CrowdStrikeMalquery

Use the MalQuery Integration to query the contents of clean and malicious binary files, which forms part of Falcon's search engine.

Category

Authentication & Identity Management

Pack

CrowdStrikeMalquery

Configuration parameters

• base_url — Server URL (e.g. https://example.net) (required)
• client_id — Client ID
• client_secret — Client Secret
• credentials_client — Client ID
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• integrationReliability — Source Reliability
• feedExpirationPolicy —
• feedExpirationInterval —

Commands (9)

• cs-malquery-exact-search — Searches Falcon MalQuery for a combination of hex patterns and strings to identify malware samples based upon file content, which returns a request ID. Use the request ID in the cs-malquery-get-request command to retrieve results. You can filter results based on criteria such as file type, file size and first seen date.
• cs-malquery-file-download — Download a file indexed by MalQuery. Specify the file using its SHA256. Only one file is supported.
• cs-malquery-fuzzy-search — Searches Falcon MalQuery quickly. Uses partial matching, but with more potential for false positives. Search for a combination of hex patterns and strings to identify samples based upon file content.
• cs-malquery-get-ratelimit — Returns information about search and download quotas in your environment.
• cs-malquery-get-request — Checks the status and results of an asynchronous request, such as hunt or exact-search. Supports a single request ID.
• cs-malquery-hunt — Schedules a YARA rule-based search for execution, which returns a request ID. Use the request ID in the cs-malquery-get-request command to retrieve results. You can filter based on criteria such as file type, file size and first seen date.
• cs-malquery-sample-fetch — Fetches a zip archive file using the password, "infected" containing the samples. Use this after the cs-malquery-samples-multidownload request has finished processing.
• cs-malquery-samples-multidownload — Schedule samples for download, which returns a request ID. Use the request ID in the cs-malquery-get-request, to check the status of the operation. When the request status is “done”, use the cs-malquery-sample-fetch to download the results as a password-protected archive. The password to extract results from the archive: infected'
• file — Retrieves indexed files metadata by their hash.