IOCs

The IOCs service collection provides operations for querying custom indicators of compromise. This class has been superseded by the new IOC service class.

Language	Last Update
Python	v1.6.6
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.7.0
Rust	v0.7.1
Ruby	v1.4.0

---

---

Table of Contents

Operation	Description
DevicesCount devices_count	Number of hosts in your customer account that have observed a given custom IOC
DevicesRanOn devices_ran_on	Find hosts that have observed a given custom IOC.
entities.processes entities_processes	For the provided ProcessID retrieve the process details
ProcessesRanOn processes_ran_on	Search for processes associated with a custom IOC

---

DevicesCount

Number of hosts in your customer account that have observed a given custom IOC

Method GET

Route /indicators/aggregates/devices-count/v1

Scope IOCs (Indicators of Compromise): READ

PEP 8 devices_count

Parameters

type query · string

The type of the indicator. Valid types include: sha256: A hex-encoded sha256 hash string. Length - min: 64, max: 64. md5: A hex-encoded md5 hash string. Length - min 32, max: 32. domain: A domain name. Length - min: 1, max: 200. ipv4: An IPv4 address. Must be a valid IP address. ipv6: An IPv6 address. Must be a valid IP address.

Available values (5)

sha256

A hex-encoded sha256 hash string. Length - min: 64, max: 64.

md5

A hex-encoded md5 hash string. Length - min 32, max: 32.

domain

A domain name. Length - min: 1, max: 200.

ipv4

An IPv4 address. Must be a valid IP address.

ipv6

An IPv6 address. Must be a valid IP address.

value query · string

The string representation of the indicator

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.devices_count(type="string", value="string")
print(response)

Operation ID

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.DevicesCount(type="string", value="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("DevicesCount",
                          type="string",
                          value="string")
print(response)

PowerShell

Examples coming soon.

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/iocs"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Iocs.DevicesCount(
    &iocs.DevicesCountParams{
      Type: "string",
      Value: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.iocs.devicesCount(
  "string",  // type
  "string"  // value
);

console.log(response);

Rust

use rusty_falcon::apis::iocs_api::devices_count;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = devices_count(
        &falcon.cfg,  // configuration
        "string",  // type
        "string",  // value
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Iocs.new

response = api.devices_count('string', 'string')

puts response

Responses

200 OK

[
  {
    "device_count": 0,
    "id": "string",
    "limit_exceeded": false,
    "type": "string",
    "value": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

DevicesRanOn

Find hosts that have observed a given custom IOC.

Method GET

Route /indicators/queries/devices/v1

Scope IOCs (Indicators of Compromise): READ

PEP 8 devices_ran_on

Parameters

type query · string

The type of the indicator. Valid types include: sha256: A hex-encoded sha256 hash string. Length - min: 64, max: 64. md5: A hex-encoded md5 hash string. Length - min 32, max: 32. domain: A domain name. Length - min: 1, max: 200. ipv4: An IPv4 address. Must be a valid IP address. ipv6: An IPv6 address. Must be a valid IP address.

Available values (5)

sha256

A hex-encoded sha256 hash string. Length - min: 64, max: 64.

md5

A hex-encoded md5 hash string. Length - min 32, max: 32.

domain

A domain name. Length - min: 1, max: 200.

ipv4

An IPv4 address. Must be a valid IP address.

ipv6

An IPv6 address. Must be a valid IP address.

value query · string

The string representation of the indicator

limit query · string

The first process to return, where 0 is the latest offset. Use with the offset parameter to manage pagination of results.

offset query · string

The first process to return, where 0 is the latest offset. Use with the limit parameter to manage pagination of results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.devices_ran_on(type="string",
                                 limit="string",
                                 offset="string",
                                 value="string")
print(response)

Operation ID

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.DevicesRanOn(type="string",
                               limit="string",
                               offset="string",
                               value="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("DevicesRanOn",
                          type="string",
                          value="string",
                          limit="string",
                          offset="string")
print(response)

PowerShell

Get-FalconIocHost -Type "string" `
  -Value "string" `
  -Limit "string" `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/iocs"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := "string"
  offset := "string"

  response, err := client.Iocs.DevicesRanOn(
    &iocs.DevicesRanOnParams{
      Type: "string",
      Value: "string",
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.iocs.devicesRanOn(
  "string",  // type
  "string",  // value
  "string",  // limit
  "string"  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::iocs_api::devices_ran_on;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = devices_ran_on(
        &falcon.cfg,  // configuration
        "string",  // type
        "string",  // value
        Some("string"),  // limit
        Some("string"),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Iocs.new

response = api.devices_ran_on('string', 'string')

puts response

Responses

200 OK

[
  "string"
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

entities.processes

For the provided ProcessID retrieve the process details

Method GET

Route /processes/entities/processes/v1

Scope IOCs (Indicators of Compromise): READ

PEP 8 entities_processes

Parameters

ids query · string or list of strings

ProcessID for the running process you want to lookup

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.entities_processes(ids=id_list)
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("entities_processes",
                          ids=id_list)
print(response)

PowerShell

Get-FalconIocProcess -Id @("ID1", "ID2")

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/iocs"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.Iocs.EntitiesProcesses(
    &iocs.EntitiesProcessesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.iocs.entitiesProcesses(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

Rust

use rusty_falcon::apis::iocs_api::entities_processes;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = entities_processes(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Iocs.new

response = api.entities_processes(['ID1', 'ID2', 'ID3'])

puts response

Responses

200 OK

[
  {
    "command_line": "string",
    "device_id": "string",
    "file_name": "string",
    "process_id": "string",
    "process_id_local": "string",
    "start_timestamp": "string",
    "start_timestamp_raw": "string",
    "stop_timestamp": "string",
    "stop_timestamp_raw": "string"
  }
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

---

---

ProcessesRanOn

Search for processes associated with a custom IOC

Method GET

Route /indicators/queries/processes/v1

Scope IOCs (Indicators of Compromise): READ

PEP 8 processes_ran_on

Parameters

type query · string

The type of the indicator. Valid types include: sha256: A hex-encoded sha256 hash string. Length - min: 64, max: 64. md5: A hex-encoded md5 hash string. Length - min 32, max: 32. domain: A domain name. Length - min: 1, max: 200. ipv4: An IPv4 address. Must be a valid IP address. ipv6: An IPv6 address. Must be a valid IP address.

Available values (5)

sha256

A hex-encoded sha256 hash string. Length - min: 64, max: 64.

md5

A hex-encoded md5 hash string. Length - min 32, max: 32.

domain

A domain name. Length - min: 1, max: 200.

ipv4

An IPv4 address. Must be a valid IP address.

ipv6

An IPv6 address. Must be a valid IP address.

value query · string

The string representation of the indicator

device_id query · string

Specify a host’s ID to return only processes from that host. Get a host’s ID from GET /devices/queries/devices/v1, the Falcon console, or the Streaming API.

limit query · string

The first process to return, where 0 is the latest offset. Use with the offset parameter to manage pagination of results.

offset query · string

The first process to return, where 0 is the latest offset. Use with the limit parameter to manage pagination of results.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

Python

PEP 8

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.processes_ran_on(type="string",
                                   limit="string",
                                   offset="string",
                                   device_id="string",
                                   value="string")
print(response)

Operation ID

from falconpy import Iocs

falcon = Iocs(client_id=CLIENT_ID,
              client_secret=CLIENT_SECRET
              )

response = falcon.ProcessesRanOn(type="string",
                                 limit="string",
                                 offset="string",
                                 device_id="string",
                                 value="string")
print(response)

Uber

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("ProcessesRanOn",
                          type="string",
                          value="string",
                          device_id="string",
                          limit="string",
                          offset="string")
print(response)

PowerShell

Get-FalconIocProcess -Type "string" `
  -Value "string" `
  -HostId "string" `
  -Limit "string" `
  -Offset integer

Go

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/iocs"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  limit := "string"
  offset := "string"

  response, err := client.Iocs.ProcessesRanOn(
    &iocs.ProcessesRanOnParams{
      Type: "string",
      Value: "string",
      DeviceID: "string",
      Limit: &limit,
      Offset: &offset,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

TypeScript

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.iocs.processesRanOn(
  "string",  // type
  "string",  // value
  "string",  // deviceId
  "string",  // limit
  "string"  // offset
);

console.log(response);

Rust

use rusty_falcon::apis::iocs_api::processes_ran_on;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = processes_ran_on(
        &falcon.cfg,  // configuration
        "string",  // type
        "string",  // value
        "string",  // device_id
        Some("string"),  // limit
        Some("string"),  // offset
    ).await.expect("API call failed");

    println!("{:?}", response);
}

Ruby

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::Iocs.new

response = api.processes_ran_on('string', 'string', 'string')

puts response

Responses

200 OK

[
  "string"
]

403 Forbidden

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

429 Too Many Requests

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

500 Unexpected Error

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}