CrowdstrikeFalcon

The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment.

Configure CrowdStrike Falcon in Cortex

Required API client scope

In order to use the CrowdStrike Falcon integration, the API client must have the following scope and permissions:

• Real Time Response - Read and Write

• Real Time Response Admin - Write
• Alerts - Read and Write
• IOC Manager - Read and Write
• IOCs - Read and Write
• IOA Exclusions - Read and Write
• Machine Learning Exclusions - Read and Write
• Detections - Read and Write
• Hosts - Read and Write
• Host Groups - Read and Write
• Incidents - Read and Write
• Spotlight Vulnerabilities - Read
• User Management - Read
• On-Demand Scans (ODS) - Read and Write
• Identity Protection Entities - Read and Write
• Identity Protection Detections - Read and Write
• Identity Protection Timeline - Read
• Identity Protection Assessment - Read
• Falcon Container Image - Read
• Recon - Read and Write
• Workflow - Read and Write

Incident Mirroring (Cortex XSOAR Only)

You can enable incident mirroring between Cortex XSOAR incidents and CrowdStrike Falcon corresponding events (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:

1. Enable Fetching incidents in your instance configuration.
2. In the Fetch types integration parameter, select what types to mirror.
3. Optional: You can go to one of the fetch query parameters and select the query to fetch the events from CrowdStrike Falcon.

4. In the Mirroring Direction integration parameter, select in which direction the incidents should be mirrored:

   Option	Description
   None	Turns off incident mirroring.
   Incoming	Any changes in CrowdStrike Falcon events (mirroring incoming fields) will be reflected in Cortex XSOAR incidents.
   Outgoing	Any changes in Cortex XSOAR incidents will be reflected in CrowdStrike Falcon events (outgoing mirrored fields).
   Incoming And Outgoing	Changes in Cortex XSOAR incidents and CrowdStrike Falcon events will be reflected in both directions.

5. Optional: Check the Close Mirrored XSOAR Incident integration parameter to close the Cortex XSOAR incident when the corresponding event is closed in CrowdStrike Falcon.
6. Optional: Check the Close Mirrored CrowdStrike Falcon Incident or Detection integration parameter to close the CrowdStrike Falcon incident or detection when the corresponding Cortex XSOAR incident is closed.

Newly fetched Cortex XSOAR incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.

Important Notes

• To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and CrowdStrike Falcon.
• When mirroring in incidents from CrowdStrike Falcon to Cortex XSOAR:
  • For the tags field, tags can only be added from the remote system.
  • When enabling the Close Mirrored XSOAR Incident integration parameter, the field in CrowdStrike Falcon that determines whether the incident was closed is the status field.
  • In case the look-back parameter is initialized with a certain value and during a time that incidents were fetched, if changing
    the lookback to a number that is greater than the previous value, then in the initial incident fetching there will be incidents duplications.
    If the integration was already set with lookback > 0, and the lookback is not being increased at any point of time, then those incident duplications would not occur.

Fetch Incidents (Cortex XSOAR Only)

CrowdStrike Falcon incidents or detections can be fetched as incidents in Cortex XSOAR.
Users can specify a fetch query per CrowdStrike Falcon fetch type when configuring the integration instance to control which records are fetched.

Indicator of Misconfiguration (IOM) Fetch Query

The IOM Fetch query relies on an FQL filter expression.

Available filters:

• use_current_scan_ids (use this to get records for latest scans)
• account_name
• account_id
• agent_id
• attack_types
• azure_subscription_id
• cloud_provider
• cloud_service_keyword
• custom_policy_id
• is_managed
• policy_id
• policy_type
• resource_id
• region
• status
• severity
• severity_string

For example: cloud_provider: 'aws'+account_id: 'my_id'

Indicator of Attack (IOA) Fetch Query

Indicator of Attack (IOA) fetch query. An FQL filter that will be combined with the time-range filter using AND. For example: cloud_provider:'aws'. For more information, see the FQL Syntax Documentation.

Fetch Assets

CrowdStrike Falcon assets and vulnerabilities can be fetched and ingested into the Cortex XSIAM Unified Asset Inventory (UAI).
Select the desired method in the Fetch Assets Type parameter:

• Spotlight: Fetches vulnerabilities from the Spotlight Vulnerabilities Endpoint and enriches them with the associated host details. Both the vulnerabilities and the corresponding assets are ingested into the Unified Asset Inventory. Only vulnerabilities updated within the last 100 days are retrieved, keeping each collection focused on recent data.
• CNAPP Alerts: Fetches Cloud Native Application Protection Platform (CNAPP) alerts as assets.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cs-falcon-search-device

Searches for a device that matches the query.

Base Command

cs-falcon-search-device

Input

Context Output

Command Example

!cs-falcon-search-device ids=a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1,a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1

Context Example

{
   "CrowdStrike": {
        "Device": [
            {
                "ExternalIP": "94.188.164.68",
                "MacAddress": "8c-85-90-3d-ed-3e",
                "Hostname": "154.132.82-test-co.in-addr.arpa",
                "LocalIP": "192.168.1.76",
                "LastSeen": "2019-03-28T02:36:41Z",
                "OS": "Mojave (10.14)",
                "ID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "FirstSeen": "2017-12-28T22:38:11Z",
                "Status": "contained"
            },
            {
                "ExternalIP": "94.188.164.68",
                "MacAddress": "f0-18-98-74-8c-31",
                "Hostname": "154.132.82-test-co.in-addr.arpa",
                "LocalIP": "172.22.14.237",
                "LastSeen": "2019-03-17T10:03:17Z",
                "OS": "Mojave (10.14)",
                "ID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "FirstSeen": "2017-12-10T11:01:20Z",
                "Status": "contained"
            }
        ]
    },
    "Endpoint": [
        {
            "Hostname": "154.132.82-test-co.in-addr.arpa",
            "ID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "IPAddress": "192.168.1.76",
            "OS": "Mojave (10.14)",
            "Status": "Online",
            "Vendor": "CrowdStrike Falcon",
            "MACAddress": "1-1-1-1"
        },
        {
            "Hostname": "154.132.82-test-co.in-addr.arpa",
            "ID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "IPAddress": "172.22.14.237",
            "OS": "Mojave (10.14)",
            "Status": "Online",
            "Vendor": "CrowdStrike Falcon",
            "MACAddress": "1-1-1-1"
        }
    ]
}

Human Readable Output

Devices

ID	Hostname	OS	Mac Address	Local IP	External IP	First Seen	Last Seen	Status
a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	154.132.82-test-co.in-addr.arpa	Mojave (10.14)	8c-85-90-3d-ed-3e	192.168.1.76	94.188.164.68	2017-12-28T22:38:11Z	2019-03-28T02:36:41Z	contained
a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	154.132.82-test-co.in-addr.arpa	Mojave (10.14)	f0-18-98-74-8c-31	172.22.14.237	94.188.164.68	2017-12-10T11:01:20Z	2019-03-17T10:03:17Z	contained

cs-falcon-search-detection

Search for details of specific detections, either using a filter query, or by providing the IDs of the detections.

Base Command

cs-falcon-search-detection

Input

Context Output

Command Example

!cs-falcon-search-detection filter="product:'idp'"

!cs-falcon-search-detection filter="product:'mobile'"

!cs-falcon-search-detection filter="product:'ngsiem'"

!cs-falcon-search-detection filter="product:'thirdparty'"

!cs-falcon-search-detection ids=ldt:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1:1898376850347,ldt:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1:1092318056279064902

Context Example

{
    "CrowdStrike": {
        "Detection": [
            { 
                "Status": "false_positive", 
                "ProcessStartTime": "2019-03-21T20:32:55.654489974Z", 
                "Behavior": [
                    {
                        "IOCType": "domain", 
                        "ProcessID": "2279170016592", 
                        "Scenario": "intel_detection", 
                        "ParentProcessID": "2257232915544", 
                        "CommandLine": "C:\\Python27\\pythonw.exe -c __import__('idlelib.run').run.main(True) 1250", 
                        "UserName": "josh", 
                        "FileName": "pythonw.exe", 
                        "SensorID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1", 
                        "SHA256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1", 
                        "ID": "4900", 
                        "IOCValue": "systemlowcheck.com", 
                        "MD5": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"
                    }, 
                    {
                        "IOCType": "domain", 
                        "ProcessID": "2283087267593", 
                        "Scenario": "intel_detection", 
                        "ParentProcessID": "2279170016592", 
                        "CommandLine": "ping.exe systemlowcheck.com", 
                        "UserName": "josh", 
                        "FileName": "PING.EXE", 
                        "SensorID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1", 
                        "SHA256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1", 
                        "ID": "4900", 
                        "IOCValue": "systemlowcheck.com", 
                        "MD5": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"
                    }
                ], 
                "MaxSeverity": 70, 
                "System": "DESKTOP-S49VMIL", 
                "ID": "ldt:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1:1898376850347", 
                "MachineDomain": "", 
                "ShowInUi": true, 
                "CustomerID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"
            }, 
            {
                "Status": "new", 
                "ProcessStartTime": "2019-02-04T07:05:57.083205971Z", 
                "Behavior": [
                    {
                        "IOCType": "sha256", 
                        "ProcessID": "201917905370426448", 
                        "Scenario": "known_malware", 
                        "ParentProcessID": "201917902773103685", 
                        "CommandLine": "./xSf", 
                        "UserName": "user@u-MacBook-Pro-2.local", 
                        "FileName": "xSf", 
                        "SensorID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1", 
                        "SHA256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1", 
                        "ID": "3206", 
                        "IOCValue": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1", 
                        "MD5": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"
                    }, 
                    {
                        "IOCType": "sha256", 
                        "ProcessID": "201917905370426448", 
                        "Scenario": "known_malware", 
                        "ParentProcessID": "201917902773103685", 
                        "CommandLine": "./xSf", 
                        "UserName": "user@u-MacBook-Pro-2.local", 
                        "FileName": "xSf", 
                        "SensorID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1", 
                        "SHA256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1", 
                        "ID": "3206", 
                        "IOCValue": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1", 
                        "MD5": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"
                    }
                ], 
                "MaxSeverity": 30, 
                "System": "u-MacBook-Pro-2.local", 
                "ID": "ldt:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1:1092318056279064902", 
                "MachineDomain": "", 
                "ShowInUi": true, 
                "CustomerID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"
            }
        ]
    }
}

Human Readable Output

Detections Found

ID	Status	System	Process Start Time	Customer ID	Max Severity
ldt:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1:1898376850347	false_positive	DESKTOP-S49VMIL	2019-03-21T20:32:55.654489974Z	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	70
ldt:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1:1092318056279064902	new	u-MacBook-Pro-2.local	2019-02-04T07:05:57.083205971Z	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	30

cs-falcon-resolve-detection

Resolves and updates a detection using the provided arguments. At least one optional argument must be passed, otherwise no change will take place. Note that IDP detections are not supported.

Base Command

cs-falcon-resolve-detection

Input

Context Output

There is no context output for this command.

cs-falcon-contain-host

Contains containment for a specified host. When contained, a host can only communicate with the CrowdStrike cloud and any IPs specified in your containment policy.

Base Command

cs-falcon-contain-host

Input

Context Output

There is no context output for this command.

cs-falcon-lift-host-containment

Lifts containment on the host, which returns its network communications to normal. When lift_filesystem_containment_all is set to true, lifts filesystem containment instead.

Base Command

cs-falcon-lift-host-containment

Input

Context Output

There is no context output for this command.

Command Example

!cs-falcon-lift-host-containment ids="a]1234567890abcdef12345678"

Human Readable Output

Containment has been lifted off host ‘a]1234567890abcdef12345678’

cs-falcon-run-command

Sends commands to hosts.

Base Command

cs-falcon-run-command

Input

Context Output

Command Example

cs-falcon-run-command host_ids=a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1 command_type=ls full_command="ls C:\\"

Context Example

{
    'CrowdStrike': {
        'Command': [{
            'HostID': 'a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1',
            'Stdout': 'Directory listing for C:\\ -\n\n'
            'BatchID': 'batch_id'
            'Name                                     Type         Size (bytes)    Size (MB)       '
            'Last Modified (UTC-5)     Created (UTC-5)          \n----                             '
            '        ----         ------------    ---------       ---------------------     -------'
            '--------          \n$Recycle.Bin                             <Directory>  --          '
            '    --              11/27/2018 10:54:44 AM    9/15/2017 3:33:40 AM     \nITAYDI       '
            '                            <Directory>  --              --              11/19/2018 1:'
            '31:42 PM     11/19/2018 1:31:42 PM    ',
            'Stderr': '',
            'BaseCommand': 'ls',
            'Command': 'ls C:\\'
        }]
}

Human Readable Output

Command ls C:\ results

BaseCommand	Command	HostID	Stderr	Stdout	BatchID
ls	ls C:\	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1		Directory listing for C:\ - Name Type Size (bytes) Size (MB) Last Modified (UTC-5) Created (UTC-5) —- —- ———— ——— ——————— ————— $Recycle.Bin <Directory> – – 11/27/2018 10:54:44 AM 9/15/2017 3:33:40 AM ITAYDI <Directory> – – 11/19/2018 1:31:42 PM 11/19/2018 1:31:42 PM	batch_id

cs-falcon-upload-script

Uploads a script to Falcon CrowdStrike.

Base Command

cs-falcon-upload-script

Input

Context Output

There is no context output for this command.

Command Example

!cs-falcon-upload-script name=greatscript content="Write-Output 'Hello, World!'"

Human Readable Output

The script was uploaded successfully.

Context Output

There is no context output for this command.

cs-falcon-upload-file

Uploads a file to the CrowdStrike cloud. (Can be used for the RTR ‘put’ command).

Base Command

cs-falcon-upload-file

Input

Context Output

There is no context output for this command.

Command Example

!cs-falcon-upload-file entry_id=4@4

Human Readable Output

The file was uploaded successfully.

Context Output

There is no context output for this command.

cs-falcon-delete-file

Deletes a file based on the provided ID or name. Can delete only one file at a time.

Base Command

cs-falcon-delete-file

Input

Context Output

There is no context output for this command.

Command Example

!cs-falcon-delete-file file_id=le10098bf0e311e989190662caec3daa_a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1

Human Readable Output

File le10098bf0e311e989190662caec3daa_a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1 was deleted successfully.

Context Output

There is no context output for this command.

cs-falcon-get-file

Returns files based on the provided IDs. These files are used for the RTR ‘put’ command.

Base Command

cs-falcon-get-file

Input

Context Output

Command Example

!cs-falcon-get-file file_id=le10098bf0e311e989190662caec3daa_a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1

Context Example

{
   "CrowdStrike": {
      "File": {
            "CreatedBy": "spongobob@demisto.com",
            "CreatedTime": "2019-10-17T13:41:48.487520845Z",
            "Description": "Demisto",
            "ID": "le10098bf0e311e989190662caec3daa_a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "ModifiedBy": "spongobob@demisto.com",
            "ModifiedTime": "2019-10-17T13:41:48.487521161Z",
            "Name": "Demisto",
            "Permission": "private",
            "SHA256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "Type": "script"
        }
   }
}

Human Readable Output

CrowdStrike Falcon file le10098bf0e311e989190662caec3daa_a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1

CreatedBy	CreatedTime	Description	ID	ModifiedBy	ModifiedTime	Name	Permission	SHA256	Type
spongobob@demisto.com	2019-10-17T13:41:48.487520845Z	Demisto	le10098bf0e311e989190662caec3daa_a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	spongobob@demisto.com	2019-10-17T13:41:48.487521161Z	Demisto	private	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	script

cs-falcon-list-files

Returns a list of put-file IDs that are available for the user in the ‘put’ command. Due to an API limitation, the maximum number of files returned is 100.

Base Command

cs-falcon-list-files

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Command Example

!cs-falcon-list-files

Context Example

{
   "CrowdStrike": {
      "File": [
         {
            "CreatedBy": "spongobob@demisto.com",
            "CreatedTime": "2019-10-17T13:41:48.487520845Z",
            "Description": "Demisto",
            "ID": "le10098bf0e311e989190662caec3daa_a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "ModifiedBy": "spongobob@demisto.com",
            "ModifiedTime": "2019-10-17T13:41:48.487521161Z",
            "Name": "Demisto",
            "Permission": "private",
            "SHA256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "Type": "script"
         }
      ]
   }
}

Human Readable Output

CrowdStrike Falcon files

CreatedBy	CreatedTime	Description	ID	ModifiedBy	ModifiedTime	Name	Permission	SHA256	Type
spongobob@demisto.com	2019-10-17T13:41:48.487520845Z	Demisto	le10098bf0e311e989190662caec3daa_a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	spongobob@demisto.com	2019-10-17T13:41:48.487521161Z	Demisto	private	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	script

cs-falcon-get-script

Returns custom scripts based on the provided ID. Used for the RTR ‘runscript’ command.

Base Command

cs-falcon-get-script

Input

Context Output

Command Example

!cs-falcon-get-script file_id=le10098bf0e311e989190662caec3daa_a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1

Context Example

{
    "CrowdStrike": {
        "Script": [
            {
                "CreatedBy": "spongobob@demisto.com",
                "CreatedTime": "2019-10-17T13:41:48.487520845Z",
                "Description": "Demisto",
                "ID": "le10098bf0e311e989190662caec3daa_a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "ModifiedBy": "spongobob@demisto.com",
                "ModifiedTime": "2019-10-17T13:41:48.487521161Z",
                "Name": "Demisto",
                "Permission": "private",
                "SHA256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "RunAttemptCount": 0,
                "RunSuccessCount": 0,
                "WriteAccess": true
            }
        ]
    }
}

Human Readable Output

CrowdStrike Falcon script le10098bf0e311e989190662caec3daa_a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1

CreatedBy	CreatedTime	Description	ID	ModifiedBy	ModifiedTime	Name	Permission	SHA256
spongobob@demisto.com	2019-10-17T13:41:48.487520845Z	Demisto	le10098bf0e311e989190662caec3daa_a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	spongobob@demisto.com	2019-10-17T13:41:48.487521161Z	Demisto	private	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1

cs-falcon-delete-script

Deletes a custom-script based on the provided ID. Can delete only one script at a time.

Base Command

cs-falcon-delete-script

Input

Context Output

There is no context output for this command.

Command Example

!cs-falcon-delete-script script_id=le10098bf0e311e989190662caec3daa_a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1

Human Readable Output

Script le10098bf0e311e989190662caec3daa_a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1 was deleted successfully.

Context Output

There is no context output for this command.

cs-falcon-list-scripts

Returns a list of custom script IDs that are available for the user in the ‘runscript’ command.

Base Command

cs-falcon-list-scripts

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Command Example

!cs-falcon-list-scripts

Context Example

{
    "CrowdStrike": {
        "Script": [
            {
                "CreatedBy": "spongobob@demisto.com",
                "CreatedTime": "2019-10-17T13:41:48.487520845Z",
                "Description": "Demisto",
                "ID": "le10098bf0e311e989190662caec3daa_a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "ModifiedBy": "spongobob@demisto.com",
                "ModifiedTime": "2019-10-17T13:41:48.487521161Z",
                "Name": "Demisto",
                "Permission": "private",
                "SHA256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "RunAttemptCount": 0,
                "RunSuccessCount": 0,
                "WriteAccess": true
            }
        ]
    }
}

Human Readable Output

CrowdStrike Falcon scripts

CreatedBy	CreatedTime	Description	ID	ModifiedBy	ModifiedTime	Name	Permission	SHA256
spongobob@demisto.com	2019-10-17T13:41:48.487520845Z	Demisto	le10098bf0e311e989190662caec3daa_a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	spongobob@demisto.com	2019-10-17T13:41:48.487521161Z	Demisto	private	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1

cs-falcon-run-script

Runs a script on the agent host.

Base Command

cs-falcon-run-script

Input

Context Output

Command Example

cs-falcon-run-script host_ids=a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1 raw="Write-Output 'Hello, World!'"

Context Example

{
    "CrowdStrike": {
        "Command": [
            {
                "HostID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "Stdout": "Hello, World!",
                "Stderr": "",
                "BaseCommand": "runscript",
                "Command": "runscript -Raw=Write-Output 'Hello, World!'"
            }
        ]
    }
}

Human Readable Output

Command runscript -Raw=Write-Output ‘Hello, World! results

BaseCommand	Command	HostID	Stderr	Stdout
runscript	runscript -Raw=Write-Output ‘Hello, World!	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1		Hello, World!	Type Size (bytes) Size (MB) Last Modified (UTC-5) Created (UTC-5) —- —- ———— ——— ——————— ————— $Recycle.Bin <Directory> – – 11/27/2018 10:54:44 AM 9/15/2017 3:33:40 AM ITAYDI <Directory> – – 11/19/2018 1:31:42 PM 11/19/2018 1:31:42 PM

cs-falcon-run-get-command

Batch executes ‘get’ command across hosts to retrieve files.

Base Command

cs-falcon-run-get-command

Input

Context Output

Command Example

cs-falcon-run-get-command host_ids=a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1 file_path="""c:\Windows\notepad.exe"""

Context Example

{
    "CrowdStrike": {
        "Command": [
            {
                "BaseCommand": "get",
                "Complete": true,
                "FilePath": "c:\\Windows\\notepad.exe",
                "GetRequestID": "84ee4d50-f499-482e-bac6-b0e296149bbf",
                "HostID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "Stderr": "",
                "Stdout": "C:\\Windows\\notepad.exe",
                "TaskID": "b5c8f140-280b-43fd-8501-9900f837510b"
            }
        ]
    }
}

Human Readable Output

Get command has requested for a file c:\Windows\notepad.exe

BaseCommand	Complete	FilePath	GetRequestID	HostID	Stderr	Stdout	TaskID
get	true	c:\Windows\notepad.exe	107199bc-544c-4b0c-8f20-3094c062a115	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1		C:\Windows\notepad.exe	9c820b97-6a60-4238-bc23-f63513970ec8

cs-falcon-status-get-command

Retrieves the status of the specified batch ‘get’ command.

Base Command

cs-falcon-status-get-command

Input

Context Output

Command Example

!cs-falcon-status-get-command request_ids="84ee4d50-f499-482e-bac6-b0e296149bbf"

Context Example

{
   "CrowdStrike": {
      "File": {
         "CreatedAt": "2020-05-01T16:09:00Z",
         "DeletedAt": null,
         "ID": 185596,
         "Name": "\\Device\\HarddiskVolume2\\Windows\\notepad.exe",
         "SHA256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
         "Size": 0,
         "TaskID": "b5c8f140-280b-43fd-8501-9900f837510b",
         "UpdatedAt": "2020-05-01T16:09:00Z"
      }
   },
   "File": {
      "Name": "\\Device\\HarddiskVolume2\\Windows\\notepad.exe",
      "SHA256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
      "Size": 0
   }
}

Human Readable Output

CrowdStrike Falcon files

CreatedAt	DeletedAt	ID	Name	SHA256	Size	TaskID	UpdatedAt
2020-05-01T16:09:00Z		185596	\Device\HarddiskVolume2\Windows\notepad.exe	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	0	b5c8f140-280b-43fd-8501-9900f837510b	2020-05-01T16:09:00Z

cs-falcon-status-command

Gets the status of a command executed on a host.

Base Command

cs-falcon-status-command

Input

Context Output

Command Example

!cs-falcon-status-command request_id="ae323961-5aa8-442e-8461-8d05c4541d7d"

Context Example

{
  "CrowdStrike": {
    "Command": [
        {
            "BaseCommand": "ls",
            "Complete": true,
            "NextSequenceID": null,
            "SequenceID": null,
            "Stderr": "",
            "Stdout": "Directory listing for C:\\ -\n\nName                                     Type         Size (bytes)    Size (MB)       Last Modified (UTC+9)     Created (UTC+9)          \n----                                     ----         ------------    ---------       ---------------------     ---------------          \n$Recycle.Bin                             \u003cDirectory\u003e  --              --              2020/01/10 16:05:59       2019/03/19 13:52:43      \nConfig.Msi                               \u003cDirectory\u003e  --              --              2020/05/01 23:12:50       2020/01/10 16:52:09      \nDocuments and Settings                   \u003cDirectory\u003e  --              --              2019/09/12 15:03:21       2019/09/12 15:03:21      \nPerfLogs                                 \u003cDirectory\u003e  --              --              2019/03/19 13:52:43       2019/03/19 13:52:43      \nProgram Files                            \u003cDirectory\u003e  --              --              2020/01/10 17:11:47       2019/03/19 13:52:43      \nProgram Files (x86)                      \u003cDirectory\u003e  --              --              2020/05/01 23:12:53       2019/03/19 13:52:44      \nProgramData                              \u003cDirectory\u003e  --              --              2020/01/10 17:16:51       2019/03/19 13:52:44      \nRecovery                                 \u003cDirectory\u003e  --              --              2019/09/11 20:13:59       2019/09/11 20:13:59      \nSystem Volume Information                \u003cDirectory\u003e  --              --              2019/09/12 15:08:21       2019/09/11 20:08:43      \nUsers                                    \u003cDirectory\u003e  --              --              2019/09/22 22:26:11       2019/03/19 13:37:22      \nWindows                                  \u003cDirectory\u003e  --              --              2020/05/01 23:09:08       2019/03/19 13:37:22      \npagefile.sys                             .sys         2334928896      2226.762        2020/05/02 2:10:05        2019/09/11 20:08:44      \nswapfile.sys                             .sys         268435456       256             2020/05/01 23:09:13       2019/09/11 20:08:44      \n",
            "TaskID": "ae323961-5aa8-442e-8461-8d05c4541d7d"
            }
        ]
    }
}

Human Readable Output

Command status results

BaseCommand	Complete	Stdout	TaskID
ls	true	Directory listing for C:\ ……	ae323961-5aa8-442e-8461-8d05c4541d7d

cs-falcon-get-extracted-file

Gets the RTR extracted file contents for the specified session and SHA256 hash.

Base Command

cs-falcon-get-extracted-file

Input

Context Output

There is no context output for this command.

Command Example

!cs-falcon-get-extracted-file host_id="a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1" sha256="a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"

Context Output

There is no context output for this command.

cs-falcon-list-host-files

Gets a list of files for the specified RTR session on a host.

Base Command

cs-falcon-list-host-files

Input

Context Output

Command Example

!cs-falcon-list-host-files host_id="a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"

Context Example

{
  "CrowdStrike": {
    "Command": {
        "HostID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
        "SessionID": "fdd6408f-6688-441b-8659-41bcad25441c",
        "TaskID": "1269ad9e-c11f-4e38-8aba-1a0275304f9c"
    },
    "File": {
        "CreatedAt": "2020-05-01T17:57:42Z",
        "DeletedAt": null,
        "ID": 186811,
        "Name": "\\Device\\HarddiskVolume2\\Windows\\notepad.exe",
        "SHA256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
        "Size": 0,
        "Stderr": null,
        "Stdout": null,
        "UpdatedAt": "2020-05-01T17:57:42Z"
    }
  },
  "File": {
      "Name": "\\Device\\HarddiskVolume2\\Windows\\notepad.exe",
      "SHA256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
      "Size": 0
    }
}

Human Readable Output

CrowdStrike Falcon files

CreatedAt	DeletedAt	ID	Name	SHA256	Size	Stderr	Stdout	UpdatedAt
2020-05-01T17:57:42Z		186811	\Device\HarddiskVolume2\Windows\notepad.exe	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	0			2020-05-01T17:57:42Z

cs-falcon-refresh-session

Refresh a session timeout on a single host.

Base Command

cs-falcon-refresh-session

Input

Context Output

There is no context output for this command.

Command Example

!cs-falcon-refresh-session host_id=a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1

Human Readable Output

CrowdStrike Session Refreshed: fdd6408f-6688-441b-8659-41bcad25441c

Context Output

There is no context output for this command.

cs-falcon-search-custom-iocs

Returns a list of your uploaded IOCs that match the search criteria.

Base Command

cs-falcon-search-custom-iocs

Input

Context Output

Command Example

!cs-falcon-search-custom-iocs limit=2

Context Example

{
    "CrowdStrike": {
        "IOC": [
            {
                "Action": "no_action",
                "CreatedBy": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "CreatedTime": "2022-02-16T17:17:25.992164453Z",
                "Description": "test",
                "Expiration": "2022-02-17T13:47:57Z",
                "ID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "ModifiedBy": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "ModifiedTime": "2022-02-16T17:17:25.992164453Z",
                "Platforms": [
                    "mac"
                ],
                "Severity": "informational",
                "Source": "Cortex",
                "Type": "ipv4",
                "Value": "1.1.8.9"
            },
            {
                "Action": "no_action",
                "CreatedBy": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "CreatedTime": "2022-02-16T17:16:44.514398876Z",
                "Description": "test",
                "Expiration": "2022-02-17T13:47:57Z",
                "ID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "ModifiedBy": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "ModifiedTime": "2022-02-16T17:16:44.514398876Z",
                "Platforms": [
                    "mac"
                ],
                "Severity": "informational",
                "Source": "Cortex",
                "Type": "ipv4",
                "Value": "4.1.8.9"
            }
        ]
    }
}

Human Readable Output

Indicators of Compromise

ID	Action	Severity	Type	Value	Expiration	CreatedBy	CreatedTime	Description	ModifiedBy	ModifiedTime	Platforms	Policy	ShareLevel	Source	Tags
a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	no_action	informational	ipv4	1.1.8.9	2022-02-17T13:47:57Z	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	2022-02-16T17:17:25.992164453Z	test	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	2022-02-16T17:17:25.992164453Z	mac			Cortex
a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	no_action	informational	ipv4	4.1.8.9	2022-02-17T13:47:57Z	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	2022-02-16T17:16:44.514398876Z	test	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	2022-02-16T17:16:44.514398876Z	mac			Cortex

cs-falcon-get-custom-ioc

Gets the full definition of one or more indicators that you are watching.

Base Command

cs-falcon-get-custom-ioc

Input

Context Output

Command Example

!cs-falcon-get-custom-ioc type=ipv4 value=7.5.9.8

Context Example

{
    "CrowdStrike": {
        "IOC": {
            "Action": "no_action",
            "MobileAction": "no_action",
            "CreatedBy": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "CreatedTime": "2022-02-16T14:25:22.968603813Z",
            "Expiration": "2022-02-17T17:55:09Z",
            "ID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "ModifiedBy": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "ModifiedTime": "2022-02-16T14:25:22.968603813Z",
            "Platforms": [
                "linux"
            ],
            "Severity": "informational",
            "Source": "Cortex",
            "Tags": [
                "test",
                "test1"
            ],
            "Type": "ipv4",
            "Value": "7.5.9.8"
        }
    }
}

Human Readable Output

Indicator of Compromise

ID	Action	Severity	Type	Value	Expiration	CreatedBy	CreatedTime	Description	ModifiedBy	ModifiedTime	Platforms	Policy	ShareLevel	Source	Tags
a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	no_action	informational	ipv4	7.5.9.8	2022-02-17T17:55:09Z	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	2022-02-16T14:25:22.968603813Z		a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	2022-02-16T14:25:22.968603813Z	linux			Cortex	test, test1

cs-falcon-upload-custom-ioc

Uploads an indicator for CrowdStrike to monitor.

Base Command

cs-falcon-upload-custom-ioc

Input

Context Output

Command Example

!cs-falcon-upload-custom-ioc ioc_type="domain" value="test.domain.com" action="prevent" severity="high" source="Demisto playbook" description="Test ioc" platforms="mac" mobile_action="no_action"

Context Example

{
    "CrowdStrike": {
        "IOC": {
            "CreatedTime": "2020-10-02T13:55:26Z",
            "Description": "Test ioc",
            "Expiration": "2020-11-01T00:00:00Z",
            "ID": "4f8c43311k1801ca4359fc07t319610482c2003mcde8934d5412b1781e841e9r",
            "ModifiedTime": "2020-10-02T13:55:26Z",
            "Action": "prevent",
            "MobileAction": "no_action",
            "Severity": "high",
            "Source": "Demisto playbook",
            "Type": "domain",
            "Value": "test.domain.com",
            "Platforms": ["mac"]
        }
    }
}

Human Readable Output

Custom IOC was created successfully

CreatedTime	Description	Expiration	ID	ModifiedTime	Action	Severity	Source	Type	Value
2020-10-02T13:55:26Z	Test ioc	2020-11-01T00:00:00Z	4f8c43311k1801ca4359fc07t319610482c2003mcde8934d5412b1781e841e9r	2020-10-02T13:55:26Z	prevent	high	Demisto playbook	domain	test.domain.com

cs-falcon-update-custom-ioc

Updates an indicator for CrowdStrike to monitor.

Base Command

cs-falcon-update-custom-ioc

Input

Context Output

Command Example

!cs-falcon-update-custom-ioc ioc_id="4f8c43311k1801ca4359fc07t319610482c2003mcde8934d5412b1781e841e9r" severity="high"

Context Example

{
    "CrowdStrike": {
        "IOC": {
            "CreatedTime": "2020-10-02T13:55:26Z",
            "Description": "Test ioc",
            "Expiration": "2020-11-01T00:00:00Z",
            "ID": "4f8c43311k1801ca4359fc07t319610482c2003mcde8934d5412b1781e841e9r",
            "ModifiedTime": "2020-10-02T13:55:26Z",
            "Action": "prevent",
            "MobileAction": "no_action",
            "Severity": "high",
            "Source": "Demisto playbook",
            "Type": "domain",
            "Value": "test.domain.com"
        }
    }
}

Human Readable Output

Custom IOC was updated successfully

CreatedTime	Description	Expiration	ID	ModifiedTime	Action	Severity	Source	Type	Value
2020-10-02T13:55:26Z	Test ioc	2020-11-01T00:00:00Z	4f8c43311k1801ca4359fc07t319610482c2003mcde8934d5412b1781e841e9r	2020-10-02T13:55:26Z	prevent	high	Demisto playbook	domain	test.domain.com

cs-falcon-delete-custom-ioc

Deletes a monitored indicator.

Base Command

cs-falcon-delete-custom-ioc

Input

Context Output

There is no context output for this command.

Command Example

!cs-falcon-delete-custom-ioc ioc_id="4f8c43311k1801ca4359fc07t319610482c2003mcde8934d5412b1781e841e9r"

Human Readable Output

Custom IOC 4f8c43311k1801ca4359fc07t319610482c2003mcde8934d5412b1781e841e9r was successfully deleted.

cs-falcon-device-count-ioc

The number of hosts that observed the provided IOC.

Base Command

cs-falcon-device-count-ioc

Input

Context Output

Command Example

!cs-falcon-device-count-ioc type="domain" value="value"

Context Example

{
    "CrowdStrike": {
        "IOC": {
            "DeviceCount": 1,
            "ID": "domain:value",
            "Type": "domain",
            "Value": "value"
        }
    }
}

Human Readable Output

Indicator of Compromise domain:value device count: 1

cs-falcon-processes-ran-on

Get processes associated with a given IOC.

Base Command

cs-falcon-processes-ran-on

Input

Context Output

Command Example

!cs-falcon-processes-ran-on device_id=a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1 type=domain value=value

Context Example

{
    "CrowdStrike": {
        "IOC": {
            "ID": "domain:value",
            "Process": {
                "DeviceID": "pid",
                "ID": [
                    "pid:pid:650164094720"
                ]
            },
            "Type": "domain",
            "Value": "value"
        }
    }
}

Human Readable Output

Processes with custom IOC domain:value on device device_id

Process ID
pid:pid:650164094720

cs-falcon-process-details

Retrieves the details of a process, according to the process ID that is running or that previously ran.

Base Command

cs-falcon-process-details

Input

Context Output

Command Example

!cs-falcon-process-details ids="pid:pid:pid"

Context Example

{
    "CrowdStrike": {
        "Process": {
            "command_line": "\"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\"",
            "device_id": "deviceId",
            "file_name": "\\Device\\HarddiskVolume1\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
            "process_id": "deviceId:pid",
            "process_id_local": "pid",
            "start_timestamp": "2020-10-01T09:05:51Z",
            "start_timestamp_raw": "132460167512852140",
            "stop_timestamp": "2020-10-02T06:43:45Z",
            "stop_timestamp_raw": "132460946259334768"
        }
    }
}

Human Readable Output

Details for process: pid:pid:pid

command_line	device_id	file_name	process_id	process_id_local	start_timestamp	start_timestamp_raw	stop_timestamp	stop_timestamp_raw
“C:\Program Files (x86)\Google\Chrome\Application\chrome.exe”	deviceId	\Device\HarddiskVolume1\Program Files (x86)\Google\Chrome\Application\chrome.exe	device_id:pid	pid	2020-10-01T09:05:51Z	132460167512852140	2020-10-02T06:43:45Z	132460946259334768

cs-falcon-device-ran-on

Returns a list of device IDs an indicator ran on.

Base Command

cs-falcon-device-ran-on

Input

Context Output

Command Example

!cs-falcon-device-ran-on type=domain value=value

Context Example

{
    "CrowdStrike": {
        "DeviceID": [
            "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"
        ]
    }
}

Human Readable Output

Devices that encountered the IOC domain:value

Device ID
a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1

cs-falcon-list-detection-summaries

Lists detection summaries.

Base Command

cs-falcon-list-detection-summaries

Input

Context Output

Command Example

#### Context Example

```json
{
    "CrowdStrike": {
        "Detections": [
            {
                "behaviors": [
                    {
                        "alleged_filetype": "exe",
                        "behavior_id": "10197",
                        "cmdline": "choice  /m crowdstrike_sample_detection",
                        "confidence": 80,
                        "control_graph_id": "ctg:ctg:ctg",
                        "device_id": "deviceid",
                        "display_name": "",
                        "filename": "choice.exe",
                        "filepath": "",
                        "ioc_description": "",
                        "ioc_source": "",
                        "ioc_type": "",
                        "ioc_value": "",
                        "md5": "md5",
                        "objective": "Falcon Detection Method",
                        "parent_details": {
                            "parent_cmdline": "\"C:\\Windows\\system32\\cmd.exe\" ",
                            "parent_md5": "md5",
                            "parent_process_graph_id": "pid:pid:pid",
                            "parent_sha256": "sha256"
                        },
                        "pattern_disposition": 0,
                        "pattern_disposition_details": {
                            "bootup_safeguard_enabled": false,
                            "critical_process_disabled": false,
                            "detect": false,
                            "fs_operation_blocked": false,
                            "inddet_mask": false,
                            "indicator": false,
                            "kill_parent": false,
                            "kill_process": false,
                            "kill_subprocess": false,
                            "operation_blocked": false,
                            "policy_disabled": false,
                            "process_blocked": false,
                            "quarantine_file": false,
                            "quarantine_machine": false,
                            "registry_operation_blocked": false,
                            "rooting": false,
                            "sensor_only": false
                        },
                        "scenario": "suspicious_activity",
                        "severity": 30,
                        "sha256": "sha256",
                        "tactic": "Malware",
                        "tactic_id": "",
                        "technique": "Malicious File",
                        "technique_id": "",
                        "template_instance_id": "382",
                        "timestamp": "2020-07-06T08:10:44Z",
                        "triggering_process_graph_id": "pid:pid:pid",
                        "user_id": "user_id",
                        "user_name": "user_name"
                    }
                ],
                "behaviors_processed": [
                    "pid:pid:pid:10197"
                ],
                "cid": "cid",
                "created_timestamp": "2020-07-06T08:10:55.538668036Z",
                "detection_id": "ldt:ldt:ldt",
                "device": {
                    "agent_load_flags": "0",
                    "agent_local_time": "2020-07-02T01:42:07.640Z",
                    "agent_version": "5.32.11406.0",
                    "bios_manufacturer": "Google",
                    "bios_version": "Google",
                    "cid": "cid",
                    "config_id_base": "id",
                    "config_id_build": "id",
                    "config_id_platform": "3",
                    "device_id": "device_id",
                    "external_ip": "external_ip",
                    "first_seen": "2020-02-10T12:40:18Z",
                    "hostname": "FALCON-CROWDSTR",
                    "last_seen": "2020-07-06T07:59:12Z",
                    "local_ip": "local_ip",
                    "mac_address": "mac_address",
                    "major_version": "major_version",
                    "minor_version": "minor_version",
                    "modified_timestamp": "modified_timestamp",
                    "os_version": "os_version",
                    "platform_id": "platform_id",
                    "platform_name": "platform_name",
                    "product_type": "product_type",
                    "product_type_desc": "product_type_desc",
                    "status": "status",
                    "system_manufacturer": "system_manufacturer",
                    "system_product_name": "system_product_name"
                },
                "email_sent": false,
                "first_behavior": "2020-07-06T08:10:44Z",
                "hostinfo": {
                    "domain": ""
                },
                "last_behavior": "2020-07-06T08:10:44Z",
                "max_confidence": 80,
                "max_severity": 30,
                "max_severity_displayname": "Low",
                "seconds_to_resolved": 0,
                "seconds_to_triaged": 0,
                "show_in_ui": true,
                "status": "new"
            }
        ]
    }
}

Human Readable Output

CrowdStrike Detections

detection_id	created_time	status	max_severity
ldt:ldt:ldt	2020-07-06T08:10:55.538668036Z	new	Low

endpoint

Returns information about an endpoint. Does not support regex.

Base Command

endpoint

Input

Context Output

Command Example

!endpoint id=15dbb9d5fe9f61eb46e829d986

Context Example

{
  "Endpoint":
    {
      "Hostname": "Hostname",
      "ID": "15dbb9d5fe9f61eb46e829d986",
      "IPAddress": "1.1.1.1",
      "OS": "Windows",
      "OSVersion": "Windows Server 2019",
      "Status": "Online",
      "￿Vendor": "CrowdStrike Falcon",
      "￿MACAddress": "1-1-1-1"
    }
}

Human Readable Output

Endpoints

ID	IPAddress	OS	OSVersion	Hostname	Status	MACAddress	Vendor
a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	1.1.1.1	Windows	Windows Server 2019	Hostname	Online	1-1-1-1	CrowdStrike Falcon	\n”

cs-falcon-create-host-group

Create a host group.

Base Command

cs-falcon-create-host-group

Input

Context Output

Command Example

!cs-falcon-create-host-group name="test_name_1" description="test_description" group_type=static

Context Example

{
    "CrowdStrike": {
        "HostGroup": {
            "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "created_timestamp": "2021-08-25T08:02:02.060242909Z",
            "description": "test_description",
            "group_type": "static",
            "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "modified_timestamp": "2021-08-25T08:02:02.060242909Z",
            "name": "test_name_1"
        }
    }
}

Human Readable Output

Results

created_by	created_timestamp	description	group_type	id	modified_by	modified_timestamp	name
api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	2021-08-25T08:02:02.060242909Z	test_description	static	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	2021-08-25T08:02:02.060242909Z	test_name_1

cs-falcon-list-host-groups

List the available host groups.

Base Command

cs-falcon-list-host-groups

Input

Context Output

Command Example

#### Context Example

```json
{
    "CrowdStrike": {
        "HostGroup": [
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T14:35:23.765624811Z",
                "description": "description",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T14:35:23.765624811Z",
                "name": "InnerServicesModuleMon Aug 23 2021"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T14:35:25.506030441Z",
                "description": "description",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T14:35:25.506030441Z",
                "name": "Rasterize_default_instanceMon Aug 23 2021"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['','FALCON-CROWDSTR']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-07-27T12:34:59.13917402Z",
                "description": "",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-07-27T12:34:59.13917402Z",
                "name": "Static by id group test"
            },
            {
                "assignment_rule": "device_id:[],hostname:[]",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-07-27T12:24:18.364057533Z",
                "description": "Group test",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-07-27T12:24:18.364057533Z",
                "name": "Static group test"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T14:35:26.069515348Z",
                "description": "description",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T14:35:26.069515348Z",
                "name": "ad-loginMon Aug 23 2021"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T14:35:25.556897468Z",
                "description": "description",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T14:35:25.556897468Z",
                "name": "ad-queryMon Aug 23 2021"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T14:35:23.737307612Z",
                "description": "description",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T14:35:23.737307612Z",
                "name": "d2Mon Aug 23 2021"
            },
            {
                "created_by": "someone@email.com",
                "created_timestamp": "2021-07-27T12:27:43.503021999Z",
                "description": "dhfh",
                "group_type": "staticByID",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "someone@email.com",
                "modified_timestamp": "2021-07-27T12:27:43.503021999Z",
                "name": "ddfxgh"
            },
            {
                "assignment_rule": "device.hostname:'FALCON-CROWDSTR'",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-07-27T12:46:39.058352326Z",
                "description": "",
                "group_type": "dynamic",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-07-27T12:46:39.058352326Z",
                "name": "dynamic 1 group test"
            },
            {
                "assignment_rule": "lkjlk:'FalconGroupingTags/example_tag'",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T13:12:56.338590022Z",
                "description": "",
                "group_type": "dynamic",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T13:12:56.338590022Z",
                "name": "dynamic 13523 group test"
            },
            {
                "assignment_rule": "lkjlk:'FalconGroupingTags/example_tag'",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-07-27T14:02:05.538065349Z",
                "description": "",
                "group_type": "dynamic",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-07-27T14:02:05.538065349Z",
                "name": "dynamic 1353 group test"
            },
            {
                "assignment_rule": "tags:'FalconGroupingTags/example_tag'",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-07-27T12:41:33.127997409Z",
                "description": "",
                "group_type": "dynamic",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-07-27T12:41:33.127997409Z",
                "name": "dynamic 2 group test"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T14:35:23.7402217Z",
                "description": "description",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T14:35:23.7402217Z",
                "name": "fcm_default_instanceMon Aug 23 2021"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-11T09:55:23.801049103Z",
                "description": "ilan test",
                "group_type": "dynamic",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-11T09:55:23.801049103Z",
                "name": "ilan"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-12T11:24:51.434863056Z",
                "description": "ilan test",
                "group_type": "dynamic",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-12T11:24:51.434863056Z",
                "name": "ilan 2"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['FALCON-CROWDSTR']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-12T11:55:57.943490809Z",
                "description": "ilan test",
                "group_type": "dynamic",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-12T11:55:57.943490809Z",
                "name": "ilan 23"
            },
            {
                "assignment_rule": "",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-17T11:28:39.855075106Z",
                "description": "after change",
                "group_type": "dynamic",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T09:26:15.351650252Z",
                "name": "ilan 2345"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-17T11:58:42.453661998Z",
                "description": "ilan test",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-17T11:58:42.453661998Z",
                "name": "ilan 23e"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-11T13:54:59.695821727Z",
                "description": "",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-11T13:54:59.695821727Z",
                "name": "ilan test 2"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-12T10:56:49.2127345Z",
                "description": "ilan test",
                "group_type": "dynamic",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-12T11:35:35.76509212Z",
                "name": "ilan2"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T14:35:23.766284685Z",
                "description": "description",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T14:35:23.766284685Z",
                "name": "splunkMon Aug 23 2021"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T15:09:15.36414377Z",
                "description": "description",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T15:09:15.36414377Z",
                "name": "test_1629731353498"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T15:12:20.69203954Z",
                "description": "description",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T15:12:20.69203954Z",
                "name": "test_1629731538458"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T15:14:20.650781714Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T15:14:23.026511269Z",
                "name": "test_16297316587261629731658726"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T15:18:53.896505566Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T15:18:56.2598933Z",
                "name": "test_16297319320381629731932038"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T15:19:51.91067257Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T15:19:54.269898808Z",
                "name": "test_16297319902371629731990237"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T15:25:42.99601887Z",
                "description": "description",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T15:25:42.99601887Z",
                "name": "test_1629732339973"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T15:26:12.280379354Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T15:26:14.973676462Z",
                "name": "test_16297323698941629732369894"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T15:26:58.717706381Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T15:27:01.648623079Z",
                "name": "test_16297324168771629732416877"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T15:28:18.674512647Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T15:28:21.781563212Z",
                "name": "test_16297324965761629732496576"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['FALCON-CROWDSTR','INSTANCE-1','falcon-crowdstrike-sensor-centos7']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T15:31:41.142748214Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T15:31:43.800147323Z",
                "name": "test_16297326990981629732699098"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T15:34:20.195778795Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T15:34:23.212828317Z",
                "name": "test_16297328579781629732857978"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T15:34:55.837119719Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T15:34:58.490114093Z",
                "name": "test_16297328938791629732893879"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-23T15:37:42.911344704Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-23T15:37:45.620464598Z",
                "name": "test_16297330605301629733060530"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-24T07:05:55.813475476Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-24T07:05:58.805702883Z",
                "name": "test_16297887501421629788750142"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-24T07:07:30.422517324Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-24T07:07:34.291988227Z",
                "name": "test_16297888481381629788848138"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-24T08:03:15.522772079Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-24T08:03:18.622015517Z",
                "name": "test_16297921932741629792193274"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-26T09:09:52.379925975Z",
                "description": "description",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-26T09:09:52.379925975Z",
                "name": "test_1629967211800"
            },
            {
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-26T12:34:36.934507422Z",
                "description": "description",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-26T12:34:36.934507422Z",
                "name": "test_162996721180000"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-26T08:46:09.996065663Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-26T08:46:11.572092204Z",
                "name": "test_16299675695531629967569553"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-26T08:53:15.35181954Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-26T08:53:17.041535905Z",
                "name": "test_16299679949831629967994983"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-26T08:59:52.639696743Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-26T08:59:54.538170036Z",
                "name": "test_16299683923121629968392312"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-26T09:06:21.891707157Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-26T09:06:23.846219163Z",
                "name": "test_16299687814871629968781487"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-26T09:12:53.982989Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-26T09:12:55.571265187Z",
                "name": "test_16299691732871629969173287"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-26T09:17:58.206157753Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-26T09:17:59.659515838Z",
                "name": "test_16299694779051629969477905"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-26T09:19:23.276267291Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-26T09:19:25.318976241Z",
                "name": "test_16299695623981629969562398"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-26T09:26:22.538367707Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-26T09:26:25.085214782Z",
                "name": "test_16299699813871629969981387"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-26T09:33:46.303790983Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-26T09:33:48.288311235Z",
                "name": "test_16299704254441629970425444"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-26T09:55:09.157561612Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-26T09:55:10.741852436Z",
                "name": "test_16299717065381629971706538"
            },
            {
                "assignment_rule": "device_id:[''],hostname:['']",
                "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "created_timestamp": "2021-08-26T10:02:50.175530821Z",
                "description": "description2",
                "group_type": "static",
                "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "modified_timestamp": "2021-08-26T10:02:52.026307768Z",
                "name": "test_16299721694081629972169408"
            }
        ]
    }
}

Human Readable Output

Results

assignment_rule	created_by	created_timestamp	description	group_type	id	modified_by	modified_timestamp	name
device_id:[’’],hostname:[’’]	api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	2021-08-26T10:02:50.175530821Z	description2	static	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	2021-08-26T10:02:52.026307768Z	test_16299721694081629972169408

cs-falcon-delete-host-groups

Deletes the requested host groups.

Base Command

cs-falcon-delete-host-groups

Input

Context Output

There is no context output for this command.

Command Example

!cs-falcon-delete-host-groups host_group_id=a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1,a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1

Human Readable Output

host group id a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1 deleted successfully
host group id a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1 deleted successfully

cs-falcon-update-host-group

Updates a host group.

Base Command

cs-falcon-update-host-group

Input

Context Output

Command Example

!cs-falcon-update-host-group host_group_id=a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1 name="test_name_update_1" description="test_description_update"

Context Example

{
    "CrowdStrike": {
        "HostGroup": {
            "assignment_rule": "device_id:[''],hostname:['']",
            "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "created_timestamp": "2021-08-22T07:48:35.111070562Z",
            "description": "test_description_update",
            "group_type": "static",
            "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "modified_timestamp": "2021-08-25T08:02:05.295663156Z",
            "name": "test_name_update_1"
        }
    }
}

Human Readable Output

Results

assignment_rule	created_by	created_timestamp	description	group_type	id	modified_by	modified_timestamp	name
device_id:[’’],hostname:[’’]	api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	2021-08-22T07:48:35.111070562Z	test_description_update	static	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	2021-08-25T08:02:05.295663156Z	test_name_update_1

cs-falcon-list-host-group-members

Gets the list of host group members.

Base Command

cs-falcon-list-host-group-members

Input

Context Output

Command Example

#### Context Example

```json
{
    "CrowdStrike": {
        "Device": [
            {
                "ExternalIP": "35.224.136.145",
                "FirstSeen": "2021-08-12T16:13:26Z",
                "Hostname": "FALCON-CROWDSTR",
                "ID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "LastSeen": "2021-08-23T04:59:48Z",
                "LocalIP": "10.128.0.21",
                "MacAddress": "42-01-0a-80-00-15",
                "OS": "Windows Server 2019",
                "Status": "normal"
            },
            {
                "ExternalIP": "35.224.136.145",
                "FirstSeen": "2020-02-10T12:40:18Z",
                "Hostname": "FALCON-CROWDSTR",
                "ID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "LastSeen": "2021-08-25T07:42:47Z",
                "LocalIP": "10.128.0.7",
                "MacAddress": "42-01-0a-80-00-07",
                "OS": "Windows Server 2019",
                "Status": "contained"
            },
            {
                "ExternalIP": "35.224.136.145",
                "FirstSeen": "2021-08-23T05:04:41Z",
                "Hostname": "INSTANCE-1",
                "ID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "LastSeen": "2021-08-25T07:49:06Z",
                "LocalIP": "10.128.0.20",
                "MacAddress": "42-01-0a-80-00-14",
                "OS": "Windows Server 2019",
                "Status": "normal"
            },
            {
                "ExternalIP": "35.224.136.145",
                "FirstSeen": "2021-08-11T13:57:29Z",
                "Hostname": "INSTANCE-1",
                "ID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "LastSeen": "2021-08-23T04:45:37Z",
                "LocalIP": "10.128.0.20",
                "MacAddress": "42-01-0a-80-00-14",
                "OS": "Windows Server 2019",
                "Status": "normal"
            },
            {
                "ExternalIP": "35.224.136.145",
                "FirstSeen": "2021-08-08T11:33:21Z",
                "Hostname": "falcon-crowdstrike-sensor-centos7",
                "ID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
                "LastSeen": "2021-08-25T07:50:47Z",
                "LocalIP": "10.128.0.19",
                "MacAddress": "42-01-0a-80-00-13",
                "OS": "CentOS 7.9",
                "Status": "normal"
            }
        ]
    }
}

Human Readable Output

Devices

ID	External IP	Local IP	Hostname	OS	Mac Address	First Seen	Last Seen	Status
a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	35.224.136.145	10.128.0.19	falcon-crowdstrike-sensor-centos7	CentOS 7.9	42-01-0a-80-00-13	2021-08-08T11:33:21Z	2021-08-25T07:50:47Z	normal

cs-falcon-add-host-group-members

Add host group members.

Base Command

cs-falcon-add-host-group-members

Input

Context Output

Command Example

!cs-falcon-add-host-group-members host_group_id="a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1" host_ids="a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"

Context Example

{
    "CrowdStrike": {
        "HostGroup": {
            "assignment_rule": "device_id:[''],hostname:['falcon-crowdstrike-sensor-centos7','']",
            "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "created_timestamp": "2021-08-22T07:48:35.111070562Z",
            "description": "test_description_update",
            "group_type": "static",
            "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "modified_timestamp": "2021-08-25T08:02:05.295663156Z",
            "name": "test_name_update_1"
        }
    }
}

Human Readable Output

Results

assignment_rule	created_by	created_timestamp	description	group_type	id	modified_by	modified_timestamp	name
device_id:[’’],hostname:[‘falcon-crowdstrike-sensor-centos7’,’’]	api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	2021-08-22T07:48:35.111070562Z	test_description_update	static	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	2021-08-25T08:02:05.295663156Z	test_name_update_1

cs-falcon-remove-host-group-members

Remove host group members.

Base Command

cs-falcon-remove-host-group-members

Input

Context Output

Command Example

!cs-falcon-remove-host-group-members host_group_id="a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1" host_ids="a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"

Context Example

{
    "CrowdStrike": {
        "HostGroup": {
            "assignment_rule": "device_id:[''],hostname:['']",
            "created_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "created_timestamp": "2021-08-22T07:48:35.111070562Z",
            "description": "test_description_update",
            "group_type": "static",
            "id": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "modified_by": "api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "modified_timestamp": "2021-08-25T08:02:05.295663156Z",
            "name": "test_name_update_1"
        }
    }
}

Human Readable Output

Results

assignment_rule	created_by	created_timestamp	description	group_type	id	modified_by	modified_timestamp	name
device_id:[’’],hostname:[’’]	api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	2021-08-22T07:48:35.111070562Z	test_description_update	static	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	api-client-id:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	2021-08-25T08:02:05.295663156Z	test_name_update_1

cs-falcon-batch-upload-custom-ioc

Uploads a batch of indicators.

Base Command

cs-falcon-batch-upload-custom-ioc

Input

Context Output

Command Example

!cs-falcon-batch-upload-custom-ioc multiple_indicators_json=`[{"description": "test", "expiration": "2022-02-17T13:47:57Z", "type": "ipv4", "severity": "Informational", "value": "1.1.8.9", "action": "no_action", "platforms": ["mac"], "source": "Cortex", "applied_globally": true}]`

Context Example

{
    "CrowdStrike": {
        "IOC": {
            "Action": "no_action",
            "CreatedBy": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "CreatedTime": "2022-02-16T17:17:25.992164453Z",
            "Description": "test",
            "Expiration": "2022-02-17T13:47:57Z",
            "ID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "ModifiedBy": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
            "ModifiedTime": "2022-02-16T17:17:25.992164453Z",
            "Platforms": [
                "mac"
            ],
            "Severity": "informational",
            "Source": "Cortex",
            "Type": "ipv4",
            "Value": "1.1.8.9"
        }
    }
}

Human Readable Output

Custom IOC 1.1.8.9 was created successfully

Action	CreatedBy	CreatedTime	Description	Expiration	ID	ModifiedBy	ModifiedTime	Platforms	Severity	Source	Type	Value
no_action	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	2022-02-16T17:17:25.992164453Z	test	2022-02-17T13:47:57Z	“a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	2022-02-16T17:17:25.992164453Z	mac	informational	Cortex	ipv4	1.1.8.9

cs-falcon-rtr-kill-process

Execute an active responder kill command on a single host.

Base Command

cs-falcon-rtr-kill-process

Input

Context Output

Command Example

!cs-falcon-rtr-kill-process host_id=a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1 process_ids=5260,123

Context Example

{
  "CrowdStrike": {
    "Command": {
      "kill": [
        {
          "Error": "Cannot find a process with the process identifier 123.",
          "HostID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
          "ProcessID": "123"
        },
        {
          "Error": "Success",
          "HostID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
          "ProcessID": "5260"
        }
      ]
    }
  }
}

Human Readable Output

CrowdStrike Falcon kill command on host a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1

|ProcessID|Error|
|—|—|
| 123 | Cannot find a process with the process identifier 123. |
| 5260 | Success |
Note: you don’t see the following IDs in the results as the request was failed for them.
ID 123 failed as it was not found.

cs-falcon-rtr-remove-file

Batch executes an RTR active-responder remove file across the hosts mapped to the given batch ID.

Base Command

cs-falcon-rtr-remove-file

Input

Context Output

Command Example

!cs-falcon-rtr-remove-file file_path="c:\\testfolder" host_ids=a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1 os=Windows

Context Example

{
  "CrowdStrike": {
    "Command": {
      "rm": {
        "Error": "Success",
        "HostID": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"
      }
    }
  }
}

Human Readable Output

CrowdStrike Falcon rm over the file: c:\testfolder

HostID	Error
a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1	Success

cs-falcon-rtr-list-processes

Executes an RTR active-responder ps command to get a list of active processes across the given host.

Base Command

cs-falcon-rtr-list-processes

Input

Context Output

Command Example

!cs-falcon-rtr-list-processes host_id=a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1

Context Example

{
  "CrowdStrike": {
    "Command": {
      "ps": {
        "Filename": "ps-a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"
      }
    }
  },
  "File": {
    "EntryID": "1792@5e02fcd0-37ad-4124-836d-7e769ba0ae86",
    "Info": "text/plain",
    "MD5": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
    "Name": "ps-a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
    "SHA1": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a115919af3",
    "SHA256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
    "SHA512": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
    "SSDeep": "768:4jcAkTBaZ61QUEcDBdMoFwIxVvroYrohrbY2akHLnsa5fbqFEJtPNObzVj0ff+3K:4IraZ61QUEcDBdMoFwIxRJEbY2akHLnr",
    "Size": 30798,
    "Type": "ASCII text"
  }
}

Human Readable Output

CrowdStrike Falcon ps command on host a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1

Stdout
TOO MUCH INFO TO DISPLAY

cs-falcon-rtr-list-network-stats

Executes an RTR active-responder netstat command to get a list of network status and protocol statistics across the given host.

Base Command

cs-falcon-rtr-list-network-stats

Input

Context Output

Command Example

!cs-falcon-rtr-list-network-stats host_id=a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1

Context Example

{
  "CrowdStrike": {
    "Command": {
      "netstat": {
        "Filename": "netstat-a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"
      }
    }
  },
  "File": {
    "EntryID": "1797@5e02fcd0-37ad-4124-836d-7e769ba0ae86",
    "Info": "text/plain",
    "MD5": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
    "Name": "netstat-a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
    "SHA1": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1864ce595",
    "SHA256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
    "SHA512": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
    "SSDeep": "48:XSvprPoeCfd8saowYL8zjt6yjjRchg24OI58RtTLvWptl6TtCla5n1lEtClMw/u:CRQeCxRmxVpIHUchCIvsCo",
    "Size": 4987,
    "Type": "ASCII text, with CRLF line terminators"
  }
}

Human Readable Output

CrowdStrike Falcon netstat command on host a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1

Stdout
TOO MUCH INFO TO DISPLAY

cs-falcon-rtr-read-registry

Executes an RTR active-responder read registry keys command across the given hosts. This command is valid only for Windows hosts.

Base Command

cs-falcon-rtr-read-registry

Input

Context Output

There is no context output for this command.

Command Example

!cs-falcon-rtr-read-registry host_ids=a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1 registry_keys=` HKEY_LOCAL_MACHINE,HKEY_USERS`

Context Example

{
  "File": [
    {
      "EntryID": "1806@5e02fcd0-37ad-4124-836d-7e769ba0ae86",
      "Info": "text/plain",
      "MD5": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
      "Name": "reg-a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1HKEY_USERS",
      "SHA1": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a139dd0333",
      "SHA256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
      "SHA512": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
      "SSDeep": "12:uSn3PtdoI1pZI2WUNI2e6NI2vboI2vbP3I2zd:uSQIpZIII1aIUMIUjIcd",
      "Size": 656,
      "Type": "ASCII text, with CRLF, LF line terminators"
    },
    {
      "EntryID": "1807@5e02fcd0-37ad-4124-836d-7e769ba0ae86",
      "Info": "text/plain",
      "MD5": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
      "Name": "reg-a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1HKEY_LOCAL_MACHINE",
      "SHA1": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a18e3b4919",
      "SHA256": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
      "SHA512": "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
      "SSDeep": "6:zYuSugMQEYPtdWCMwdiwf2Jai2FU42DGE25/:zYuSnMQXPtd9/eJqy7yfh",
      "Size": 320,
      "Type": "ASCII text, with CRLF, LF line terminators"
    }
  ]
}