CrowdStrike Falcon Intel v2

CrowdStrike Threat intelligence service integration helps organizations defend themselves against adversary activity by investigating incidents, and accelerating alert triage and response.

Data Enrichment & Threat Intelligence · CrowdStrike Falcon Intel

Configuration parameters

  • server_url — Server URL (e.g., https://example.net) (required)
  • credentials — Client ID (required)
  • timeout — The amount of time (in seconds) that a request will wait for a client to establish a connection to a remote machine before a timeout occurs.
  • threshold — Indicator Threshold. Minimum malicious confidence from Falcon Intel to consider the indicator malicious.
  • integrationReliability — Source Reliability (required)
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)

Commands (7)

  • cs-actors

    Search known actors based on the given parameters.

  • cs-indicators

    Search known indicators based on the given parameters.

  • cs-reports

    Queries CrowdStrike intelligence publications.

  • domain

    Checks the domain reputation.

  • file

    Checks the file reputation.

  • ip

    Checks the IP reputation.

  • url

    Checks the URL reputation.