IOCs - CrowdStrike/falconpy GitHub Wiki
This class has been superseded by the new IOC service class.
| Operation ID | Description | ||||
|---|---|---|---|---|---|
|
Number of hosts in your customer account that have observed a given custom IOC | ||||
|
This operation has been superseded by the IOC.indicator_get_v1 operation and is no longer used. | ||||
|
This operation has been superseded by the IOC.indicator_create_v1 operation and is no longer used. | ||||
|
This operation has been superseded by the IOC.indicator_delete_v1 operation and is no longer used. | ||||
|
This operation has been superseded by the IOC.indicator_update_v1 operation and is no longer used. | ||||
|
Find hosts that have observed a given custom IOC. For details about those hosts, use GET /devices/entities/devices/v1 | ||||
|
This operation has been superseded by the IOC.indicator_search_v1 operation and is no longer used. | ||||
|
Search for processes associated with a custom IOC | ||||
|
For the provided ProcessID retrieve the process details | ||||
WARNING
client_idandclient_secretare keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.
Number of hosts in your customer account that have observed a given custom IOC
devices_count
| Method | Route |
|---|---|
 |
/indicators/aggregates/devices-count/v1 |
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| type |
 |
|
query | string | The type of the indicator. Valid types include:
|
| value |
|
|
query | string | The string representation of the indicator. |
| parameters |
|
|
query | dictionary | Full query string parameters payload in JSON format. |
from falconpy import Iocs
# Do not hardcode API credentials!
falcon = Iocs(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.devices_count(type="string", value="string")
print(response)from falconpy import Iocs
# Do not hardcode API credentials!
falcon = Iocs(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.DevicesCount(type="string", value="string")
print(response)from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.command("DevicesCount", type="string", value="string")
print(response)This method is deprecated.
This operation has been superseded by the IOC.indicator_get_v1 operation and is no longer used.
get_ioc
| Method | Route |
|---|---|
|
/indicators/entities/iocs/v1 |
- Consumes: application/json
- Produces: application/json
Keywords and arguments are ignored in deprecated methods.
This method and the corresponding endpoint are deprecated.
This method is deprecated.
This operation has been superseded by the IOC.indicator_create_v1 operation and is no longer used.
create_ioc
| Method | Route |
|---|---|
 |
/indicators/entities/iocs/v1 |
- Consumes: application/json
- Produces: application/json
Keywords and arguments are ignored in deprecated methods.
This method and the corresponding endpoint are deprecated.
This method is deprecated.
This operation has been superseded by the IOC.indicator_delete_v1 operation and is no longer used.
delete_ioc
| Method | Route |
|---|---|
 |
/indicators/entities/iocs/v1 |
- Consumes: application/json
- Produces: application/json
Keywords and arguments are ignored in deprecated methods.
This method and the corresponding endpoint are deprecated.
This method is deprecated.
This operation has been superseded by the IOC.indicator_update_v1 operation and is no longer used.
update_ioc
| Method | Route |
|---|---|
 |
/indicators/entities/iocs/v1 |
- Consumes: application/json
- Produces: application/json
Keywords and arguments are ignored in deprecated methods.
This method and the corresponding endpoint are deprecated.
Find hosts that have observed a given custom IOC. For details about those hosts, use GET /devices/entities/devices/v1
devices_ran_on
| Method | Route |
|---|---|
|
/indicators/queries/devices/v1 |
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| type |
|
|
query | string | The type of the indicator. Valid types include:
|
| value |
|
|
query | string | The string representation of the indicator. |
| limit |
|
|
query | integer | Maximum number of results to return. |
| offset |
|
|
query | integer | Starting offset to begin returning results. |
| parameters |
|
|
query | dictionary | Full query string parameters payload in JSON format. |
from falconpy import Iocs
# Do not hardcode API credentials!
falcon = Iocs(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.devices_ran_on(type="string",
value="string",
limit="string",
offset="string"
)
print(response)from falconpy import Iocs
# Do not hardcode API credentials!
falcon = Iocs(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.DevicesRanOn(type="string",
value="string",
limit="string",
offset="string"
)
print(response)from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.command("DevicesRanOn",
type="string",
value="string",
limit="string",
offset="string"
)
print(response)This method is deprecated.
This operation has been superseded by the IOC.indicator_search_v1 operation and is no longer used.
query_iocs
| Method | Route |
|---|---|
|
/indicators/queries/iocs/v1 |
- Consumes: application/json
- Produces: application/json
Keywords and arguments are ignored in deprecated methods.
This method and the corresponding endpoint are deprecated.
Search for processes associated with a custom IOC
processes_ran_on
| Method | Route |
|---|---|
|
/indicators/queries/processes/v1 |
- Consumes: application/json
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| type |
|
|
query | string | The type of the indicator. Valid types include:
|
| value |
|
|
query | string | The string representation of the indicator. |
| device_id |
|
|
query | string | Specify a Host AID to return only processes from that host. |
| limit |
|
|
query | integer | Maximum number of results to return. |
| offset |
|
|
query | integer | Starting offset to begin returning results. |
| parameters |
|
|
query | dictionary | Full query string parameters payload in JSON format. |
from falconpy import Iocs
# Do not hardcode API credentials!
falcon = Iocs(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.processes_ran_on(type="string",
value="string",
device_id="string",
limit="string",
offset="string"
)
print(response)from falconpy import Iocs
# Do not hardcode API credentials!
falcon = Iocs(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.ProcessesRanOn(type="string",
value="string",
device_id="string",
limit="string",
offset="string"
)
print(response)from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
response = falcon.command("ProcessesRanOn",
type="string",
value="string",
device_id="string",
limit="string",
offset="string"
)
print(response)For the provided ProcessID retrieve the process details
entities_processes
| Method | Route |
|---|---|
|
/processes/entities/processes/v1 |
- Produces: application/json
| Name | Service | Uber | Type | Data type | Description |
|---|---|---|---|---|---|
| ids |
|
|
query | string or list of strings | ProcessID for the running process you want to lookup. |
| parameters |
|
|
query | dictionary | Full query string parameters payload in JSON format. |
from falconpy import Iocs
# Do not hardcode API credentials!
falcon = Iocs(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.entities_processes(ids=id_list)
print(response)from falconpy import Iocs
# Do not hardcode API credentials!
falcon = Iocs(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.entities_processes(ids=id_list)
print(response)from falconpy import APIHarnessV2
# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("entities_processes", ids=id_list)
print(response)