IOCs

The IOCs service collection provides operations for querying custom indicators of compromise. This class has been superseded by the new IOC service class.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

Operation	Description
CreateIOC `create_ioc`	Create a new IOC. * Deprecated - Use the new IOC Management endpoint (POST /iocs/entities/indicators/v1). * deprecated
DeleteIOC `delete_ioc`	Delete an IOC by providing a type and value. * Deprecated - Use the new IOC Management endpoint (DELETE /iocs/entities/indicators/v1). * deprecated
DevicesCount `devices_count`	Number of hosts in your customer account that have observed a given custom IOC
DevicesRanOn `devices_ran_on`	Find hosts that have observed a given custom IOC.
entities.processes `entities_processes`	For the provided ProcessID retrieve the process details
GetIOC `get_ioc`	Get an IOC by providing a type and value. * Deprecated - Use the new IOC Management endpoint (GET /iocs/entities/indicators/v1). * deprecated
ProcessesRanOn `processes_ran_on`	Search for processes associated with a custom IOC
QueryIOCs `query_iocs`	Search the custom IOCs in your customer account. * Deprecated - Use the new IOC Management endpoint (GET /iocs/queries/indicators/v1). * deprecated
UpdateIOC `update_ioc`	Update an IOC by providing a type and value. * Deprecated - Use the new IOC Management endpoint (PATCH /iocs/entities/indicators/v1). * deprecated

CreateIOC

Create a new IOC. *** Deprecated - Use the new IOC Management endpoint (POST /iocs/entities/indicators/v1). ***

Method POST

Route /indicators/entities/iocs/v1

PEP 8 create_ioc

Code Examples

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.create_ioc()
print(response)

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.CreateIOC()
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("CreateIOC")
print(response)

DeleteIOC

Delete an IOC by providing a type and value. *** Deprecated - Use the new IOC Management endpoint (DELETE /iocs/entities/indicators/v1). ***

Method DELETE

Route /indicators/entities/iocs/v1

PEP 8 delete_ioc

Parameters

type query · string

The type of the indicator. Valid types include: sha256: A hex-encoded sha256 hash string. Length - min: 64, max: 64. md5: A hex-encoded md5 hash string. Length - min 32, max: 32. domain: A domain name. Length - min: 1, max: 200. ipv4: An IPv4 address. Must be a valid IP address. ipv6: An IPv6 address. Must be a valid IP address.

value query · string

The string representation of the indicator

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.delete_ioc(type="string", value="string")
print(response)

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.DeleteIOC(type="string", value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("DeleteIOC",
                          type="string",
                          value="string")
print(response)

DevicesCount

Number of hosts in your customer account that have observed a given custom IOC

Method GET

Route /indicators/aggregates/devices-count/v1

Scope IOCs (Indicators of Compromise): READ

PEP 8 devices_count

Parameters

type query · string

Available values (5)

value query · string

The string representation of the indicator

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.devices_count(type="string", value="string")
print(response)

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.DevicesCount(type="string", value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("DevicesCount",
                          type="string",
                          value="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/iocs"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Iocs.DevicesCount(
    &iocs.DevicesCountParams{
      Type: "string",
      Value: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.iocs.devicesCount(
  "string",  // type
  "string"  // value
);

console.log(response);

use rusty_falcon::apis::iocs_api::devices_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = devices_count(
        &falcon.cfg,  // configuration
        "string",  // value
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Iocs.new

response = api.devices_count('string', 'string')

puts response

Responses

[
  {
    "device_count": 0,
    "id": "string",
    "limit_exceeded": false,
    "type": "string",
    "value": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

DevicesRanOn

Find hosts that have observed a given custom IOC.

Method GET

Route /indicators/queries/devices/v1

Scope IOCs (Indicators of Compromise): READ

PEP 8 devices_ran_on

Parameters

type query · string

Available values (5)

value query · string

The string representation of the indicator

limit query · string

The first process to return, where 0 is the latest offset. Use with the offset parameter to manage pagination of results.

offset query · string

The first process to return, where 0 is the latest offset. Use with the limit parameter to manage pagination of results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.devices_ran_on(type="string",
                                 limit="string",
                                 offset="string",
                                 value="string")
print(response)

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.DevicesRanOn(type="string",
                               limit="string",
                               offset="string",
                               value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("DevicesRanOn",
                          type="string",
                          value="string",
                          limit="string",
                          offset="string")
print(response)

Get-FalconIocHost -Type "string" `
  -Value "string" `
  -Limit "string" `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/iocs"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := "string"
  offset := "string"

  response, err := client.Iocs.DevicesRanOn(
    &iocs.DevicesRanOnParams{
      Type: "string",
      Value: "string",
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.iocs.devicesRanOn(
  "string",  // type
  "string",  // value
  "string",  // limit
  "string"  // offset
);

console.log(response);

use rusty_falcon::apis::iocs_api::devices_ran_on;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = devices_ran_on(
        &falcon.cfg,  // configuration
        "string",  // value
        Some("string"),  // limit
        Some("string"),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Iocs.new

response = api.devices_ran_on('string', 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

entities.processes

For the provided ProcessID retrieve the process details

Method GET

Route /processes/entities/processes/v1

Scope IOCs (Indicators of Compromise): READ

PEP 8 entities_processes

Parameters

ids query · string or list of strings

ProcessID for the running process you want to lookup

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_processes(ids=id_list)
print(response)

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_processes(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_processes",
                          ids=id_list)
print(response)

Get-FalconIocProcess -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/iocs"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Iocs.EntitiesProcesses(
    &iocs.EntitiesProcessesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.iocs.entitiesProcesses(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::iocs_api::entities_processes;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_processes(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Iocs.new

response = api.entities_processes(['ID1', 'ID2', 'ID3'])

puts response

Responses

[
  {
    "command_line": "string",
    "device_id": "string",
    "file_name": "string",
    "process_id": "string",
    "process_id_local": "string",
    "start_timestamp": "string",
    "start_timestamp_raw": "string",
    "stop_timestamp": "string",
    "stop_timestamp_raw": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

GetIOC

Get an IOC by providing a type and value. *** Deprecated - Use the new IOC Management endpoint (GET /iocs/entities/indicators/v1). ***

Method GET

Route /indicators/entities/iocs/v1

PEP 8 get_ioc

Parameters

type query · string

value query · string

The string representation of the indicator

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.get_ioc(type="string", value="string")
print(response)

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.GetIOC(type="string", value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetIOC",
                          type="string",
                          value="string")
print(response)

ProcessesRanOn

Search for processes associated with a custom IOC

Method GET

Route /indicators/queries/processes/v1

Scope IOCs (Indicators of Compromise): READ

PEP 8 processes_ran_on

Parameters

type query · string

Available values (5)

value query · string

The string representation of the indicator

device_id query · string

Specify a host’s ID to return only processes from that host. Get a host’s ID from GET /devices/queries/devices/v1, the Falcon console, or the Streaming API.

limit query · string

The first process to return, where 0 is the latest offset. Use with the offset parameter to manage pagination of results.

offset query · string

The first process to return, where 0 is the latest offset. Use with the limit parameter to manage pagination of results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.processes_ran_on(type="string",
                                   limit="string",
                                   offset="string",
                                   device_id="string",
                                   value="string")
print(response)

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.ProcessesRanOn(type="string",
                                 limit="string",
                                 offset="string",
                                 device_id="string",
                                 value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ProcessesRanOn",
                          type="string",
                          value="string",
                          device_id="string",
                          limit="string",
                          offset="string")
print(response)

Get-FalconIocProcess -Type "string" `
  -Value "string" `
  -HostId "string" `
  -Limit "string" `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/iocs"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := "string"
  offset := "string"

  response, err := client.Iocs.ProcessesRanOn(
    &iocs.ProcessesRanOnParams{
      Type: "string",
      Value: "string",
      DeviceID: "string",
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.iocs.processesRanOn(
  "string",  // type
  "string",  // value
  "string",  // deviceId
  "string",  // limit
  "string"  // offset
);

console.log(response);

use rusty_falcon::apis::iocs_api::processes_ran_on;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = processes_ran_on(
        &falcon.cfg,  // configuration
        "string",  // value
        "string",  // device_id
        Some("string"),  // limit
        Some("string"),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Iocs.new

response = api.processes_ran_on('string', 'string', 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

QueryIOCs

Search the custom IOCs in your customer account. *** Deprecated - Use the new IOC Management endpoint (GET /iocs/queries/indicators/v1). ***

Method GET

Route /indicators/queries/iocs/v1

PEP 8 query_iocs

Parameters

types query · string

values query · string

The string representation of the indicator

from.expiration_timestamp query · string

Find custom IOCs created after this time (RFC-3339 timestamp)

to.expiration_timestamp query · string

Find custom IOCs created before this time (RFC-3339 timestamp)

policies query · string

\ndetect: Find custom IOCs that produce notifications\n\nnone: Find custom IOCs the particular indicator has been detected on a host. This is equivalent to turning the indicator off.

sources query · string

The source where this indicator originated. This can be used for tracking where this indicator was defined. Limit 200 characters.

share_levels query · string

The level at which the indicator will be shared. Currently only red share level (not shared) is supported, indicating that the IOC isn’t shared with other FH customers.

created_by query · string

created_by

deleted_by query · string

The user or API client who deleted the custom IOC

include_deleted query · string

true: Include deleted IOCs false: Don’t include deleted IOCs (default)

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.query_iocs(types="string",
                             values="string",
                             from.expiration_timestamp="string",
                             to.expiration_timestamp="string",
                             policies="string",
                             sources="string",
                             share_levels="string",
                             created_by="string",
                             deleted_by="string",
                             include_deleted="string")
print(response)

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.QueryIOCs(types="string",
                            values="string",
                            from.expiration_timestamp="string",
                            to.expiration_timestamp="string",
                            policies="string",
                            sources="string",
                            share_levels="string",
                            created_by="string",
                            deleted_by="string",
                            include_deleted="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("QueryIOCs",
                          types="string",
                          values="string",
                          from.expiration_timestamp="string",
                          to.expiration_timestamp="string",
                          policies="string",
                          sources="string",
                          share_levels="string",
                          created_by="string",
                          deleted_by="string",
                          include_deleted="string")
print(response)

UpdateIOC

Update an IOC by providing a type and value. *** Deprecated - Use the new IOC Management endpoint (PATCH /iocs/entities/indicators/v1). ***

Method PATCH

Route /indicators/entities/iocs/v1

PEP 8 update_ioc

Parameters

type query · string

value query · string

The string representation of the indicator

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.update_ioc(type="string", value="string")
print(response)

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.UpdateIOC(type="string", value="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("UpdateIOC",
                          type="string",
                          value="string")
print(response)

IOCs

Table of Contents

CreateIOC

DeleteIOC

Parameters

DevicesCount

Parameters

DevicesRanOn

Parameters

entities.processes

Parameters

GetIOC

Parameters

ProcessesRanOn

Parameters

QueryIOCs

Parameters

UpdateIOC

Parameters