FalconIntel Deprecated

Deprecated. Use CrowdStrike Falcon Intel v2 integration instead.

Data Enrichment & Threat Intelligence · CrowdStrike Falcon Intel

Configuration parameters

  • url — Server URL (e.g. https://192.168.0.1) (required)
  • id — API ID (required)
  • key — API Key (required)
  • threshold — Indicator Threshold. Minimum malicious confidence from Falcon Intel to consider the indicator malicious.(low, medium, high)
  • useproxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • version — Support indicator API V2

Commands (8)

  • cs-actors

    Search known actors based on the given parameters. Dates are formatted as YYYY-MM-DD. Max date is taken automatically looking at end-of-day time. Origins, targetCountries, targetIndustries and motivations can all receive multiple values separated by ",". Offset is 0 based. Sort is field_name.order, field_name.order where order is either asc or desc.

  • cs-indicators

    Search known indicators based on the given parameters

  • cs-report-pdf

    Retrieve the Falcon Intel Report PDF

  • cs-reports

    The Falcon Intel Reports API allows to query CrowdStrike intelligence publications.

  • domain

    Check the given URL reputation

  • file

    Check file reputation

  • ip

    Check IP reputation

  • url

    Check the given URL reputation