CrowdStrike Falcon - Search Endpoints By Indicators
This playbooks searches for different indicators (IP,IPV6,File hashes,Domain) in the crowdstrike falcon console. The output will be all the endpoints found associated with provided indicators. Provided agent id as an input will be excluded from the returned list.
- Pack
- CrowdStrikeFalcon
- Tasks
- 21
Inputs
- FileSha256 — The SHA256 file hash to search for.
- HostId — The host ID which will be excluded from the results.
- SHA1 — The SHA1 file hash to search for.
- MD5 — The MD5 file hash to search for.
- IP — The IPV4 indicator to search for.
- Domain — The domain indicator to search for.
- IPV6 — The IPv6 indicator to search for.
Outputs
- Endpoint — Additional hosts that have the hash present.
- CrowdStrike.IOC.DeviceCount — The number of devices the IOC ran on.
- Endpoint.Hostname — The endpoint's hostname.
- CrowdStrike.IOC.Type — The type of the IOC.
- Endpoint.IPAddress — The endpoint's IP address.
- CrowdStrike.IOC.Value — The string representation of the indicator.
- Endpoint.OS — The endpoint operation system.
- Endpoint.Status — The endpoint status.
- Endpoint.IsIsolated — The endpoint isolation status.
- CrowdStrike.DeviceID — Device IDs an indicator ran on.
Commands used
- cs-falcon-device-count-ioc
- cs-falcon-device-ran-on
- endpoint