custom_ioc

Manages IOC (Indicator of Compromise) indicators in CrowdStrike Falcon. IOC indicators allow you to create custom indicators based on SHA256 hashes, MD5 hashes, domains, IPv4 addresses, or IPv6 addresses with actions such as allow, detect, or prevent.

API Scopes

The following API scopes are required:

• IOC Management: READ
• IOC Management: WRITE

Example Usage

# Allow a specific SHA256 hash globally across all Mac hosts
resource "crowdstrike_custom_ioc" "allow_by_hash" {
  type        = "sha256"
  value       = "73cb3858a687a8494ca3323053016282f3dad39d42cf62ca4e79dda2aac7d9ac"
  action      = "allow"
  severity    = "informational"
  description = "Allowlist for approved application - VENDSEC-10155"
  platforms   = ["mac"]
  host_groups = ["all"]
  tags        = ["vendsec-approved"]
}

# Detect a domain, scoped to specific host groups
resource "crowdstrike_custom_ioc" "detect_domain" {
  type        = "domain"
  value       = "malicious-example.com"
  action      = "detect"
  severity    = "high"
  description = "Known C2 domain"
  platforms   = ["windows", "mac", "linux"]
  host_groups = ["host-group-id-1", "host-group-id-2"]
  expiration  = "2030-12-31T23:59:59Z"
}

# Block an MD5 hash globally
resource "crowdstrike_custom_ioc" "block_md5" {
  type        = "md5"
  value       = "44d88612fea8a8f36de82e1278abb02f"
  action      = "prevent"
  severity    = "critical"
  description = "Known malware hash"
  platforms   = ["windows"]
  host_groups = ["all"]
}

Schema

Required

• host_groups (Set of String) Host group IDs that receive this indicator. Use ["all"] to apply globally.
• platforms (Set of String) The platforms this IOC indicator applies to. Valid values are: windows, mac, linux, ios, android. Hash types (sha256, md5) only support non-mobile platforms (windows, mac, linux); all_subdomains only supports mobile platforms (ios, android).
• type (String) The type of the IOC indicator. Valid values are: sha256, md5, domain, ipv4, ipv6, all_subdomains. sha256 and md5 are only valid with non-mobile platforms (windows, mac, linux); all_subdomains is only valid with mobile platforms (ios, android).
• value (String) The value of the IOC indicator. For hash types, this is the hash value. For domain types, this is the domain name. For IP types, this is the IP address.

Optional

• action (String) The action to take on non-mobile platforms (windows, mac, linux). Required when platforms contains a non-mobile platform. Valid values are: allow, detect, prevent, prevent_no_ui, no_action. For domain, ipv4, and ipv6 types only detect and no_action are permitted.
• description (String) A description of the IOC indicator.
• expiration (String) The expiration date of the IOC indicator in RFC 3339 format (e.g. 2025-12-31T23:59:59Z). Must be a future date. Once this date passes, the API auto-resets action or mobile_action to no_action server-side. Terraform will show permanent drift on action after that point until expiration is bumped/removed or action is set to no_action.
• mobile_action (String) The action to take on mobile platforms (ios, android). Required when platforms contains a mobile platform. Valid values are: allow, detect, prevent, prevent_no_ui, no_action.
• severity (String) The severity level of the IOC indicator. Required when action or mobile_action is detect or prevent; must not be set for other actions. Valid values are: informational, low, medium, high, critical.
• source (String) The source of the IOC indicator.
• tags (Set of String) A set of tags to apply to the IOC indicator.

Read-Only

• applied_globally (Boolean) Whether the indicator is applied globally to all hosts.
• created_by (String) The user who created the IOC indicator.
• created_on (String) The timestamp when the IOC indicator was created.
• id (String) The unique identifier of the IOC indicator.
• modified_by (String) The user who last modified the IOC indicator.
• modified_on (String) The timestamp when the IOC indicator was last modified.

Import

Import is supported using the following syntax:

terraform import crowdstrike_custom_ioc.example indicator-id-here