CrowdStrike Indicator Feed

category: Data Enrichment & Threat Intelligence
provider: CrowdStrike
commonfields:
  id: CrowdStrike Indicator Feed
  version: -1
configuration:
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  type: 8
  required: false
  section: Collect
- display: CrowdStrike Base URL
  name: base_url
  required: true
  type: 0
  defaultvalue: "https://api.crowdstrike.com/"
  section: Connect
- display: CrowdStrike API Client ID
  displaypassword: CrowdStrike API Client Secret
  additionalinfo: 'For non 6.1 - enter your CrowdStrike API Client Secret in the password field.'
  name: credentials
  type: 9
  required: true
  section: Connect
- display: The amount of time (in seconds) that a request will wait for a client to establish a connection to a remote machine before a timeout occurs.
  name: timeout
  defaultvalue: "10"
  type: 0
  required: false
  section: Connect
- additionalinfo: 'The indicator types to fetch. Out-of-the-box indicator types supported in XSOAR are: "Account", "Domain", "Email", "File MD5", "File SHA-256", "IP", "Registry Key", and "URL". The default is "ALL".'
  display: Type
  name: type
  options:
  - ALL
  - Account
  - Domain
  - Email
  - File MD5
  - File SHA-256
  - IP
  - Registry Key
  - URL
  type: 16
  required: false
  section: Collect
- display: First fetch time
  name: first_fetch
  required: true
  type: 0
  additionalinfo: "The time range to consider for the initial data fetch. Warning: This feed may fetch tens of thousands of indicators per day. Please consider this when configuring this parameter to further in the past, as it may overload the system with indicators."
  defaultvalue: '1 week'
  section: Collect
- display: Max. indicators per fetch
  defaultvalue: 5000
  name: max_indicator_to_fetch
  type: 0
  additionalinfo: Maximum number of indicators per fetch. Value should be between 1 - 10000. A large value may result in a timeout.
  required: false
  section: Collect
- additionalinfo: Malicious confidence level to filter by.
  display: Malicious confidence
  name: malicious_confidence
  options:
  - high
  - medium
  - low
  - unverified
  type: 16
  required: false
  section: Collect
- display: Include deleted indicators
  name: include_deleted
  type: 8
  required: false
  section: Collect
- additionalinfo: "Advanced: FQL query. For more information visit the CrowdStrike documentation."
  display: Filter
  name: filter
  type: 0
  required: false
  section: Collect
- display: Generic phrase match
  additionalinfo: Generic phrase match search across all indicator fields.
  name: generic_phrase
  type: 0
  required: false
  section: Collect
- additionalinfo: Indicators from this integration instance will be marked with this reputation.
  defaultvalue: Bad
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
  section: Collect
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: A - Completely reliable
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  section: Collect
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
  defaultvalue: GREEN
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
  section: Collect
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  type: 17
  required: false
  section: Collect
- defaultvalue: '20160'
  display: ''
  name: feedExpirationInterval
  type: 1
  required: false
  section: Collect
- defaultvalue: '240'
  display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
  section: Collect
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  required: false
  section: Collect
- defaultvalue: 'true'
  additionalinfo: Create relationships between indicators as part of Enrichment.
  display: Create relationships
  name: create_relationships
  type: 8
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  section: Collect
- additionalinfo: Incremental feeds pull only new or modified indicators that have been sent from the integration. As the determination if the indicator is new or modified happens on the 3rd-party vendor's side, and only indicators that are new or modified are sent to Cortex XSOAR, all indicators coming from these feeds are labeled new or modified.
  display: Incremental Feed
  name: feedIncremental
  defaultvalue: 'true'
  type: 8
  hidden: true
  required: false
  section: Collect
description: Retrieves indicators from the CrowdStrike Falcon Intel Feed.
display: CrowdStrike Indicator Feed
name: CrowdStrike Indicator Feed
script:
  commands:
  - arguments:
    - description: The maximum number of indicators to return. Default is 50.
      name: limit
    - description: The index of the first indicator to fetch.
      name: offset
    - description: The minimum timestamp to fetch indicators by.
      name: last_run
    description: Gets indicators from the CrowdStrike Falcon Intel Feed.
    name: crowdstrike-indicators-list
    outputs:
    - contextPath: CrowdStrikeFalconIntel.Indicators.id
      description: Indicator ID.
      type: String
    - contextPath: CrowdStrikeFalconIntel.Indicators.value
      description: Indicator value.
      type: String
    - contextPath: CrowdStrikeFalconIntel.Indicators.type
      description: Indicator type.
      type: String
    - contextPath: CrowdStrikeFalconIntel.Indicators.fields.reports
      description: Indicator reports.
      type: Unknown
    - contextPath: CrowdStrikeFalconIntel.Indicators.fields.actors
      description: Actors related to the indicator.
      type: Unknown
    - contextPath: CrowdStrikeFalconIntel.Indicators.fields.malwarefamily
      description: Indicator malware families.
      type: Unknown
    - contextPath: CrowdStrikeFalconIntel.Indicators.fields.stixkillchainphases
      description: Indicator kill chains.
      type: Unknown
    - contextPath: CrowdStrikeFalconIntel.Indicators.fields.maliciousconfidence
      description: Indicator malicious confidence.
      type: String
    - contextPath: CrowdStrikeFalconIntel.Indicators.fields.tags
      description: Indicator labels.
      type: Unknown
    - contextPath: CrowdStrikeFalconIntel.Indicators.fields.targets
      description: Targets of the indicator.
      type: Unknown
    - contextPath: CrowdStrikeFalconIntel.Indicators.fields.threattypes
      description: Indicator threat types.
      type: Unknown
    - contextPath: CrowdStrikeFalconIntel.Indicators.fields.vulnerabilities
      description: Indicator vulnerabilities.
      type: Unknown
    - contextPath: CrowdStrikeFalconIntel.Indicators.fields.ipaddress
      description: Indicator related IP address.
      type: Unknown
    - contextPath: CrowdStrikeFalconIntel.Indicators.fields.domainname
      description: Indicator related domains.
      type: Unknown
    - contextPath: CrowdStrikeFalconIntel.Indicators.fields.updateddate
      description: Indicator update date.
      type: Date
    - contextPath: CrowdStrikeFalconIntel.Indicators.fields.creationdate
      description: Indicator creation date.
      type: Unknown
    - contextPath: CrowdStrikeFalconIntel.Indicators.rawJSON
      description: Raw response.
      type: Unknown
  - description: 'Resets the retrieving start time according to the `First Fetch Time` parameter, WARNING: This command will reset your fetch history.'
    name: crowdstrike-reset-fetch-indicators
  dockerimage: demisto/python3:3.12.13.10116658
  feed: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Fetch Indicators Test
fromversion: 5.5.0
sectionorder:
- Connect
- Collect