New FalconIoc - CrowdStrike/psfalcon Wiki

New-FalconIoc

SYNOPSIS

Create custom indicators

DESCRIPTION

Requires 'IOC Manager APIs: Write'.

PARAMETERS

Name Type Min Max Allowed Pipeline PipelineByName Description
Array Object[] X An array of indicators to create in a single request
Action String no_action
allow
prevent_no_ui
detect
prevent
Action to perform when a host observes the indicator
Platform String[] android
ios
linux
mac
windows
Operating system platform
Source String 1 256 Origination source
Severity String informational
low
medium
high
critical
Severity level
Description String Indicator description
Filename String Indicator filename,used with hash values
Tag String[] Indicator tag
MobileAction String no_action
allow
detect
prevent
Action to perform when a mobile device observes the indicator
HostGroup String[] Host group identifier
AppliedGlobally Boolean Assign to all host groups
Expiration String Expiration date. When an indicator expires,its action is set to 'no_action' but it remains in your indicator list.
Comment String Audit log comment
Retrodetect Boolean Generate retroactive detections for hosts that have observed the indicator
IgnoreWarning Boolean Ignore warnings and create all indicators
Type String domain
ipv4
ipv6
md5
sha256
Indicator type
Value String String representation of the indicator

SYNTAX

New-FalconIoc [-Action] <String> [-Platform] <String[]> [[-Source] <String>] [[-Severity] <String>] [[-Description] <String>] [[-Filename] 
<String>] [[-Tag] <String[]>] [[-MobileAction] <String>] [[-HostGroup] <String[]>] [[-AppliedGlobally] <Boolean>] [[-Expiration] <String>] [-Comment] <String>] [[-Retrodetect] <Boolean>] [[-IgnoreWarning] <Boolean>] [-Type] <String> [-Value] <String> [-WhatIf] [-Confirm] <CommonParameters>]
New-FalconIoc -Array <Object[]> [[-Comment] <String>] [[-Retrodetect] <Boolean>] [[-IgnoreWarning] <Boolean>] [-WhatIf] [-Confirm] <CommonParameters>]

USAGE

Creating a domain indicator

New-FalconIoc -Type domain -Value example01.com -Action detect -Severity medium -Description 'test description' -Platforms windows, mac, linux -Tags test_tag -HostGroup <host_group_id>, <host_group_id> -Expiration 2021-05-01

Creating multiple indicators in a single request

$Array = @(
    @{
        type = 'domain'
        value = 'example01.com'
        action = 'detect'
        severity = 'medium'
        description = 'test description'
        platforms = @('windows', 'mac', 'linux')
        tags = @('test_tag')
        host_groups = @('<id>')
    },
    @{
        type = 'sha256'
        value = 'a88787d8ff144c502c7f5cffaafe2cc588d86079f9de88304c26b0cb99ce91cc'
        source = 'bd20201216'
        filename = 'iexplore.exe'
        action = 'prevent'
        severity = 'high'
        description = 'test block description'
        platforms = @('windows')
        tags = @('test_tag', 'test_tag2')
        applied_globally = $true
    }
)
New-FalconIoc -Array $Array

Generated 20220922 using PSFalcon v2.2.3

⚠️ **GitHub.com Fallback** ⚠️