Skip to content

IOCs

Jump to bottom
Joshua Hiller edited this page Apr 12, 2021 · 18 revisions

CrowdStrike Falcon Twitter URL

Using the IOCs service collection

Uber class support Uber class support

Table of Contents

API Function Description
DevicesCount Number of hosts in your customer account that have observed a given custom IOC
GetIOC Get an IOC by providing a type and value
CreateIOC Create a new IOC
DeleteIOC Delete an IOC by providing a type and value
UpdateIOC Update an IOC by providing a type and value
DevicesRanOn Find hosts that have observed a given custom IOC. For details about those hosts, use GET /devices/entities/devices/v1
QueryIOCs Search the custom IOCs in your customer account
ProcessesRanOn Search for processes associated with a custom IOC
entities_processes For the provided ProcessID retrieve the process details

DevicesCount

Number of hosts in your customer account that have observed a given custom IOC

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ type query string The type of the indicator. Valid types include: sha256: A hex-encoded sha256 hash string. Length - min: 64, max: 64. md5: A hex-encoded md5 hash string. Length - min 32, max: 32. domain: A domain name. Length - min: 1, max: 200. ipv4: An IPv4 address. Must be a valid IP address. ipv6: An IPv6 address. Must be a valid IP address.
✅ value query string The string representation of the indicator

Usage

Service class example
from falconpy import iocs as FalconIOCs

falcon = FalconIOCs.Iocs(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

PARAMS = {
    'type': 'string',
    'value': 'string'
}

response = falcon.DevicesCount(parameters=PARAMS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'type': 'string',
    'value': 'string'
}

response = falcon.command('DevicesCount', parameters=PARAMS)
print(response)
falcon.deauthenticate()

GetIOC

Get an IOC by providing a type and value

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ type query string The type of the indicator. Valid types include: sha256: A hex-encoded sha256 hash string. Length - min: 64, max: 64. md5: A hex-encoded md5 hash string. Length - min 32, max: 32. domain: A domain name. Length - min: 1, max: 200. ipv4: An IPv4 address. Must be a valid IP address. ipv6: An IPv6 address. Must be a valid IP address.
✅ value query string The string representation of the indicator

Usage

Service class example
from falconpy import iocs as FalconIOCs

falcon = FalconIOCs.Iocs(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

PARAMS = {
    'type': 'string',
    'value': 'string'
}

response = falcon.GetIOC(parameters=PARAMS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'type': 'string',
    'value': 'string'
}

response = falcon.command('GetIOC', parameters=PARAMS)
print(response)
falcon.deauthenticate()

CreateIOC

Create a new IOC

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ body body string Create a new IOC by providing a JSON object that includes these key/value pairs: type (required): The type of the indicator. Valid values: - sha256: A hex-encoded sha256 hash string. Length - min: 64, max: 64. - md5: A hex-encoded md5 hash string. Length - min 32, max: 32. - domain: A domain name. Length - min: 1, max: 200. - ipv4: An IPv4 address. Must be a valid IP address. - ipv6: An IPv6 address. Must be a valid IP address. value (required): The string representation of the indicator. policy (required): Action to take when a host observes the custom IOC. Values: - detect: Enable detections for this custom IOC - none: Disable detections for this custom IOC share_level (optional): Visibility of this custom IOC. All custom IOCs are visible only within your customer account, so only one value is valid: - red expiration_days (optional): Number of days this custom IOC is active. Only applies for the types domain, ipv4, and ipv6. source (optional): The source where this indicator originated. This can be used for tracking where this indicator was defined. Limit 200 characters. description (optional): Descriptive label for this custom IOC

Usage

Service class example
from falconpy import iocs as FalconIOCs

falcon = FalconIOCs.Iocs(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

BODY = {
    'Body Payload': 'See body description above'
}

response = falcon.CreateIOC(body=BODY)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

BODY = {
    'Body Payload': 'See body description above'
}

response = falcon.command('CreateIOC', body=BODY)
print(response)
falcon.deauthenticate()

DeleteIOC

Delete an IOC by providing a type and value

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ type query string The type of the indicator. Valid types include: sha256: A hex-encoded sha256 hash string. Length - min: 64, max: 64. md5: A hex-encoded md5 hash string. Length - min 32, max: 32. domain: A domain name. Length - min: 1, max: 200. ipv4: An IPv4 address. Must be a valid IP address. ipv6: An IPv6 address. Must be a valid IP address.
✅ value query string The string representation of the indicator

Usage

Service class example
from falconpy import iocs as FalconIOCs

falcon = FalconIOCs.Iocs(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

PARAMS = {
    'type': 'string',
    'value': 'string'
}

response = falcon.DeleteIOC(parameters=PARAMS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'type': 'string',
    'value': 'string'
}

response = falcon.command('DeleteIOC', parameters=PARAMS)
print(response)
falcon.deauthenticate()

UpdateIOC

Update an IOC by providing a type and value

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ body body string
✅ type query string The type of the indicator. Valid types include: sha256: A hex-encoded sha256 hash string. Length - min: 64, max: 64. md5: A hex-encoded md5 hash string. Length - min 32, max: 32. domain: A domain name. Length - min: 1, max: 200. ipv4: An IPv4 address. Must be a valid IP address. ipv6: An IPv6 address. Must be a valid IP address.
✅ value query string The string representation of the indicator

Usage

Service class example
from falconpy import iocs as FalconIOCs

falcon = FalconIOCs.Iocs(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

PARAMS = {
    'type': 'string',
    'value': 'string'
}

BODY = {
    'Body Payload': 'See body description above'
}

response = falcon.UpdateIOC(parameters=PARAMS, body=BODY)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'type': 'string',
    'value': 'string'
}

BODY = {
    'Body Payload': 'See body description above'
}

response = falcon.command('UpdateIOC', parameters=PARAMS, body=BODY)
print(response)
falcon.deauthenticate()

DevicesRanOn

Find hosts that have observed a given custom IOC. For details about those hosts, use GET /devices/entities/devices/v1

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ type query string The type of the indicator. Valid types include: sha256: A hex-encoded sha256 hash string. Length - min: 64, max: 64. md5: A hex-encoded md5 hash string. Length - min 32, max: 32. domain: A domain name. Length - min: 1, max: 200. ipv4: An IPv4 address. Must be a valid IP address. ipv6: An IPv6 address. Must be a valid IP address.
✅ value query string The string representation of the indicator
limit query string The first process to return, where 0 is the latest offset. Use with the offset parameter to manage pagination of results.
offset query string The first process to return, where 0 is the latest offset. Use with the limit parameter to manage pagination of results.

Usage

Service class example
from falconpy import iocs as FalconIOCs

falcon = FalconIOCs.Iocs(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

PARAMS = {
    'type': 'string',
    'value': 'string',
    'limit': 'string',
    'offset': 'string'
}

response = falcon.DevicesRanOn(parameters=PARAMS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'type': 'string',
    'value': 'string',
    'limit': 'string',
    'offset': 'string'
}

response = falcon.command('DevicesRanOn', parameters=PARAMS)
print(response)
falcon.deauthenticate()

QueryIOCs

Search the custom IOCs in your customer account

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
types query string The type of the indicator. Valid types include: sha256: A hex-encoded sha256 hash string. Length - min: 64, max: 64. md5: A hex-encoded md5 hash string. Length - min 32, max: 32. domain: A domain name. Length - min: 1, max: 200. ipv4: An IPv4 address. Must be a valid IP address. ipv6: An IPv6 address. Must be a valid IP address.
values query string The string representation of the indicator
from.expiration_timestamp query string Find custom IOCs created after this time (RFC-3339 timestamp)
to.expiration_timestamp query string Find custom IOCs created before this time (RFC-3339 timestamp)
policies query string ndetect: Find custom IOCs that produce notificationsnnnone: Find custom IOCs the particular indicator has been detected on a host. This is equivalent to turning the indicator off.
sources query string The source where this indicator originated. This can be used for tracking where this indicator was defined. Limit 200 characters.
share_levels query string The level at which the indicator will be shared. Currently only red share level (not shared) is supported, indicating that the IOC isn't shared with other FH customers.
created_by query string created_by
deleted_by query string The user or API client who deleted the custom IOC
include_deleted query string true: Include deleted IOCs false: Don't include deleted IOCs (default)

Usage

Service class example
from falconpy import iocs as FalconIOCs

falcon = FalconIOCs.Iocs(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

PARAMS = {
    'types': 'string',
    'values': 'string',
    'from.expiration_timestamp': 'string',
    'to.expiration_timestamp': 'string',
    'policies': 'string',
    'sources': 'string',
    'share_levels': 'string',
    'created_by': 'string',
    'deleted_by': 'string',
    'include_deleted': 'string'
}

response = falcon.QueryIOCs(parameters=PARAMS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'types': 'string',
    'values': 'string',
    'from.expiration_timestamp': 'string',
    'to.expiration_timestamp': 'string',
    'policies': 'string',
    'sources': 'string',
    'share_levels': 'string',
    'created_by': 'string',
    'deleted_by': 'string',
    'include_deleted': 'string'
}

response = falcon.command('QueryIOCs', parameters=PARAMS)
print(response)
falcon.deauthenticate()

ProcessesRanOn

Search for processes associated with a custom IOC

Content-Type

  • Consumes: application/json
  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ type query string The type of the indicator. Valid types include: sha256: A hex-encoded sha256 hash string. Length - min: 64, max: 64. md5: A hex-encoded md5 hash string. Length - min 32, max: 32. domain: A domain name. Length - min: 1, max: 200. ipv4: An IPv4 address. Must be a valid IP address. ipv6: An IPv6 address. Must be a valid IP address.
✅ value query string The string representation of the indicator
✅ device_id query string Specify a host's ID to return only processes from that host. Get a host's ID from GET /devices/queries/devices/v1, the Falcon console, or the Streaming API.
limit query string The first process to return, where 0 is the latest offset. Use with the offset parameter to manage pagination of results.
offset query string The first process to return, where 0 is the latest offset. Use with the limit parameter to manage pagination of results.

Usage

Service class example
from falconpy import iocs as FalconIOCs

falcon = FalconIOCs.Iocs(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

PARAMS = {
    'type': 'string',
    'value': 'string',
    'device_id': 'string',
    'limit': 'string',
    'offset': 'string'
}

response = falcon.ProcessesRanOn(parameters=PARAMS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

PARAMS = {
    'type': 'string',
    'value': 'string',
    'device_id': 'string',
    'limit': 'string',
    'offset': 'string'
}

response = falcon.command('ProcessesRanOn', parameters=PARAMS)
print(response)
falcon.deauthenticate()

entities_processes

For the provided ProcessID retrieve the process details

Content-Type

  • Produces: application/json

Parameters

Required Name Type Datatype Description
✅ ids query array (string) ProcessID for the running process you want to lookup

Usage

Service class example
from falconpy import iocs as FalconIOCs

falcon = FalconIOCs.Iocs(creds={
     'client_id': falcon_client_id,
     'client_secret': falcon_client_secret
})

IDS = 'ID1,ID2,ID3'

response = falcon.entities_processes(ids=IDS)
print(response)
Uber class example
from falconpy import api_complete as FalconSDK

falcon = FalconSDK.APIHarness(creds={
      'client_id': falcon_client_id,
      'client_secret': falcon_client_secret
   }
)

IDS = 'ID1,ID2,ID3'

response = falcon.command('entities.processes', ids=IDS)
print(response)
falcon.deauthenticate()

CrowdStrike Falcon

Clone this wiki locally