Crowdstrike Falcon Intel Feed
The CrowdStrike intelligence team tracks the activities of threat actor groups and advanced persistent threats (APTs) to understand as much as possible about their known aliases, targets, methods, and more. This integration retrieves indicators from the CrowdStrike Falcon Intel Feed.
- Category
- Data Enrichment & Threat Intelligence
- Pack
- FeedCrowdstrikeFalconIntel
Configuration parameters
- server_url — Cloud Base URL (e.g., https://api.crowdstrike.com)
- feed — Fetch indicators
- client_id — CrowdStrike API client ID
- feedReputation — Indicator Reputation
- feedReliability — Source Reliability (required)
- tlp_color — Traffic Light Protocol Color
- feedExpirationPolicy —
- feedExpirationInterval —
- feedIncremental — Incremental feed
- feedFetchInterval — Feed Fetch Interval
- limit — Number of top indicators to fetch from the feed.
- feedBypassExclusionList — Bypass exclusion list
- insecure — Trust any certificate (not secure)
- proxy — Use system proxy settings
- feedTags — Tags
- client_secret — CrowdStrike API client secret
- credentials_client — CrowdStrike API client ID
- target_industries — Filter by the threat actor's target industries.
- target_countries — Filter by threat actor's target countries.
- custom_filter — A custom filter by which to filter the indicators. If you pass the custom_filter argument it will override the custom_filter parameter from the integration instance configuration.
Commands (1)
- crowdstrike-falcon-intel-get-indicators — Gets indicators from CrowdStrike Falcon Intel Feed.