IOCs

The IOCs service collection provides operations for querying custom indicators of compromise. This class has been superseded by the new IOC service class.

Language	Last Update
Python	v1.4.6
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

Operation	Description
DevicesCount `devices_count`	Number of hosts in your customer account that have observed a given custom IOC.
GetIOC `get_ioc`	This operation has been superseded by the IOC.indicator_get_v1 operation and is no longer used. deprecated
CreateIOC `create_ioc`	This operation has been superseded by the IOC.indicator_create_v1 operation and is no longer used. deprecated
DeleteIOC `delete_ioc`	This operation has been superseded by the IOC.indicator_delete_v1 operation and is no longer used. deprecated
UpdateIOC `update_ioc`	This operation has been superseded by the IOC.indicator_update_v1 operation and is no longer used. deprecated
DevicesRanOn `devices_ran_on`	Find hosts that have observed a given custom IOC. For details about those hosts, use GET /devices/entities/devices/v1.
QueryIOCs `query_iocs`	This operation has been superseded by the IOC.indicator_search_v1 operation and is no longer used. deprecated
ProcessesRanOn `processes_ran_on`	Search for processes associated with a custom IOC.
entities_processes `entities_processes`	For the provided ProcessID retrieve the process details.

DevicesCount

Number of hosts in your customer account that have observed a given custom IOC.

GET /indicators/aggregates/devices-count/v1

Scope IOCs (Indicators of Compromise): READ Consumes · Produces application/json

PEP 8 devices_count

Parameters

Name	Type	Data type	Description
type	query	string	The type of the indicator. Valid types include: `sha256` (hex-encoded sha256 hash string, length min: 64, max: 64); `md5` (hex-encoded md5 hash string, length min: 32, max: 32); `domain` (a domain name, length min: 1, max: 200); `ipv4` (a valid IPv4 address); `ipv6` (a valid IPv6 address).
value	query	string	The string representation of the indicator.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.devices_count(type="string", value="string")
print(response)

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.DevicesCount(type="string", value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("DevicesCount",
                          type="string",
                          value="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/iocs"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Iocs.DevicesCount(
    &iocs.DevicesCountParams{
      Type: "string",
      Value: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.iocs.devicesCount(
  "string",  // type
  "string"  // value
);

console.log(response);

use rusty_falcon::apis::iocs_api::devices_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = devices_count(
        &falcon.cfg,  // configuration
        "string",  // value
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Iocs.new

response = api.devices_count('string', 'string')

puts response

GetIOC

This operation has been superseded by the IOC.indicator_get_v1 operation and is no longer used.

GET /indicators/entities/iocs/v1

Scope IOCs (Indicators of Compromise): READ Consumes · Produces application/json

PEP 8 get_ioc

deprecated

Keywords and arguments are ignored in deprecated methods. This method and the corresponding endpoint are deprecated.

Code Examples

Examples coming soon.

CreateIOC

This operation has been superseded by the IOC.indicator_create_v1 operation and is no longer used.

POST /indicators/entities/iocs/v1

Scope IOCs (Indicators of Compromise): WRITE Consumes · Produces application/json

PEP 8 create_ioc

deprecated

Keywords and arguments are ignored in deprecated methods. This method and the corresponding endpoint are deprecated.

Code Examples

Examples coming soon.

DeleteIOC

This operation has been superseded by the IOC.indicator_delete_v1 operation and is no longer used.

DELETE /indicators/entities/iocs/v1

Scope IOCs (Indicators of Compromise): WRITE Consumes · Produces application/json

PEP 8 delete_ioc

deprecated

Keywords and arguments are ignored in deprecated methods. This method and the corresponding endpoint are deprecated.

Code Examples

Examples coming soon.

UpdateIOC

This operation has been superseded by the IOC.indicator_update_v1 operation and is no longer used.

PATCH /indicators/entities/iocs/v1

Scope IOCs (Indicators of Compromise): WRITE Consumes · Produces application/json

PEP 8 update_ioc

deprecated

Keywords and arguments are ignored in deprecated methods. This method and the corresponding endpoint are deprecated.

Code Examples

Examples coming soon.

DevicesRanOn

Find hosts that have observed a given custom IOC. For details about those hosts, use GET /devices/entities/devices/v1.

GET /indicators/queries/devices/v1

Scope IOCs (Indicators of Compromise): READ Consumes · Produces application/json

PEP 8 devices_ran_on

Parameters

Name	Type	Data type	Description
type	query	string	The type of the indicator. Valid types include: `sha256` (hex-encoded sha256 hash string, length min: 64, max: 64); `md5` (hex-encoded md5 hash string, length min: 32, max: 32); `domain` (a domain name, length min: 1, max: 200); `ipv4` (a valid IPv4 address); `ipv6` (a valid IPv6 address).
value	query	string	The string representation of the indicator.
limit	query	integer	Maximum number of results to return.
offset	query	integer	Starting offset to begin returning results.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.devices_ran_on(type="string",
                                 limit="string",
                                 offset="string",
                                 value="string")
print(response)

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.DevicesRanOn(type="string",
                               limit="string",
                               offset="string",
                               value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("DevicesRanOn",
                          type="string",
                          value="string",
                          limit="string",
                          offset="string")
print(response)

Get-FalconIocHost -Type "string" `
  -Value "string" `
  -Limit "string" `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/iocs"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := "string"
  offset := "string"

  response, err := client.Iocs.DevicesRanOn(
    &iocs.DevicesRanOnParams{
      Type: "string",
      Value: "string",
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.iocs.devicesRanOn(
  "string",  // type
  "string",  // value
  "string",  // limit
  "string"  // offset
);

console.log(response);

use rusty_falcon::apis::iocs_api::devices_ran_on;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = devices_ran_on(
        &falcon.cfg,  // configuration
        "string",  // value
        Some("string"),  // limit
        Some("string"),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Iocs.new

response = api.devices_ran_on('string', 'string')

puts response

QueryIOCs

This operation has been superseded by the IOC.indicator_search_v1 operation and is no longer used.

GET /indicators/queries/iocs/v1

Scope IOCs (Indicators of Compromise): READ Consumes · Produces application/json

PEP 8 query_iocs

deprecated

Keywords and arguments are ignored in deprecated methods. This method and the corresponding endpoint are deprecated.

Code Examples

Examples coming soon.

ProcessesRanOn

Search for processes associated with a custom IOC.

GET /indicators/queries/processes/v1

Scope IOCs (Indicators of Compromise): READ Consumes · Produces application/json

PEP 8 processes_ran_on

Parameters

Name	Type	Data type	Description
type	query	string	The type of the indicator. Valid types include: `sha256` (hex-encoded sha256 hash string, length min: 64, max: 64); `md5` (hex-encoded md5 hash string, length min: 32, max: 32); `domain` (a domain name, length min: 1, max: 200); `ipv4` (a valid IPv4 address); `ipv6` (a valid IPv6 address).
value	query	string	The string representation of the indicator.
device_id	query	string	Specify a Host AID to return only processes from that host.
limit	query	integer	Maximum number of results to return.
offset	query	integer	Starting offset to begin returning results.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.processes_ran_on(type="string",
                                   limit="string",
                                   offset="string",
                                   device_id="string",
                                   value="string")
print(response)

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.ProcessesRanOn(type="string",
                                 limit="string",
                                 offset="string",
                                 device_id="string",
                                 value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ProcessesRanOn",
                          type="string",
                          value="string",
                          device_id="string",
                          limit="string",
                          offset="string")
print(response)

Get-FalconIocProcess -Type "string" `
  -Value "string" `
  -HostId "string" `
  -Limit "string" `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/iocs"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := "string"
  offset := "string"

  response, err := client.Iocs.ProcessesRanOn(
    &iocs.ProcessesRanOnParams{
      Type: "string",
      Value: "string",
      DeviceID: "string",
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.iocs.processesRanOn(
  "string",  // type
  "string",  // value
  "string",  // deviceId
  "string",  // limit
  "string"  // offset
);

console.log(response);

use rusty_falcon::apis::iocs_api::processes_ran_on;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = processes_ran_on(
        &falcon.cfg,  // configuration
        "string",  // value
        "string",  // device_id
        Some("string"),  // limit
        Some("string"),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Iocs.new

response = api.processes_ran_on('string', 'string', 'string')

puts response

entities_processes

For the provided ProcessID retrieve the process details.

GET /processes/entities/processes/v1

Scope IOCs (Indicators of Compromise): READ Consumes · Produces application/json

PEP 8 entities_processes

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	ProcessID for the running process you want to lookup.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_processes(ids=id_list)
print(response)

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_processes(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_processes",
                          ids=id_list)
print(response)

Get-FalconIocProcess -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/iocs"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Iocs.EntitiesProcesses(
    &iocs.EntitiesProcessesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.iocs.entitiesProcesses(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

IOCs

Table of Contents

DevicesCount

Parameters

Code Examples

GetIOC

Code Examples

CreateIOC

Code Examples

DeleteIOC

Code Examples

UpdateIOC

Code Examples

DevicesRanOn

Parameters

Code Examples

QueryIOCs

Code Examples

ProcessesRanOn

Parameters

Code Examples

entities_processes

Parameters

Code Examples