CrowdStrike Falcon Intel v2

CrowdStrike Threat intelligence service integration helps organizations defend themselves against adversary activity by investigating incidents, and accelerating alert triage and response.

Data Enrichment & Threat Intelligence · CrowdStrike Falcon Intel

Details

IDCrowdStrike Falcon Intel v2
ProviderCrowdStrike
CategoryData Enrichment & Threat Intelligence
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

Threat intelligence service by CrowdStrike focused on delivering a technical feed to help organizations better defend themselves against adversary activity.

Configure CrowdStrike Falcon Intel v2 in Cortex

Parameter Description Required
Server URL The server URL to which you want to connect True
credentials Client ID True
threshold Indicator Threshold. Minimum malicious confidence from Falcon Intel to consider the indicator malicious.(low, medium, high) False
proxy Use system proxy settings False
insecure Trust any certificate (not secure) False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

file

Check file reputation.

Base Command

file

Input

Argument Name Description Required
file A comma-separated list of file hashes (MD5/SHA1/SHA256) to check. Required

Context Output

Path Type Description
File.MD5 String The MD5 hash of the file.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA256 hash of the file.
File.Malicious.Vendor String The vendor that reported the file as malicious.
File.Malicious.Description String A description explaining why the file was determined to be malicious.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
FalconIntel.Indicator.ID String The indicator ID.
FalconIntel.Indicator.Type String The indicator type.
FalconIntel.Indicator.Value String The indicator value.
FalconIntel.Indicator.LastUpdate Date The last time the indicator was updated.
FalconIntel.Indicator.PublishDate Date The time the indicator was published.
FalconIntel.Indicator.MaliciousConfidence String The confidence level by which an indicator is considered to be malicious
FalconIntel.Indicator.Reports String The report ID that the indicator is associated with
FalconIntel.Indicator.Actors String Actors that the indicator is associated
FalconIntel.Indicator.MalwareFamilies String A list of malware families that an indicator has been associated. An indicator may be associated with more than one malware family.
FalconIntel.Indicator.KillChains String The point in the kill chain at which an indicator is associated
FalconIntel.Indicator.DomainTypes String The domain type of domain indicators
FalconIntel.Indicator.IPAddressTypes String The address type of ip_address indicators
FalconIntel.Indicator.Relations.Indicator String Related Indicators
FalconIntel.Indicator.Type String The indicator type
FalconIntel.Indicator.Labels String Additional labels

Command Example

!file file=sha256_value

Context Example

{
    "DBotScore": {
        "Indicator": "sha256_value",
        "Score": 3,
        "Type": "file",
        "Vendor": "FalconIntel"
    },
    "FalconIntel": {
        "Indzicator": {
            "Actors": [
                "CIRCUSSPIDER"
            ],
            "ID": "hash_sha256_id",
            "Labels": [
                "CSD/CSA-201011",
                "ThreatType/Criminal",
                "CSD/CSWR-20018",
                "CSD/CSWR-20023",
                "CSD/CSDR-20035",
                "CSD/CSWR-20020",
                "CSD/CSWR-20024",
                "CSD/CSWR-20021",
                "MaliciousConfidence/High",
                "Malware/NetWalker"
            ],
            "MaliciousConfidence": "high",
            "MalwareFamilies": [
                "NetWalker"
            ],
            "Relations": [
                "hash_md5: 0432b62130ca06c04d5a12a5e9841300",
                "hash_sha1: fd2b8fff2c583a1af1b86f150be8f611a2292197"
            ],
            "Reports": [
                "CSA-201011",
                "CSWR-20018",
                "CSWR-20023",
                "CSDR-20035",
                "CSWR-20020",
                "CSWR-20024",
                "CSWR-20021",
                "CSA-200605",
                "CSA-200385",
                "CSDR-20090",
                "CSWR-20017",
                "CSIT-20081",
                "CSWR-20011"
            ],
            "Type": "hash_sha256",
            "Value": "sha256_value"
        }
    },
    "File": {
        "Actors": [
            "CIRCUSSPIDER"
        ],
        "Malicious": {
            "Description": "High confidence",
            "Vendor": "FalconIntel"
        },
        "MalwareFamilies": [
            "NetWalker"
        ],
        "Reports": [
            "CSA-201011",
            "CSWR-20018",
            "CSWR-20023",
            "CSDR-20035",
            "CSWR-20020",
            "CSWR-20024",
            "CSWR-20021",
            "CSA-200605",
            "CSA-200385",
            "CSDR-20090",
            "CSWR-20017",
            "CSIT-20081",
            "CSWR-20011"
        ],
        "SHA256": "sha256_value"
    }
}

Human Readable Output

Falcon Intel file reputation

Actors ID Labels Malicious Confidence Malware Families Relations Reports Type Value
CIRCUSSPIDER hash_sha256_sha256_value CSD/CSA-201011,
ThreatType/Criminal,
CSD/CSWR-20018,
CSD/CSWR-20023,
CSD/CSDR-20035,
CSD/CSWR-20020,
CSD/CSWR-20024,
CSD/CSWR-20021,
MaliciousConfidence/High,
Malware/NetWalker		 high NetWalker hash_md5: 0432b62130ca06c04d5a12a5e9841300,
hash_sha1: fd2b8fff2c583a1af1b86f150be8f611a2292197		 CSA-201011,
CSWR-20018,
CSWR-20023,
CSDR-20035,
CSWR-20020,
CSWR-20024,
CSWR-20021,
CSA-200605,
CSA-200385,
CSDR-20090,
CSWR-20017,
CSIT-20081,
CSWR-20011		 hash_sha256 sha256_value

url

Check the given URL reputation.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

url

Input

Argument Name Description Required
url A comma-separated list of URLs to check. Required

Context Output

Path Type Description
URL.Data String The URL
URL.Malicious.Vendor String The vendor reporting the URL as malicious.
URL.Malicious.Description String A description of the malicious URL.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
FalconIntel.Indicator.ID String The indicator ID.
FalconIntel.Indicator.Type String The indicator type.
FalconIntel.Indicator.Value String The indicator value.
FalconIntel.Indicator.LastUpdate Date The last time the indicator was updated.
FalconIntel.Indicator.PublishDate Date The time the indicator was published.
FalconIntel.Indicator.MaliciousConfidence String The confidence level by which an indicator is considered to be malicious
FalconIntel.Indicator.Reports String The report ID that the indicator is associated with
FalconIntel.Indicator.Actors String Actors that the indicator is associated
FalconIntel.Indicator.MalwareFamilies String A list of malware families that an indicator has been associated. An indicator may be associated with more than one malware family.
FalconIntel.Indicator.KillChains String The point in the kill chain at which an indicator is associated
FalconIntel.Indicator.DomainTypes String The domain type of domain indicators
FalconIntel.Indicator.IPAddressTypes String The address type of ip_address indicators
FalconIntel.Indicator.Relations.Indicator String Related Indicators
FalconIntel.Indicator.Type String The indicator type
FalconIntel.Indicator.Labels String Additional labels

Command Example

!url url=https://withifceale.top/treusparq.php

Context Example

{
    "DBotScore": {
        "Indicator": "https://withifceale.top/treusparq.php",
        "Score": 3,
        "Type": "url",
        "Vendor": "FalconIntel"
    },
    "FalconIntel": {
        "Indicator": {
            "ID": "url_https://withifceale.top/treusparq.php",
            "KillChains": [
                "C2"
            ],
            "Labels": [
                "CSD/CSA-200342",
                "KillChain/C2",
                "Malware/Zloader",
                "CSD/CSDR-20011",
                "CSD/CSIT-20009",
                "CSD/CSA-191551",
                "MaliciousConfidence/High",
                "ThreatType/Criminal",
                "CSD/CSA-200038",
                "ThreatType/Banking"
            ],
            "MaliciousConfidence": "high",
            "MalwareFamilies": [
                "Zloader"
            ],
            "Relations": [
                "hash_sha256: sha256_value",
                "hash_sha256: sha256_value",
                "hash_sha256: sha256_value",
                "hash_md5: md5_value",
                "hash_md5: md5_value",
                "hash_sha1: sha1_value",
                "hash_sha1: sha1_value",
                "hash_md5: md5_value",
                "hash_sha1: sha1_value",
                "hash_sha1: sha1_value"
            ],
            "Reports": [
                "CSA-200342",
                "CSDR-20011",
                "CSIT-20009",
                "CSA-191551",
                "CSA-200038",
                "CSIT-17112",
                "CSA-200149"
            ],
            "Type": "url",
            "Value": "https://withifceale.top/treusparq.php"
        }
    },
    "URL": {
        "Data": "https://withifceale.top/treusparq.php",
        "KillChains": [
            "C2"
        ],
        "Malicious": {
            "Description": "High confidence",
            "Vendor": "FalconIntel"
        },
        "MalwareFamilies": [
            "Zloader"
        ],
        "Reports": [
            "CSA-200342",
            "CSDR-20011",
            "CSIT-20009",
            "CSA-191551",
            "CSA-200038",
            "CSIT-17112",
            "CSA-200149"
        ]
    }
}

Human Readable Output

Falcon Intel URL reputation

ID Kill Chains Labels Malicious Confidence Malware Families Relations Reports Type Value
url_https://withifceale.top/treusparq.php C2 CSD/CSA-200342,
KillChain/C2,
Malware/Zloader,
CSD/CSDR-20011,
CSD/CSIT-20009,
CSD/CSA-191551,
MaliciousConfidence/High,
ThreatType/Criminal,
CSD/CSA-200038,
ThreatType/Banking		 high Zloader hash_sha256: sha256_value,
hash_sha256: sha256_value,
hash_sha256: sha256_value,
hash_md5: md5_value,
hash_md5: md5_value,
hash_sha1: sha1_value,
hash_sha1: sha1_value,
hash_md5: md5_value,
hash_sha1: sha1_value,
hash_sha1: sha1_value		 CSA-200342,
CSDR-20011,
CSIT-20009,
CSA-191551,
CSA-200038,
CSIT-17112,
CSA-200149		 url https://withifceale.top/treusparq.php

domain

Check the given URL reputation.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

domain

Input

Argument Name Description Required
domain A comma-seperated list of domains to check. Required

Context Output

Path Type Description
Domain.Name String The domain name, for example: “google.com”.
Domain.Malicious.Vendor String The vendor reporting the domain as malicious.
Domain.Malicious.Description String A description explaining why the domain was reported as malicious.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
FalconIntel.Indicator.ID String The indicator ID.
FalconIntel.Indicator.Type String The indicator type.
FalconIntel.Indicator.Value String The indicator value.
FalconIntel.Indicator.LastUpdate Date The last time the indicator was updated.
FalconIntel.Indicator.PublishDate Date The time the indicator was published.
FalconIntel.Indicator.MaliciousConfidence String The confidence level by which an indicator is considered to be malicious
FalconIntel.Indicator.Reports String The report ID that the indicator is associated with
FalconIntel.Indicator.Actors String Actors that the indicator is associated
FalconIntel.Indicator.MalwareFamilies String A list of malware families that an indicator has been associated. An indicator may be associated with more than one malware family.
FalconIntel.Indicator.KillChains String The point in the kill chain at which an indicator is associated
FalconIntel.Indicator.DomainTypes String The domain type of domain indicators
FalconIntel.Indicator.IPAddressTypes String The address type of ip_address indicators
FalconIntel.Indicator.Relations.Indicator String Related Indicators
FalconIntel.Indicator.Type String The indicator type
FalconIntel.Indicator.Labels String Additional labels

Command Example

!domain domain=xeemoquo.top

Context Example

{
    "DBotScore": {
        "Indicator": "xeemoquo.top",
        "Score": 3,
        "Type": "domain",
        "Vendor": "FalconIntel"
    },
    "Domain": {
        "KillChains": [
            "C2"
        ],
        "Malicious": {
            "Description": "High confidence",
            "Vendor": "FalconIntel"
        },
        "Name": "xeemoquo.top",
        "Reports": [
            "CSA-191551",
            "CSA-200038",
            "CSDR-20011",
            "CSA-200149"
        ]
    },
    "FalconIntel": {
        "Indicator": {
            "ID": "domain_xeemoquo.top",
            "KillChains": [
                "C2"
            ],
            "Labels": [
                "CSD/CSA-191551",
                "CSD/CSA-200038",
                "MaliciousConfidence/High",
                "KillChain/C2",
                "CSD/CSDR-20011",
                "CSD/CSA-200149"
            ],
            "MaliciousConfidence": "high",
            "Relations": [
                "hash_md5: md5_value",
                "hash_sha1: sha1_value",
                "hash_sha1: sha1_value",
                "hash_md5: md5_value",
                "hash_sha1: sha1_value",
                "hash_md5: md5_value",
                "hash_md5: md5_value",
                "hash_sha256: sha256_value",
                "hash_sha256: sha256_value",
                "hash_sha1: sha1_value"
            ],
            "Reports": [
                "CSA-191551",
                "CSA-200038",
                "CSDR-20011",
                "CSA-200149"
            ],
            "Type": "domain",
            "Value": "xeemoquo.top"
        }
    }
}

Human Readable Output

Falcon Intel domain reputation

ID Kill Chains Labels Malicious Confidence Relations Reports Type Value
domain_xeemoquo.top C2 CSD/CSA-191551,
CSD/CSA-200038,
MaliciousConfidence/High,
KillChain/C2,
CSD/CSDR-20011,
CSD/CSA-200149		 high hash_md5: md5_value,
hash_sha1: sha1_value,
hash_sha1: sha1_value,
hash_md5: md5_value,
hash_sha1: sha1_value,
hash_md5: md5_value,
hash_md5: md5_value,
hash_sha256: sha256_value,
hash_sha256: sha256_value,
hash_sha1: sha1_value		 CSA-191551,
CSA-200038,
CSDR-20011,
CSA-200149		 domain xeemoquo.top

ip

Check IP reputation.

Base Command

ip

Input

Argument Name Description Required
ip A comma-separated list of IP addresses to check. Required

Context Output

Path Type Description
IP.Address String IP address
IP.Malicious.Vendor String The vendor reporting the IP address as malicious.
IP.Malicious.Description String A description explaining why the IP address was reported as malicious.
DBotScore.Indicator String The indicator that was tested.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
DBotScore.Score Number The actual score.
FalconIntel.Indicator.ID String The indicator ID.
FalconIntel.Indicator.Type String The indicator type.
FalconIntel.Indicator.Value String The indicator value.
FalconIntel.Indicator.LastUpdate Date The last time the indicator was updated.
FalconIntel.Indicator.PublishDate Date The time the indicator was published.
FalconIntel.Indicator.MaliciousConfidence String The confidence level by which an indicator is considered to be malicious
FalconIntel.Indicator.Reports String The report ID that the indicator is associated with
FalconIntel.Indicator.Actors String Actors that the indicator is associated
FalconIntel.Indicator.MalwareFamilies String A list of malware families that an indicator has been associated. An indicator may be associated with more than one malware family.
FalconIntel.Indicator.KillChains String The point in the kill chain at which an indicator is associated
FalconIntel.Indicator.DomainTypes String The domain type of domain indicators
FalconIntel.Indicator.IPAddressTypes String The address type of ip_address indicators
FalconIntel.Indicator.Relations.Indicator String Related Indicators
FalconIntel.Indicator.Type String The indicator type
FalconIntel.Indicator.Labels String Additional labels

Command Example

!ip ip=8.8.8.8

Context Example

{
    "DBotScore": {
        "Indicator": "8.8.8.8",
        "Score": 3,
        "Type": "ip",
        "Vendor": "FalconIntel"
    },
    "FalconIntel": {
        "Indicator": {
            "Actors": [
                "QUILTEDTIGER"
            ],
            "ID": "ip_address_8.8.8.8",
            "KillChains": [
                "C2"
            ],
            "Labels": [
                "KillChain/C2",
                "Malware/Badnews",
                "Actor/QUILTEDTIGER",
                "ThreatType/Targeted",
                "MitreATTCK/CommandAndControl/StandardApplicationLayerProtocol",
                "MaliciousConfidence/High",
                "MitreATTCK/CommandAndControl/CommonlyUsedPort"
            ],
            "MaliciousConfidence": "high",
            "MalwareFamilies": [
                "Badnews"
            ],
            "Relations": [
                "hash_sha1: sha1_value",
                "hash_sha256: sha256_value",
                "hash_md5: md5_value",
                "hash_md5: md5_value",
                "hash_sha256: sha256_value",
                "hash_sha1: sha1_value",
                "hash_md5: md5_value",
                "hash_sha1: sha1_value",
                "hash_sha256: sha256_value",
                "hash_sha1: sha1_value"
            ],
            "Type": "ip_address",
            "Value": "8.8.8.8"
        }
    },
    "IP": {
        "Actors": [
            "QUILTEDTIGER"
        ],
        "Address": "8.8.8.8",
        "KillChains": [
            "C2"
        ],
        "Malicious": {
            "Description": "High confidence",
            "Vendor": "FalconIntel"
        },
        "MalwareFamilies": [
            "Badnews"
        ]
    }
}

Human Readable Output

Falcon Intel IP reputation

Actors ID Kill Chains Labels Malicious Confidence Malware Families Relations Type Value
QUILTEDTIGER ip_address_8.8.8.8 C2 KillChain/C2,
Malware/Badnews,
Actor/QUILTEDTIGER,
ThreatType/Targeted,
MitreATTCK/CommandAndControl/StandardApplicationLayerProtocol,
MaliciousConfidence/High,
MitreATTCK/CommandAndControl/CommonlyUsedPort		 high Badnews hash_sha1: sha1_value,
hash_sha256: sha256_value,
hash_md5: md5_value,
hash_md5: md5_value,
hash_sha256: sha256_value,
hash_sha1: sha1_value,
hash_md5: md5_value,
hash_sha1: sha1_value,
hash_sha256: sha256_value,
hash_sha1: sha1_value		 ip_address 8.8.8.8

cs-actors

Search known actors based on the given parameters.

Base Command

cs-actors

Input

Argument Name Description Required
query Search based on a query written in FQL (Falcon Query Language, See https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-fql for more information). Optional
free_search Search across all fields in an Actor object. Optional
name Search based on actor name. Optional
description Search based on description. Optional
created_date Search range from created date. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours). Optional
max_last_modified_date Search range to modified date. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours). Optional
min_last_activity_date Search range from activity date. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours). Optional
max_last_activity_date Search range to activity date. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours). Optional
origins Search by origins separated by “,”. Optional
target_countries Search by target countries separated by “,”. Optional
target_industries Search by target industries separated by “,”. Optional
motivations Search by motivations separated by “,”. Optional
offset Which page of the results to retrieve. It is 0 based. Optional
limit The maximum number of actors to retrieve. The default is 10. Optional
sort Sort by field and direction. Optional
slug Search by ‘slug’ or short descriptive name. Ex: “anchor-panda” Optional
display_full_fields Whether to display the full fields result from CS API. Default is False Optional

Context Output

Path Type Description
FalconIntel.Actor.ImageURL String The URL of the actor image
FalconIntel.Actor.Name String The actor name.
FalconIntel.Actor.ID String The actor ID.
FalconIntel.Actor.URL String The url of the actor
FalconIntel.Actor.Slug String Slug name ofactor
FalconIntel.Actor.ShortDescription String The actor short description.
FalconIntel.Actor.Description String The actor full description.
FalconIntel.Actor.FirstActivityDate Date The actor first activity date.
FalconIntel.Actor.LastActivityDate Date The actor last activity date.
FalconIntel.Actor.Active Boolean The actor active status.
FalconIntel.Actor.KnowsAs String Nicknames the actor is known as.
FalconIntel.Actor.TargetIndustries String A list of targeted industries associated with this actor
FalconIntel.Actor.TargetCountries String A list of targeted countries associated with this actor
FalconIntel.Actor.Origins String The actor’s country of origin. Ex: Afghanistan
FalconIntel.Actor.Motivations String The actor’s motivations. Ex: Criminal
FalconIntel.Actor.Capability String The actor’s capability. Ex: Average
FalconIntel.Actor.Group String The actor’s group. Ex: panda gang
FalconIntel.Actor.Region String The actor’s region. Ex: Eastern Europe
FalconIntel.Actor.KillChains String Kill chain fields.

Command Example

!cs-actors limit=1 target_industries="Entertainment,Healthcare"

Context Example

{
    "FalconIntel": {
        "Actor": {
            "Active": false,
            "Capability": "Average",
            "FirstActivityDate": "2019-05-01T00:00:00.000Z",
            "ID": 76078,
            "KnownAs": "Maze Team",
            "LastActivityDate": "2020-09-01T00:00:00.000Z",
            "Motivations": [
                "Criminal"
            ],
            "Name": "TWISTED SPIDER",
            "Origins": [
                "Eastern Europe",
                "Russian Federation"
            ],
            "ShortDescription": "TWISTED SPIDER is the criminal group behind the development and operation of Maze ransomware. While the ransomware was first observed in May 2019, the group gained notoriety in November 2019 with their brazen attitude toward victims and their willingness to speak with security researchers as they began using Big Game Hunting (BGH) tactics to target ...",
            "Description": "TWISTED SPIDER is the criminal group behind the development and operation of Maze ransomware. While the ransomware was first observed in May 2019, the group gained notoriety in November 2019 with their brazen attitude toward victims and their willingness to speak with security researchers as they began using Big Game Hunting (BGH) tactics to target organizations and businesses.",
            "Slug": "twisted-spider",
            "TargetCountries": [
                "Algeria",
                "Argentina",
                "Australia",
                "Austria",
                "Belgium",
                "Brazil",
                "Canada",
                "China",
                "Colombia",
                "Costa Rica",
                "Czech Republic",
                "Egypt",
                "France",
                "Germany",
                "Hong Kong",
                "India",
                "Italy",
                "Japan",
                "Luxembourg",
                "Macedonia",
                "Netherlands",
                "Nigeria",
                "North America",
                "Norway",
                "Oman",
                "Puerto Rico",
                "Saudi Arabia",
                "Singapore",
                "South Africa",
                "South Korea",
                "Spain",
                "Sri Lanka",
                "Switzerland",
                "Thailand",
                "United Arab Emirates",
                "United Kingdom",
                "United States",
                "Vietnam"
            ],
            "TargetIndustries": [
                "Academic",
                "Agriculture",
                "Automotive",
                "Aviation",
                "Biomedical",
                "Chemicals",
                "Consulting & Professional Services",
                "Consumer Goods",
                "Energy",
                "Entertainment",
                "Financial Management & Hedge Funds",
                "Financial Services",
                "Food and Beverage",
                "Government",
                "Healthcare",
                "Hospitality",
                "Industrials and Engineering",
                "Insurance",
                "Legal",
                "Logistics",
                "Manufacturing",
                "Media",
                "NGOs and Nonprofits",
                "Oil and Gas",
                "Opportunistic",
                "Pharmaceuticals",
                "Real Estate",
                "Retail",
                "State & Municipal Government",
                "Technology",
                "Telecommunications",
                "Transportation",
                "Travel",
                "Utilities"
            ],
            "URL": "https://falcon.crowdstrike.com/intelligence/actors/twisted-spider/"
        }
    }
}

Human Readable Output

Falcon Intel Actor search

Active Capability First Activity Date ID Known As Last Activity Date Motivations Name Origins Short Description Slug Target Countries Target Industries URL
false Average 2019-05-01T00:00:00.000Z 76078 Maze Team 2020-09-01T00:00:00.000Z Criminal TWISTED SPIDER Eastern Europe,
Russian Federation		 TWISTED SPIDER is the criminal group behind the development and operation of Maze ransomware. While the ransomware was first observed in May 2019, the group gained notoriety in November 2019 with their brazen attitude toward victims and their willingness to speak with security researchers as they began using Big Game Hunting (BGH) tactics to target organizations and businesses. While other actors … twisted-spider Algeria,
Argentina,
Australia,
Austria,
Belgium,
Brazil,
Canada,
China,
Colombia,
Costa Rica,
Czech Republic,
Egypt,
France,
Germany,
Hong Kong,
India,
Italy,
Japan,
Luxembourg,
Macedonia,
Netherlands,
Nigeria,
North America,
Norway,
Oman,
Puerto Rico,
Saudi Arabia,
Singapore,
South Africa,
South Korea,
Spain,
Sri Lanka,
Switzerland,
Thailand,
United Arab Emirates,
United Kingdom,
United States,
Vietnam		 Academic,
Agriculture,
Automotive,
Aviation,
Biomedical,
Chemicals,
Consulting & Professional Services,
Consumer Goods,
Energy,
Entertainment,
Financial Management & Hedge Funds,
Financial Services,
Food and Beverage,
Government,
Healthcare,
Hospitality,
Industrials and Engineering,
Insurance,
Legal,
Logistics,
Manufacturing,
Media,
NGOs and Nonprofits,
Oil and Gas,
Opportunistic,
Pharmaceuticals,
Real Estate,
Retail,
State & Municipal Government,
Technology,
Telecommunications,
Transportation,
Travel,
Utilities		 https://falcon.crowdstrike.com/intelligence/actors/twisted-spider/

cs-indicators

Search known indicators based on the given parameters.

Base Command

cs-indicators

Input

Argument Name Description Required
query Search based on a query written in FQL (Falcon Query Language, See https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-fql for more information). Optional
type The indicator type. Optional
malicious_confidence Indicates a confidence level by which an indicator is considered to be malicious. Optional
offset Used to paginate the response. You can then use limit to set the number of results for the next page. Optional
last_updated The date the indicator was last updated.Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours). Optional
indicator The value for the given indicator type. Optional
sort Sort by field and direction. Optional
id The indicator’s ID, in the following format <type>_<indicator>. Optional
limit The maximum number of indicators to retrieve. The default is 10. Optional

Context Output

Path Type Description
File.MD5 String The MD5 hash of the file.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA1 hash of the file.
File.Malicious.Vendor String The vendor that reported the file as malicious.
File.Malicious.Description String A description explaining why the file was determined to be malicious.
File.Reports String For malicious files, the associated reports describing the hash
File.Actors String For malicious files, the associated actors
File.MalwareFamilies String For malicious files, the associated malware family
File.KillChains String For malicious files, the associated kill chain
URL.Data String The URL
URL.Malicious.Vendor String The vendor reporting the URL as malicious.
URL.Malicious.Description String A description of the malicious URL.
URL.Reports String For malicious URL, the associated reports describing the URL
URL.Actors String For malicious URL, the associated actors
URL.MalwareFamilies String For malicious URL, the associated malware family
URL.KillChains String For malicious URL, the associated kill chain
Domain.Name String The domain name, for example: “google.com”.
Domain.Malicious.Vendor String The vendor reporting the domain as malicious.
Domain.Malicious.Description String A description explaining why the domain was reported as malicious.
Domain.Reports String For malicious domain, the associated reports describing the domain
Domain.Actors String For malicious domain, the associated actors
Domain.MalwareFamilies String For malicious domain, the associated malware family
Domain.KillChains String For malicious domain, the associated kill chain
IP.Address String IP address
IP.Malicious.Vendor String The vendor reporting the IP address as malicious.
IP.Malicious.Description String A description explaining why the IP address was reported as malicious.
IP.Reports String For malicious IP, the associated reports describing the IP
IP.Actors String For malicious IP, the associated actors
IP.MalwareFamilies String For malicious IP, the associated malware family
IP.KillChains String For malicious IP, the associated kill chain
DBotScore.Indicator String The indicator we tested
DBotScore.Type String The type of the indicator
DBotScore.Vendor String Vendor used to calculate the score
DBotScore.Score Number The actual score
FalconIntel.Indicator.ID String The indicator ID.
FalconIntel.Indicator.Type String The indicator type.
FalconIntel.Indicator.Value String The indicator value.
FalconIntel.Indicator.LastUpdate Date The last time the indicator was updated.
FalconIntel.Indicator.PublishDate Date The time the indicator was published.
FalconIntel.Indicator.MaliciousConfidence String The confidence level by which an indicator is considered to be malicious
FalconIntel.Indicator.Reports String The report ID that the indicator is associated with
FalconIntel.Indicator.Actors String Actors that the indicator is associated
FalconIntel.Indicator.MalwareFamilies String A list of malware families that an indicator has been associated. An indicator may be associated with more than one malware family.
FalconIntel.Indicator.KillChains String The point in the kill chain at which an indicator is associated
FalconIntel.Indicator.DomainTypes String The domain type of domain indicators
FalconIntel.Indicator.IPAddressTypes String The address type of ip_address indicators
FalconIntel.Indicator.Relations.Indicator String Related Indicators
FalconIntel.Indicator.Type String The indicator type
FalconIntel.Indicator.Labels String Additional labels

Command Example

!cs-indicators limit=1 type=ip_address malicious_confidence=high

Context Example

{
    "DBotScore": {
        "Indicator": "8.8.8.8",
        "Score": 3,
        "Type": "ip",
        "Vendor": "FalconIntel"
    },
    "FalconIntel": {
        "Indicator": {
            "ID": "ip_address_id",
            "KillChains": [
                "C2"
            ],
            "Labels": [
                "CSD/CSA-191023",
                "CSD/CSA-191350",
                "CSD/CSA-181072",
                "CSD/CSWR-17018",
                "CSD/CSWR-20022",
                "CSD/CSWR-19024",
                "MaliciousConfidence/High",
                "KillChain/C2",
                "CSD/CSIT-16091",
                "ThreatType/Commodity"
            ],
            "MaliciousConfidence": "high",
            "MalwareFamilies": [
                "njRAT"
            ],
            "Reports": [
                "CSA-191023",
                "CSA-191350",
                "CSA-181072",
                "CSWR-17018",
                "CSWR-20022",
                "CSWR-19024",
                "CSIT-16091",
                "CSA-201008",
                "CSWR-20014"
            ],
            "Type": "ip_address",
            "Value": "8.8.8.8"
        }
    },
    "IP": {
        "Address": "8.8.8.8",
        "KillChains": [
            "C2"
        ],
        "Malicious": {
            "Description": "High confidence",
            "Vendor": "FalconIntel"
        },
        "MalwareFamilies": [
            "njRAT"
        ],
        "Reports": [
            "CSA-191023",
            "CSA-191350",
            "CSA-181072",
            "CSWR-17018",
            "CSWR-20022",
            "CSWR-19024",
            "CSIT-16091",
            "CSA-201008",
            "CSWR-20014"
        ]
    }
}

Human Readable Output

Falcon Intel Indicator search

ID Kill Chains Labels Malicious Confidence Malware Families Reports Type Value
ip_address_id C2 CSD/CSA-191023,
CSD/CSA-191350,
CSD/CSA-181072,
CSD/CSWR-17018,
CSD/CSWR-20022,
CSD/CSWR-19024,
MaliciousConfidence/High,
KillChain/C2,
CSD/CSIT-16091,
ThreatType/Commodity		 high njRAT CSA-191023,
CSA-191350,
CSA-181072,
CSWR-17018,
CSWR-20022,
CSWR-19024,
CSIT-16091,
CSA-201008,
CSWR-20014		 ip_address 8.8.8.8

cs-reports

The Falcon Intel Reports API allows to query CrowdStrike intelligence publications.

Base Command

cs-reports

Input

Argument Name Description Required
query Search based on a query written in FQL (Falcon Query Language, See https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-fql for more information). Optional
free_search Search across all fields in an Report object. Optional
name Search for keywords across report names (i.e. the report’s title). Optional
actors Search for a report related to a particular actors. Actors should be comma separated. - For example - actor1,actor2,… Optional
target_countries Search reports by targeted country/countries Optional
target_industries Search reports by targeted industry/industries Optional
motivations Search by motivation Optional
slug Search by report ‘slug’ or short descriptive name Optional
description Search the body of the report Optional
type The type of object to search for. Optional
sub_type The sub-type to search for. Optional
tags Tags associated with a report (managed internally by CS). Optional
created_date Constrain results to those created on a certain date. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours). Optional
max_last_modified_date Constrain results to those modified on or before a certain date. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours). Optional
offset Used to paginate the response. You can then use limit to set the number of results for the next page. Optional
limit The maximum number of reports to retrieve. The default is 10. Optional
sort Sort by field and direction. Optional
display_full_fields Whether to display the full fields result from CS API. Default is False Optional

Context Output

Path Type Description
FalconIntel.Report.ID String The report ID.
FalconIntel.Report.URL String The report URL.
FalconIntel.Report.Name String The report name.
FalconIntel.Report.Type String The report type.
FalconIntel.Report.SubType String The report sub type.
FalconIntel.Report.Slug String Slug name of the report
FalconIntel.Report.CreatedDate Date The date the report was created.
FalconIntel.Report.LastModifiedSate Date The date the report was last modified.
FalconIntel.Report.ShortDescription String The report short description.
FalconIntel.Report.Description String The report full description.
FalconIntel.Report.TargetIndustries String Targeted industries included in the report. Ex: aerospace
FalconIntel.Report.TargetCountries String Targeted countries included in the report. Ex: afghanistan
FalconIntel.Report.Motivations String Motivations included in the report. Ex: criminal
FalconIntel.Report.Tags String The report’s tags. Ex: intel_feed

Command Example

!cs-reports limit=1 created_date="2016-09-30T19:15:53.000Z"

Context Example

{
    "FalconIntel": {
        "Report": {
            "CreatedDate": "2016-09-30T19:15:53.000Z",
            "ID": 7448,
            "LastModifiedSate": "2020-07-24T10:15:02.000Z",
            "Name": "Snort Changelog",
            "ShortDescription": "Added one additional rule to detect Hancitor ...",
            "Description": "Added one additional rule to detect Hancitor malware traffic decsribed in CSIT-16107. ",
            "Slug": "slug_value",
            "SubType": "Snort/Suricata",
            "Type": "Feeds",
            "URL": "https://falcon.crowdstrike.com/intelligence/reports/snort-changelog-9-5-2016-6/"
        }
    }
}

Human Readable Output

Falcon Intel Report search

Created Date ID Last Modified Sate Name Short Description Slug Sub Type Type URL
2016-09-30T19:15:53.000Z 7448 2020-07-24T10:15:02.000Z Snort Changelog Added one additional rule to detect Hancitor malware traffic decsribed in CSIT-16107. snort-changelog-9-5-2016-6 Snort/Suricata Feeds https://falcon.crowdstrike.com/intelligence/reports/snort-changelog-9-5-2016-6/

Configuration parameters

  • server_url — Server URL (e.g., https://example.net) (required)
  • credentials — Client ID (required)
  • timeout — The amount of time (in seconds) that a request will wait for a client to establish a connection to a remote machine before a timeout occurs.
  • threshold — Indicator Threshold. Minimum malicious confidence from Falcon Intel to consider the indicator malicious.
  • integrationReliability — Source Reliability (required)
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)

Commands (7)

  • cs-actors

    Search known actors based on the given parameters.

  • cs-indicators

    Search known indicators based on the given parameters.

  • cs-reports

    Queries CrowdStrike intelligence publications.

  • domain

    Checks the domain reputation.

  • file

    Checks the file reputation.

  • ip

    Checks the IP reputation.

  • url

    Checks the URL reputation.

Source

CrowdStrikeFalconIntel_v2.py CrowdStrikeFalconIntel_v2_test.py CrowdStrikeFalconIntel_v2.yml CrowdStrikeFalconIntel_v2_description.md command_examples.txt
Download History Raw 
commonfields:
  id: CrowdStrike Falcon Intel v2
  version: -1
sectionorder:
- Connect
- Collect
name: CrowdStrike Falcon Intel v2
display: CrowdStrike Falcon Intel v2
category: Data Enrichment & Threat Intelligence
provider: CrowdStrike
description: CrowdStrike Threat intelligence service integration helps organizations defend themselves against adversary activity by investigating incidents, and accelerating alert triage and response.
configuration:
- defaultvalue: https://api.crowdstrike.com/
  display: Server URL (e.g., https://example.net)
  name: server_url
  required: true
  type: 0
  section: Connect
- display: Client ID
  displaypassword: Client Secret
  name: credentials
  required: true
  type: 9
  section: Connect
- display: The amount of time (in seconds) that a request will wait for a client to establish a connection to a remote machine before a timeout occurs.
  name: timeout
  defaultvalue: "10"
  type: 0
  section: Connect
  advanced: true
  required: false
- display: Indicator Threshold. Minimum malicious confidence from Falcon Intel to consider the indicator malicious.
  name: threshold
  defaultvalue: high
  type: 15
  options:
  - low
  - medium
  - high
  section: Collect
  advanced: true
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: B - Usually reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  section: Collect
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  section: Collect
  advanced: true
  required: false
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  section: Collect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
script:
  dockerimage: demisto/python3:3.12.13.10116658
  type: python
  subtype: python3
  script: '-'
  commands:
  - name: file
    arguments:
    - name: file
      required: true
      default: true
      description: A comma-separated list of file hashes (MD5/SHA1/SHA256) to check.
      isArray: true
    outputs:
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Malicious.Vendor
      description: The vendor that reported the file as malicious.
      type: String
    - contextPath: File.Malicious.Description
      description: A description explaining why the file was determined to be malicious.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: FalconIntel.Indicator.ID
      description: The ID of the indicator.
      type: String
    - contextPath: FalconIntel.Indicator.Type
      description: The type of the indicator.
      type: String
    - contextPath: FalconIntel.Indicator.Value
      description: The value of the indicator.
      type: String
    - contextPath: FalconIntel.Indicator.LastUpdate
      description: The last time the indicator was updated.
      type: Date
    - contextPath: FalconIntel.Indicator.PublishDate
      description: The time the indicator was published.
      type: Date
    - contextPath: FalconIntel.Indicator.MaliciousConfidence
      description: The confidence level by which an indicator is considered to be malicious.
      type: String
    - contextPath: FalconIntel.Indicator.Reports
      description: The report ID for which the indicator is associated.
      type: String
    - contextPath: FalconIntel.Indicator.Actors
      description: Actors for which the indicator is associated.
      type: String
    - contextPath: FalconIntel.Indicator.MalwareFamilies
      description: A list of malware families that an indicator has been associated. An indicator may be associated with more than one malware family.
      type: String
    - contextPath: FalconIntel.Indicator.KillChains
      description: The point in the kill chain at which an indicator is associated.
      type: String
    - contextPath: FalconIntel.Indicator.DomainTypes
      description: The domain type of domain indicators.
      type: String
    - contextPath: FalconIntel.Indicator.IPAddressTypes
      description: The address type of IP Address indicators.
      type: String
    - contextPath: FalconIntel.Indicator.Relations.Indicator
      description: Related indicators.
      type: String
    - contextPath: FalconIntel.Indicator.Type
      description: The type of the indicator.
      type: String
    - contextPath: FalconIntel.Indicator.Labels
      description: Additional labels.
      type: String
    description: Checks the file reputation.
  - name: url
    arguments:
    - name: url
      required: true
      default: true
      description: A comma-separated list of URLs to check.
      isArray: true
    outputs:
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: The vendor reporting the URL as malicious.
      type: String
    - contextPath: URL.Malicious.Description
      description: A description of the malicious URL.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: FalconIntel.Indicator.ID
      description: The ID of the indicator.
      type: String
    - contextPath: FalconIntel.Indicator.Type
      description: The type of the indicator.
      type: String
    - contextPath: FalconIntel.Indicator.Value
      description: The value of the indicator.
      type: String
    - contextPath: FalconIntel.Indicator.LastUpdate
      description: The last time the indicator was updated.
      type: Date
    - contextPath: FalconIntel.Indicator.PublishDate
      description: The time the indicator was published.
      type: Date
    - contextPath: FalconIntel.Indicator.MaliciousConfidence
      description: The confidence level by which an indicator is considered to be malicious.
      type: String
    - contextPath: FalconIntel.Indicator.Reports
      description: The report ID for which the indicator is associated.
      type: String
    - contextPath: FalconIntel.Indicator.Actors
      description: Actors for which the indicator is associated.
      type: String
    - contextPath: FalconIntel.Indicator.MalwareFamilies
      description: A list of malware families that an indicator has been associated. An indicator may be associated with more than one malware family.
      type: String
    - contextPath: FalconIntel.Indicator.KillChains
      description: The point in the kill chain at which an indicator is associated.
      type: String
    - contextPath: FalconIntel.Indicator.DomainTypes
      description: The domain type of domain indicators.
      type: String
    - contextPath: FalconIntel.Indicator.IPAddressTypes
      description: The address type of IP address indicators.
      type: String
    - contextPath: FalconIntel.Indicator.Relations.Indicator
      description: Related indicators.
      type: String
    - contextPath: FalconIntel.Indicator.Type
      description: The the type of indicator.
      type: String
    - contextPath: FalconIntel.Indicator.Labels
      description: Additional labels.
      type: String
    description: Checks the URL reputation.
  - name: domain
    arguments:
    - name: domain
      required: true
      default: true
      description: A comma-separated list of domains to check.
      isArray: true
    outputs:
    - contextPath: Domain.Name
      description: 'The domain name. For example, "google.com".'
      type: String
    - contextPath: Domain.Malicious.Vendor
      description: The vendor reporting the domain as malicious.
      type: String
    - contextPath: Domain.Malicious.Description
      description: A description explaining why the domain was reported as malicious.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: FalconIntel.Indicator.ID
      description: The ID of the indicator.
      type: String
    - contextPath: FalconIntel.Indicator.Type
      description: The type of the indicator.
      type: String
    - contextPath: FalconIntel.Indicator.Value
      description: The value of the indicator.
      type: String
    - contextPath: FalconIntel.Indicator.LastUpdate
      description: The last time the indicator was updated.
      type: Date
    - contextPath: FalconIntel.Indicator.PublishDate
      description: The time the indicator was published.
      type: Date
    - contextPath: FalconIntel.Indicator.MaliciousConfidence
      description: The confidence level by which an indicator is considered to be malicious.
      type: String
    - contextPath: FalconIntel.Indicator.Reports
      description: The report ID for which the indicator is associated.
      type: String
    - contextPath: FalconIntel.Indicator.Actors
      description: Actors for which the indicator is associated.
      type: String
    - contextPath: FalconIntel.Indicator.MalwareFamilies
      description: A list of malware families that an indicator has been associated. An indicator may be associated with more than one malware family.
      type: String
    - contextPath: FalconIntel.Indicator.KillChains
      description: The point in the kill chain at which an indicator is associated.
      type: String
    - contextPath: FalconIntel.Indicator.DomainTypes
      description: The domain type of domain indicators.
      type: String
    - contextPath: FalconIntel.Indicator.IPAddressTypes
      description: The address type of IP address indicators.
      type: String
    - contextPath: FalconIntel.Indicator.Relations.Indicator
      description: Related indicators.
      type: String
    - contextPath: FalconIntel.Indicator.Type
      description: The type of the indicator.
      type: String
    - contextPath: FalconIntel.Indicator.Labels
      description: Additional labels.
      type: String
    description: Checks the domain reputation.
  - name: ip
    arguments:
    - name: ip
      required: true
      default: true
      description: A comma-separated list of IP addresses to check.
      isArray: true
    outputs:
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: The vendor reporting the IP address as malicious.
      type: String
    - contextPath: IP.Malicious.Description
      description: A description explaining why the IP address was reported as malicious.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: FalconIntel.Indicator.ID
      description: The indicator ID.
      type: String
    - contextPath: FalconIntel.Indicator.Type
      description: The indicator type.
      type: String
    - contextPath: FalconIntel.Indicator.Value
      description: The value of the indicator.
      type: String
    - contextPath: FalconIntel.Indicator.LastUpdate
      description: The last time the indicator was updated.
      type: Date
    - contextPath: FalconIntel.Indicator.PublishDate
      description: The time the indicator was published.
      type: Date
    - contextPath: FalconIntel.Indicator.MaliciousConfidence
      description: The confidence level by which an indicator is considered to be malicious.
      type: String
    - contextPath: FalconIntel.Indicator.Reports
      description: The report ID for which the indicator is associated.
      type: String
    - contextPath: FalconIntel.Indicator.Actors
      description: Actors for which the indicator is associated.
      type: String
    - contextPath: FalconIntel.Indicator.MalwareFamilies
      description: A list of malware families that an indicator has been associated. An indicator may be associated with more than one malware family.
      type: String
    - contextPath: FalconIntel.Indicator.KillChains
      description: The point in the kill chain at which an indicator is associated.
      type: String
    - contextPath: FalconIntel.Indicator.DomainTypes
      description: The domain type of domain indicators.
      type: String
    - contextPath: FalconIntel.Indicator.IPAddressTypes
      description: The address type of IP address indicators.
      type: String
    - contextPath: FalconIntel.Indicator.Relations.Indicator
      description: Related indicators.
      type: String
    - contextPath: FalconIntel.Indicator.Type
      description: The type of indicator.
      type: String
    - contextPath: FalconIntel.Indicator.Labels
      description: Additional labels.
      type: String
    description: Checks the IP reputation.
  - name: cs-actors
    arguments:
    - name: query
      description: Search based on a query written in FQL (Falcon Query Language, See https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-fql for more information)..
    - name: free_search
      description: Search across all fields in an actor object.
    - name: name
      description: Search based on an actor's name.
    - name: description
      description: Search based on a description.
    - name: created_date
      description: 'Search from the created date. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours).'
    - name: max_last_modified_date
      description: 'Search up to the last modified date. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours).'
    - name: min_last_activity_date
      description: 'Search from the last activity date. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours).'
    - name: max_last_activity_date
      description: 'Search up to the last activity date. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours).'
    - name: origins
      description: Search by origins, separated by ",".
      isArray: true
    - name: target_countries
      description: Search by target countries, separated by ",".
      isArray: true
    - name: target_industries
      description: Search by target industries, separated by ",".
      isArray: true
    - name: motivations
      description: Search by motivations, separated by ",".
      isArray: true
    - name: offset
      description: The page of the results to retrieve. It is 0 based.
    - name: limit
      description: The maximum number of actors to retrieve. The default is 10.
      default: true
      defaultValue: '10'
    - name: sort
      description: Sort by field and direction. Select a pre-defined value and direction. For example, for ascending list of names, "name|asc", for descending list of names, "name|desc".
      auto: PREDEFINED
      predefined:
      - name|asc
      - name|desc
      - target_countries|asc
      - target_countries|desc
      - target_industries|asc
      - target_industries|desc
      - type|asc
      - type|desc
      - created_date|asc
      - created_date|desc
      - last_activity_date|asc
      - last_activity_date|desc
      - last_modified_date|asc
      - last_modified_date|desc
    - name: slug
      description: 'Search by ''slug'' or short descriptive name. For example, "anchor-panda".'
    - name: display_full_fields
      description: Whether to return and display full data from CS API. (For example full description, which by default is short).
      defaultValue: false
    outputs:
    - contextPath: FalconIntel.Actor.ImageURL
      description: The URL of the actor image.
      type: String
    - contextPath: FalconIntel.Actor.Name
      description: The name of the actor.
      type: String
    - contextPath: FalconIntel.Actor.ID
      description: The ID of the actor.
      type: String
    - contextPath: FalconIntel.Actor.URL
      description: The URL of the actor.
      type: String
    - contextPath: FalconIntel.Actor.Slug
      description: The slug name of the actor.
      type: String
    - contextPath: FalconIntel.Actor.ShortDescription
      description: The short description of the actor.
      type: String
    - contextPath: FalconIntel.Actor.Description
      description: The full description of the actor.
      type: String
    - contextPath: FalconIntel.Actor.FirstActivityDate
      description: The first activity date of the actor.
      type: Date
    - contextPath: FalconIntel.Actor.LastActivityDate
      description: The last activity date of the actor.
      type: Date
    - contextPath: FalconIntel.Actor.Active
      description: The active status of the actor.
      type: Boolean
    - contextPath: FalconIntel.Actor.KnowsAs
      description: Nicknames that the actor is known as.
      type: String
    - contextPath: FalconIntel.Actor.TargetIndustries
      description: A list of targeted industries associated with this actor.
      type: String
    - contextPath: FalconIntel.Actor.TargetCountries
      description: A list of targeted countries associated with this actor.
      type: String
    - contextPath: FalconIntel.Actor.Origins
      description: "The actor's country of origin. For example, Afghanistan."
      type: String
    - contextPath: FalconIntel.Actor.Motivations
      description: "The actor's motivations. For example, Criminal."
      type: String
    - contextPath: FalconIntel.Actor.Capability
      description: "The actor's capability. For example, Average."
      type: String
    - contextPath: FalconIntel.Actor.Group
      description: "The the group of the actor. For example, panda gang."
      type: String
    - contextPath: FalconIntel.Actor.Region
      description: "The region of the actor. For example, Eastern Europe."
      type: String
    - contextPath: FalconIntel.Actor.KillChains
      description: Kill chain fields.
      type: String
    description: Search known actors based on the given parameters.
  - name: cs-indicators
    arguments:
    - name: query
      description: Search based on a query written in FQL (Falcon Query Language, See https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-fql for more information)..
    - name: type
      description: The indicator type. Add a pre-defined value, such as email_address, hash_ion, password, etc.
      auto: PREDEFINED
      predefined:
      - binary_string
      - compile_time
      - device_name
      - domain
      - email_address
      - email_subject
      - event_name
      - file_mapping
      - file_name
      - file_path
      - hash_ion
      - hash_md5
      - hash_sha1
      - hash_sha256
      - ip_address
      - ip_address_block
      - mutex_name
      - password
      - persona_name
      - phone_number
      - port
      - registry
      - semaphore_name
      - service_name
      - url
      - user_agent
      - username
      - x509_seria
      - x509_subject
    - name: malicious_confidence
      auto: PREDEFINED
      predefined:
      - high
      - medium
      - low
      - unverified
      description: Indicates a confidence level by which an indicator is considered to be malicious. Can be "high", "medium", "low", or "unverified".
    - name: offset
      description: Used to paginate the response. You can then use limit to set the number of results for the next page.
    - name: last_updated_date
      description: 'The date the indicator was last updated. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours).'
    - name: indicator
      description: The value for the given indicator type.
    - name: sort
      description: Sort by field and direction. Select a pre-defined value and direction. For example, for ascending list of IDs, "id|asc", for descending list of IDs, "id|desc".
      auto: PREDEFINED
      predefined:
      - id|asc
      - id|desc
      - indicator|asc
      - indicator|desc
      - type|asc
      - type|desc
      - published_date|asc
      - published_date|desc
      - last_updated|asc
      - last_updated|desc
    - name: id
      description: "The indicator's ID, in the following format: <type>_<indicator>."
    - default: true
      defaultValue: '10'
      description: The maximum number of indicators to retrieve. The default is 10.
      name: limit
    outputs:
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.Malicious.Vendor
      description: The vendor that reported the file as malicious.
      type: String
    - contextPath: File.Malicious.Description
      description: A description explaining why the file was determined to be malicious.
      type: String
    - contextPath: File.Reports
      description: For malicious files, the associated reports describing the hash.
      type: String
    - contextPath: File.Actors
      description: For malicious files, the associated actors.
      type: String
    - contextPath: File.MalwareFamilies
      description: For malicious files, the associated malware family.
      type: String
    - contextPath: File.KillChains
      description: For malicious files, the associated kill chain.
      type: String
    - contextPath: URL.Data
      description: The URL.
      type: String
    - contextPath: URL.Malicious.Vendor
      description: The vendor reporting the URL as malicious.
      type: String
    - contextPath: URL.Malicious.Description
      description: A description of the malicious URL.
      type: String
    - contextPath: URL.Reports
      description: For malicious URL, the associated reports describing the URL.
      type: String
    - contextPath: URL.Actors
      description: For malicious URL, the associated actors.
      type: String
    - contextPath: URL.MalwareFamilies
      description: For malicious URL, the associated malware family.
      type: String
    - contextPath: URL.KillChains
      description: For malicious URL, the associated kill chain.
      type: String
    - contextPath: Domain.Name
      description: 'The domain name. For example, "google.com".'
      type: String
    - contextPath: Domain.Malicious.Vendor
      description: The vendor reporting the domain as malicious.
      type: String
    - contextPath: Domain.Malicious.Description
      description: A description explaining why the domain was reported as malicious.
      type: String
    - contextPath: Domain.Reports
      description: For a malicious domain, the associated reports describing the domain.
      type: String
    - contextPath: Domain.Actors
      description: For a malicious domain, the associated actors.
      type: String
    - contextPath: Domain.MalwareFamilies
      description: For a malicious domain, the associated malware family.
      type: String
    - contextPath: Domain.KillChains
      description: For a malicious domain, the associated kill chain.
      type: String
    - contextPath: IP.Address
      description: The IP address.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: The vendor reporting the IP address as malicious.
      type: String
    - contextPath: IP.Malicious.Description
      description: A description explaining why the IP address was reported as malicious.
      type: String
    - contextPath: IP.Reports
      description: For a malicious IP address, the associated reports describing the IP address.
      type: String
    - contextPath: IP.Actors
      description: For a malicious IP address, the associated actors.
      type: String
    - contextPath: IP.MalwareFamilies
      description: For a malicious IP address, the associated malware family.
      type: String
    - contextPath: IP.KillChains
      description: For a malicious IP address, the associated kill chain.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator tested.
      type: String
    - contextPath: DBotScore.Type
      description: The type of the indicator.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: FalconIntel.Indicator.ID
      description: The ID of the indicator.
      type: String
    - contextPath: FalconIntel.Indicator.Type
      description: The type of indicator.
      type: String
    - contextPath: FalconIntel.Indicator.Value
      description: The value of the indicator.
      type: String
    - contextPath: FalconIntel.Indicator.LastUpdate
      description: The last time the indicator was updated.
      type: Date
    - contextPath: FalconIntel.Indicator.PublishDate
      description: The time the indicator was published.
      type: Date
    - contextPath: FalconIntel.Indicator.MaliciousConfidence
      description: The confidence level by which an indicator is considered to be malicious.
      type: String
    - contextPath: FalconIntel.Indicator.Reports
      description: The report ID for which the indicator is associated.
      type: String
    - contextPath: FalconIntel.Indicator.Actors
      description: Actors for which the indicator is associated.
      type: String
    - contextPath: FalconIntel.Indicator.MalwareFamilies
      description: A list of malware families that an indicator has been associated. An indicator may be associated with more than one malware family.
      type: String
    - contextPath: FalconIntel.Indicator.KillChains
      description: The point in the kill chain at which an indicator is associated.
      type: String
    - contextPath: FalconIntel.Indicator.DomainTypes
      description: The domain type of domain indicators.
      type: String
    - contextPath: FalconIntel.Indicator.IPAddressTypes
      description: The address type of IP address indicators.
      type: String
    - contextPath: FalconIntel.Indicator.Relations.Indicator
      description: Related indicators.
      type: String
    - contextPath: FalconIntel.Indicator.Type
      description: The type of indicator.
      type: String
    - contextPath: FalconIntel.Indicator.Labels
      description: Additional labels.
      type: String
    description: Search known indicators based on the given parameters.
  - name: cs-reports
    arguments:
    - name: query
      description: Search based on a query written in FQL (Falcon Query Language, See https://falcon.crowdstrike.com/support/documentation/45/falcon-query-language-fql for more information).
    - name: free_search
      description: Search across all fields in a report object.
    - name: name
      description: Search for keywords across report names (for example, the report’s title).
    - name: actors
      description: Search for a report related to particular actors. Actors should be comma separated. For example, actor1,actor2, etc.
      isArray: true
    - name: target_countries
      description: Search reports by targeted country/countries.
      isArray: true
    - name: target_industries
      description: Search reports by targeted industry/industries.
      isArray: true
    - name: motivations
      description: Search by motivation.
      isArray: true
    - name: slug
      description: Search by report 'slug' or short descriptive name.
    - name: description
      description: Search the body of the report.
    - name: type
      auto: PREDEFINED
      predefined:
      - intelligence report
      - alert
      - periodic report
      - tipper
      description: The type of object for which to search. Can be "intelligence report", "alert", "periodic report", or "tipper".
    - name: sub_type
      auto: PREDEFINED
      predefined:
      - weekly
      - monthly
      - quarterly
      - annual
      description: The report sub-type to search. Can be "weekly", "monthly", "quarterly", or "annual".
    - name: tags
      description: Tags associated with a report (managed internally by CrowdStrike).
    - name: created_date
      description: 'Search for reports created on a certain date. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours).'
    - name: max_last_modified_date
      description: 'Search for reports modified on or before a certain date. Supported formats: ISO 8601 (for example, 2020-07-28T10:00:00Z) and time period (for example, 24 hours).'
    - name: offset
      description: Used to paginate the response. You can then use limit to set the number of results for the next page.
    - name: limit
      description: The maximum number of reports to retrieve. The default is 10.
      default: true
      defaultValue: '10'
    - name: sort
      description: Sort by field and direction. Select a pre-defined value and direction. For example, for ascending list of types, "type|asc", for descending list of types, "types|desc".
      auto: PREDEFINED
      predefined:
      - id|asc
      - id|desc
      - name|asc
      - name|desc
      - type|asc
      - type|desc
      - target_countries|asc
      - target_countries|desc
      - target_industries|asc
      - target_industries|desc
      - created_date|asc
      - created_date|desc
      - last_modified_date|asc
      - last_modified_date|desc
    - name: display_full_fields
      description: Whether to display the full fields result from CS API.
      defaultValue: false
    outputs:
    - contextPath: FalconIntel.Report.ID
      description: The ID of the report.
      type: String
    - contextPath: FalconIntel.Report.URL
      description: The URL of the report.
      type: String
    - contextPath: FalconIntel.Report.Name
      description: The name of the report.
      type: String
    - contextPath: FalconIntel.Report.Type
      description: The type of report.
      type: String
    - contextPath: FalconIntel.Report.SubType
      description: The sub type of the report.
      type: String
    - contextPath: FalconIntel.Report.Slug
      description: The slug name of the report.
      type: String
    - contextPath: FalconIntel.Report.CreatedDate
      description: The date the report was created.
      type: Date
    - contextPath: FalconIntel.Report.LastModifiedSate
      description: The date the report was last modified.
      type: Date
    - contextPath: FalconIntel.Report.ShortDescription
      description: The short description of the report.
      type: String
    - contextPath: FalconIntel.Report.Description
      description: The full description of the report.
      type: String
    - contextPath: FalconIntel.Report.TargetIndustries
      description: "Targeted industries included in the report. For example, aerospace."
      type: String
    - contextPath: FalconIntel.Report.TargetCountries
      description: "Targeted countries included in the report. For example, afghanistan."
      type: String
    - contextPath: FalconIntel.Report.Motivations
      description: "Motivations included in the report. For example, criminal."
      type: String
    - contextPath: FalconIntel.Report.Tags
      description: "The report's tags. For example, intel_feed."
      type: String
    description: Queries CrowdStrike intelligence publications.
tests:
- CrowdStrike Falcon Intel v2 - Test
fromversion: 5.0.0