TransformIndicatorToCSFalconIOC
Transform an indicator in Cortex into a CrowdStrike Falcon IOC. The output (found at the TransformIndicatorToCSFalconIOC.JsonOutput context path) is a JSON, which represents the indicators in CrowdStrike Falcon format. This JSON can be used as the input for the *cs-falcon-batch-upload-custom-ioc* command.
python · CrowdStrike Falcon
Details
| ID | TransformIndicatorToCSFalconIOC |
|---|---|
| Language | python |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
README
Transform an indicator in Cortex into a CrowdStrike Falcon IOC.
The output (found at the TransformIndicatorToCSFalconIOC.JsonOutput context path) is a JSON, which represents the indicators in CrowdStrike Falcon format.
This JSON can be used as the input for the cs-falcon-batch-upload-custom-ioc command. (Available from Cortex XSOAR 6.0.0).
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | |
| Cortex XSOAR Version | 6.0.0 |
Inputs
| Argument Name | Description |
|---|---|
| query | The indicators query. Using GetIndicatorsByQuery automation. Example: type:IP and lastSeen:>="2022-02-16T16:20:00 +0200". |
| action | The action that will be taken if the indicator will be discovered in the organization. |
| limit | The maximum number of indicators to fetch. |
| offset | The results offset page. Only change when the number of the results exceed the limit. |
| host_groups | List of host group IDs that the indicator applies to. Can be retrieved by running the cs-falcon-list-host-groups command. Either applied_globally or host_groups must be provided. |
| platforms | The platforms that the indicator applies to. |
| applied_globally | Whether the indicator is applied globally. Either applied_globally or host_groups must be provided. Default set to True. |
Outputs
| Path | Description | Type |
|---|---|---|
| TransformIndicatorToCSFalconIOC | Json output of the indicators. Should be the input for the *cs-falcon-batch-upload-custom-ioc*. | String |
| TransformIndicatorToCSFalconIOC.Indicators.value | The value of the Indicator. | String |
| TransformIndicatorToCSFalconIOC.Indicators.expiration | The date on which the indicator will become inactive. | String |
| TransformIndicatorToCSFalconIOC.Indicators.description | Descriptive label for the indicator. | String |
| TransformIndicatorToCSFalconIOC.Indicators.tags | List of tags of the indicator. | Unknown |
| TransformIndicatorToCSFalconIOC.Indicators.source | The source where this indicator originated. | String |
| TransformIndicatorToCSFalconIOC.Indicators.id | The ID of the indicator. | String |
| TransformIndicatorToCSFalconIOC.Indicators.type | Type of the indicator. Possible values are: md5, sha256, ipv4, ipv6 and domain. | String |
| TransformIndicatorToCSFalconIOC.Indicators.severity | The severity of the indicator. possible values are: Informational, Low, Medium, High and Critical. | String |
| TransformIndicatorToCSFalconIOC.Indicators.action | The action that will be taken if the indicator will be discovered in the organization. | String |
| TransformIndicatorToCSFalconIOC.Indicators.applied_globally | Whether the indicator is applied globally. | Boolean |
| TransformIndicatorToCSFalconIOC.Indicators.platforms | The platforms that the indicator applies to. | Unknown |
| TransformIndicatorToCSFalconIOC.Indicators.host_groups | List of host group IDs that the indicator applies to. | Unknown |
Script Examples
Example command
!TransformIndicatorToCSFalconIOC query="type:IP" action=no_action platforms=linux
Context Example
{
"TransformIndicatorToCSFalconIOC": {
"Indicators": [
{
"Severity": "Informational",
"Tags": [
"test"
],
"action": "no_action",
"applied_globally": true,
"expiration": "2022-02-16T13:02:26Z",
"platforms": [
"linux"
],
"source": "Cortex",
"type": "ipv4",
"value": "9.6.3.5"
},
{
"Severity": "Informational",
"action": "no_action",
"applied_globally": true,
"expiration": "2022-02-22T13:36:02.776329896Z",
"platforms": [
"linux"
],
"source": "Cortex",
"type": "ipv4",
"value": "4.6.8.7"
},
{
"Severity": "Informational",
"action": "no_action",
"applied_globally": true,
"expiration": "2022-02-22T13:41:02.960974457Z",
"platforms": [
"linux"
],
"source": "Cortex",
"type": "ipv4",
"value": "4.7.8.7"
},
{
"Severity": "Informational",
"action": "no_action",
"applied_globally": true,
"expiration": "2022-02-22T13:41:02.960919913Z",
"platforms": [
"linux"
],
"source": "Cortex",
"type": "ipv4",
"value": "9.1.4.8"
},
{
"Severity": "Informational",
"action": "no_action",
"applied_globally": true,
"expiration": "2022-02-22T13:36:02.776389915Z",
"platforms": [
"linux"
],
"source": "Cortex",
"type": "ipv4",
"value": "2.1.4.8"
},
{
"Severity": "Informational",
"action": "no_action",
"applied_globally": true,
"expiration": "2022-02-16T13:02:46Z",
"platforms": [
"linux"
],
"source": "Cortex",
"type": "ipv4",
"value": "4.5.8.9"
}
],
"JsonOutput": "[{\"expiration\": \"2022-02-16T13:02:26Z\", \"type\": \"ipv4\", \"Severity\": \"Informational\", \"Tags\": [\"test\"], \"value\": \"9.6.3.5\", \"action\": \"no_action\", \"source\": \"Cortex\", \"platforms\": [\"linux\"], \"applied_globally\": true}, {\"expiration\": \"2022-02-22T13:36:02.776329896Z\", \"type\": \"ipv4\", \"Severity\": \"Informational\", \"value\": \"4.6.8.7\", \"action\": \"no_action\", \"source\": \"Cortex\", \"platforms\": [\"linux\"], \"applied_globally\": true}, {\"expiration\": \"2022-02-22T13:41:02.960974457Z\", \"type\": \"ipv4\", \"Severity\": \"Informational\", \"value\": \"4.7.8.7\", \"action\": \"no_action\", \"source\": \"Cortex\", \"platforms\": [\"linux\"], \"applied_globally\": true}, {\"expiration\": \"2022-02-22T13:41:02.960919913Z\", \"type\": \"ipv4\", \"Severity\": \"Informational\", \"value\": \"9.1.4.8\", \"action\": \"no_action\", \"source\": \"Cortex\", \"platforms\": [\"linux\"], \"applied_globally\": true}, {\"expiration\": \"2022-02-22T13:36:02.776389915Z\", \"type\": \"ipv4\", \"Severity\": \"Informational\", \"value\": \"2.1.4.8\", \"action\": \"no_action\", \"source\": \"Cortex\", \"platforms\": [\"linux\"], \"applied_globally\": true}, {\"expiration\": \"2022-02-16T13:02:46Z\", \"type\": \"ipv4\", \"Severity\": \"Informational\", \"value\": \"4.5.8.9\", \"action\": \"no_action\", \"source\": \"Cortex\", \"platforms\": [\"linux\"], \"applied_globally\": true}]"
}
}
Human Readable Output
TransformIndicatorToCSFalconIOC is done
value expiration Severity Tags type 9.6.3.5 2022-02-16T13:02:26Z Informational test ipv4 4.6.8.7 2022-02-22T13:36:02.776329896Z Informational ipv4 4.7.8.7 2022-02-22T13:41:02.960974457Z Informational ipv4 9.1.4.8 2022-02-22T13:41:02.960919913Z Informational ipv4 2.1.4.8 2022-02-22T13:36:02.776389915Z Informational ipv4 4.5.8.9 2022-02-16T13:02:46Z Informational ipv4
args: - description: 'The indicators query. Using `GetIndicatorsByQuery` automation. <br/>Example: `type:IP and lastSeen:>="2022-02-16T16:20:00 +0200"`.' name: query required: true - auto: PREDEFINED description: The action that will be taken if the indicator will be discovered in the organization. name: action predefined: - no_action - allow - detect - prevent_no_ui - prevent required: true - defaultValue: '10000' description: The maximum number of indicators to fetch. name: limit - defaultValue: '0' description: The results offset page. Only change when the number of the results exceed the limit. name: offset - description: "List of host group IDs that the indicator applies to. \nCan be retrieved by running the cs-falcon-list-host-groups command.\nEither applied_globally or host_groups must be provided." isArray: true name: host_groups - auto: PREDEFINED description: The platforms that the indicator applies to. isArray: true name: platforms predefined: - mac - windows - linux required: true - auto: PREDEFINED defaultValue: 'true' description: "Whether the indicator is applied globally. \nEither applied_globally or host_groups must be provided. Default set to True." name: applied_globally predefined: - 'true' - 'false' comment: Transform an indicator in Cortex into a CrowdStrike Falcon IOC. The output (found at the TransformIndicatorToCSFalconIOC.JsonOutput context path) is a JSON, which represents the indicators in CrowdStrike Falcon format. This JSON can be used as the input for the *cs-falcon-batch-upload-custom-ioc* command. commonfields: id: TransformIndicatorToCSFalconIOC version: -1 name: TransformIndicatorToCSFalconIOC outputs: - contextPath: TransformIndicatorToCSFalconIOC description: Json output of the indicators. Should be the input for the *cs-falcon-batch-upload-custom-ioc*. type: String - contextPath: TransformIndicatorToCSFalconIOC.Indicators.value description: The value of the Indicator. type: String - contextPath: TransformIndicatorToCSFalconIOC.Indicators.expiration description: The date on which the indicator will become inactive. type: String - contextPath: TransformIndicatorToCSFalconIOC.Indicators.description description: Descriptive label for the indicator. type: String - contextPath: TransformIndicatorToCSFalconIOC.Indicators.tags description: List of tags of the indicator. type: Unknown - contextPath: TransformIndicatorToCSFalconIOC.Indicators.source description: The source where this indicator originated. type: String - contextPath: TransformIndicatorToCSFalconIOC.Indicators.id description: The ID of the indicator. type: String - contextPath: TransformIndicatorToCSFalconIOC.Indicators.type description: 'Type of the indicator. Possible values are: md5, sha256, ipv4, ipv6 and domain.' type: String - contextPath: TransformIndicatorToCSFalconIOC.Indicators.severity description: 'The severity of the indicator. possible values are: Informational, Low, Medium, High and Critical.' type: String - contextPath: TransformIndicatorToCSFalconIOC.Indicators.action description: The action that will be taken if the indicator will be discovered in the organization. type: String - contextPath: TransformIndicatorToCSFalconIOC.Indicators.applied_globally description: Whether the indicator is applied globally. type: Boolean - contextPath: TransformIndicatorToCSFalconIOC.Indicators.platforms description: The platforms that the indicator applies to. type: Unknown - contextPath: TransformIndicatorToCSFalconIOC.Indicators.host_groups description: List of host group IDs that the indicator applies to. type: Unknown script: '-' subtype: python3 timeout: '0' type: python dockerimage: demisto/python3:3.12.13.10116658 tests: - No tests (auto formatted) fromversion: 6.0.0 supportedModules: - agentix - xsiam - edr - cloud - cloud_runtime_security