CrowdStrike Falcon (v2.12.9)

The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment.

Author

Cortex XSOAR

Support

xsoar

URL

https://www.paloaltonetworks.com/cortex

Categories

Endpoint

Incident fields (61)

• Behaviour Objective
• Behaviour Scenario
• Behaviour Tactic
• CrowdStrike Falcon Actor slug
• CrowdStrike Falcon Alleged File Type
• CrowdStrike Falcon At Accounts
• CrowdStrike Falcon Behaviour Pattern Disposition Details
• CrowdStrike Falcon Bios Manufacturer
• CrowdStrike Falcon Bios Version
• CrowdStrike Falcon Crawled Timestamp
• CrowdStrike Falcon Data Domains
• CrowdStrike Falcon Detection Type
• CrowdStrike Falcon Enrichments
• CrowdStrike Falcon Firmware Build Fingerprint
• CrowdStrike Falcon Firmware Build Time
• CrowdStrike Falcon IOC CVES
• CrowdStrike Falcon IOC Domains
• CrowdStrike Falcon IOC Emails
• CrowdStrike Falcon IOC Hashtags
• CrowdStrike Falcon IOC Types
• CrowdStrike Falcon IOC Urls
• CrowdStrike Falcon Item Author ID
• CrowdStrike Falcon Item author
• CrowdStrike Falcon Item date
• CrowdStrike Falcon Item id
• CrowdStrike Falcon Item site
• CrowdStrike Falcon Item site ID
• CrowdStrike Falcon Item type
• CrowdStrike Falcon Lead Id
• CrowdStrike Falcon Lead Type
• CrowdStrike Falcon Macros CMD line
• CrowdStrike Falcon Macros Display Name
• CrowdStrike Falcon Macros IOC Description
• CrowdStrike Falcon Macros IOC Source
• CrowdStrike Falcon Macros IOC Type
• CrowdStrike Falcon Mitre Attack
• CrowdStrike Falcon Mobile Manufacturer
• CrowdStrike Falcon Mobile Product
• CrowdStrike Falcon Mobile platform version
• CrowdStrike Falcon Pattern ID
• CrowdStrike Falcon Platform Name
• CrowdStrike Falcon Product Type Description
• CrowdStrike Falcon Request Parameters
• CrowdStrike Falcon Resource Attributes
• CrowdStrike Falcon Response Elements
• CrowdStrike Falcon Role ID
• CrowdStrike Falcon Role creator UID
• CrowdStrike Falcon Role creator name
• CrowdStrike Falcon Role priority
• CrowdStrike Falcon Role topic
• CrowdStrike Falcon Scan Id
• CrowdStrike Falcon Scan Name
• CrowdStrike Falcon Security patch level
• CrowdStrike Falcon Service Type
• CrowdStrike Falcon System Manufacturer
• CrowdStrike Falcon System Product Name
• CrowdStrike Falcon User Agent
• CrowdStrike Falcon User Identity
• CrowdStrike Falcon Vertex ID
• CrowdStrike Falcon Vertex Type
• Grand Parent Process

Integrations (1)

• CrowdStrike Falcon

Layouts (1)

• CrowdStrike Falcon Layout

Playbooks (15)

• CrowdStrike Falcon - False Positive Incident Handling
• CrowdStrike Falcon - Get Detections by Case
• CrowdStrike Falcon - Get Detections by Incident
• CrowdStrike Falcon - Get Endpoint Forensics Data
• CrowdStrike Falcon - Retrieve File
• CrowdStrike Falcon - SIEM ingestion Get Incident Data
• CrowdStrike Falcon - Search Endpoints By Hash
• CrowdStrike Falcon - Search Endpoints By Indicators
• CrowdStrike Falcon - T1059 - Command and Scripting Interpreter
• CrowdStrike Falcon - True Positive Incident Handling
• CrowdStrike Falcon Malware - Incident Enrichment
• CrowdStrike Falcon Malware - Investigation and Response
• CrowdStrike Falcon Malware - Verify Containment Actions
• Crowdstrike Falcon - Isolate Endpoint
• Crowdstrike Falcon - Unisolate Endpoint

Scripts (12)

• ConvertEnrichmentsToTable
• ConvertRequestParametersToTable
• ConvertResourceAttributesToTable
• ConvertResponseElementsToTable
• ConvertUserIdentityToTable
• CsFalconLiftHostContainment
• ReadNetstatFile
• ReadProcessesFile
• TransformIndicatorToCSFalconIOC
• cspresentgrandparentprocess
• cspresentparentprocess
• cspresentpolicyactions

README