
print(response)

PowerShell

Get-FalconIocType -Limit integer -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)

  response, err := client.Ioc.IocTypeQueryV1(
    &ioc.IocTypeQueryV1Params{
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.iocTypeQueryV1(
  "string",  // offset
  integer  // limit
);

console.log(response);

Rust

use rusty_falcon::apis::ioc_api::ioc_type_query_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = ioc_type_query_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Ioc.new

response = api.ioc_type_query_v1(offset: 'string', limit: integer)

puts response

Responses

200 OK

[
  "string"
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

platform.query.v1

Query Platforms.

Method GET

Route /iocs/queries/platforms/v1

Scope IOC Management: READ

PEP 8 platform_query

Parameters

offset query · string

Starting index of overall result set from which to return ids.

limit query · integer

Number of ids to return.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.platform_query(limit=integer, offset="string")
print(response)

Operation ID

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.platform_query_v1(limit=integer, offset="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("platform_query_v1",
                          offset="string",
                          limit=integer)
print(response)

PowerShell

Get-FalconIocPlatform -Limit integer -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)

  response, err := client.Ioc.PlatformQueryV1(
    &ioc.PlatformQueryV1Params{
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.platformQueryV1(
  "string",  // offset
  integer  // limit
);

console.log(response);

Rust

use rusty_falcon::apis::ioc_api::platform_query_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = platform_query_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Ioc.new

response = api.platform_query_v1(offset: 'string', limit: integer)

puts response

Responses

200 OK

[
  "string"
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

severity.query.v1

Query Severities.

Method GET

Route /iocs/queries/severities/v1

Scope IOC Management: READ

PEP 8 severity_query

Parameters

offset query · string

Starting index of overall result set from which to return ids.

limit query · integer

Number of ids to return.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.severity_query(limit=integer, offset="string")
print(response)

Operation ID

from falconpy import IOC

falcon = IOC(client_id=CLIENT_ID,
             client_secret=CLIENT_SECRET
             )

response = falcon.severity_query_v1(limit=integer, offset="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("severity_query_v1",
                          offset="string",
                          limit=integer)
print(response)

PowerShell

Get-FalconIocSeverity -Limit integer -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/ioc"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)

  response, err := client.Ioc.SeverityQueryV1(
    &ioc.SeverityQueryV1Params{
      Offset: &offset,
      Limit: &limit,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.ioc.severityQueryV1(
  "string",  // offset
  integer  // limit
);

console.log(response);

Rust

use rusty_falcon::apis::ioc_api::severity_query_v1;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = severity_query_v1(
        &falcon.cfg,  // configuration
        Some("string"),  // offset
        Some(integer),  // limit
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Ioc.new

response = api.severity_query_v1(offset: 'string', limit: integer)

puts response

Responses

200 OK

[
  "string"
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}