CrowdStrike Indicator Feed

Retrieves indicators from the CrowdStrike Falcon Intel Feed.

Data Enrichment & Threat Intelligence · Crowdstrike Falcon Intel Feed · Feed

Configuration parameters

  • feed — Fetch indicators
  • base_url — CrowdStrike Base URL (required)
  • credentials — CrowdStrike API Client ID (required)
  • timeout — The amount of time (in seconds) that a request will wait for a client to establish a connection to a remote machine before a timeout occurs.
  • type — Type
  • first_fetch — First fetch time (required)
  • max_indicator_to_fetch — Max. indicators per fetch
  • malicious_confidence — Malicious confidence
  • include_deleted — Include deleted indicators
  • filter — Filter
  • generic_phrase — Generic phrase match
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • tlp_color — Traffic Light Protocol Color
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • feedFetchInterval — Feed Fetch Interval
  • feedTags — Tags
  • create_relationships — Create relationships
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • feedBypassExclusionList — Bypass exclusion list
  • feedIncremental — Incremental Feed

Commands (2)

  • crowdstrike-indicators-list

    Gets indicators from the CrowdStrike Falcon Intel Feed.

  • crowdstrike-reset-fetch-indicators

    Resets the retrieving start time according to the `First Fetch Time` parameter, WARNING: This command will reset your fetch history.