TransformIndicatorToCSFalconIOC

Transform an indicator in Cortex into a CrowdStrike Falcon IOC. The output (found at the TransformIndicatorToCSFalconIOC.JsonOutput context path) is a JSON, which represents the indicators in CrowdStrike Falcon format. This JSON can be used as the input for the *cs-falcon-batch-upload-custom-ioc* command.

python · CrowdStrike Falcon

Details

IDTransformIndicatorToCSFalconIOC
Languagepython
From Version6.0.0
Docker Imagedemisto/python3:3.12.13.10116658

README

Transform an indicator in Cortex into a CrowdStrike Falcon IOC.
The output (found at the TransformIndicatorToCSFalconIOC.JsonOutput context path) is a JSON, which represents the indicators in CrowdStrike Falcon format.
This JSON can be used as the input for the cs-falcon-batch-upload-custom-ioc command. (Available from Cortex XSOAR 6.0.0).

Script Data

Name Description
Script Type python3
Tags  
Cortex XSOAR Version 6.0.0

Inputs

Argument Name Description
query The indicators query. Using GetIndicatorsByQuery automation.
Example: type:IP and lastSeen:>="2022-02-16T16:20:00 +0200".
action The action that will be taken if the indicator will be discovered in the organization.
limit The maximum number of indicators to fetch.
offset The results offset page. Only change when the number of the results exceed the limit.
host_groups List of host group IDs that the indicator applies to.
Can be retrieved by running the cs-falcon-list-host-groups command.
Either applied_globally or host_groups must be provided.
platforms The platforms that the indicator applies to.
applied_globally Whether the indicator is applied globally.
Either applied_globally or host_groups must be provided. Default set to True.

Outputs

Path Description Type
TransformIndicatorToCSFalconIOC Json output of the indicators. Should be the input for the *cs-falcon-batch-upload-custom-ioc*. String
TransformIndicatorToCSFalconIOC.Indicators.value The value of the Indicator. String
TransformIndicatorToCSFalconIOC.Indicators.expiration The date on which the indicator will become inactive. String
TransformIndicatorToCSFalconIOC.Indicators.description Descriptive label for the indicator. String
TransformIndicatorToCSFalconIOC.Indicators.tags List of tags of the indicator. Unknown
TransformIndicatorToCSFalconIOC.Indicators.source The source where this indicator originated. String
TransformIndicatorToCSFalconIOC.Indicators.id The ID of the indicator. String
TransformIndicatorToCSFalconIOC.Indicators.type Type of the indicator. Possible values are: md5, sha256, ipv4, ipv6 and domain. String
TransformIndicatorToCSFalconIOC.Indicators.severity The severity of the indicator. possible values are: Informational, Low, Medium, High and Critical. String
TransformIndicatorToCSFalconIOC.Indicators.action The action that will be taken if the indicator will be discovered in the organization. String
TransformIndicatorToCSFalconIOC.Indicators.applied_globally Whether the indicator is applied globally. Boolean
TransformIndicatorToCSFalconIOC.Indicators.platforms The platforms that the indicator applies to. Unknown
TransformIndicatorToCSFalconIOC.Indicators.host_groups List of host group IDs that the indicator applies to. Unknown

Script Examples

Example command

!TransformIndicatorToCSFalconIOC query="type:IP" action=no_action platforms=linux

Context Example

{
    "TransformIndicatorToCSFalconIOC": {
        "Indicators": [
            {
                "Severity": "Informational",
                "Tags": [
                    "test"
                ],
                "action": "no_action",
                "applied_globally": true,
                "expiration": "2022-02-16T13:02:26Z",
                "platforms": [
                    "linux"
                ],
                "source": "Cortex",
                "type": "ipv4",
                "value": "9.6.3.5"
            },
            {
                "Severity": "Informational",
                "action": "no_action",
                "applied_globally": true,
                "expiration": "2022-02-22T13:36:02.776329896Z",
                "platforms": [
                    "linux"
                ],
                "source": "Cortex",
                "type": "ipv4",
                "value": "4.6.8.7"
            },
            {
                "Severity": "Informational",
                "action": "no_action",
                "applied_globally": true,
                "expiration": "2022-02-22T13:41:02.960974457Z",
                "platforms": [
                    "linux"
                ],
                "source": "Cortex",
                "type": "ipv4",
                "value": "4.7.8.7"
            },
            {
                "Severity": "Informational",
                "action": "no_action",
                "applied_globally": true,
                "expiration": "2022-02-22T13:41:02.960919913Z",
                "platforms": [
                    "linux"
                ],
                "source": "Cortex",
                "type": "ipv4",
                "value": "9.1.4.8"
            },
            {
                "Severity": "Informational",
                "action": "no_action",
                "applied_globally": true,
                "expiration": "2022-02-22T13:36:02.776389915Z",
                "platforms": [
                    "linux"
                ],
                "source": "Cortex",
                "type": "ipv4",
                "value": "2.1.4.8"
            },
            {
                "Severity": "Informational",
                "action": "no_action",
                "applied_globally": true,
                "expiration": "2022-02-16T13:02:46Z",
                "platforms": [
                    "linux"
                ],
                "source": "Cortex",
                "type": "ipv4",
                "value": "4.5.8.9"
            }
        ],
        "JsonOutput": "[{\"expiration\": \"2022-02-16T13:02:26Z\", \"type\": \"ipv4\", \"Severity\": \"Informational\", \"Tags\": [\"test\"], \"value\": \"9.6.3.5\", \"action\": \"no_action\", \"source\": \"Cortex\", \"platforms\": [\"linux\"], \"applied_globally\": true}, {\"expiration\": \"2022-02-22T13:36:02.776329896Z\", \"type\": \"ipv4\", \"Severity\": \"Informational\", \"value\": \"4.6.8.7\", \"action\": \"no_action\", \"source\": \"Cortex\", \"platforms\": [\"linux\"], \"applied_globally\": true}, {\"expiration\": \"2022-02-22T13:41:02.960974457Z\", \"type\": \"ipv4\", \"Severity\": \"Informational\", \"value\": \"4.7.8.7\", \"action\": \"no_action\", \"source\": \"Cortex\", \"platforms\": [\"linux\"], \"applied_globally\": true}, {\"expiration\": \"2022-02-22T13:41:02.960919913Z\", \"type\": \"ipv4\", \"Severity\": \"Informational\", \"value\": \"9.1.4.8\", \"action\": \"no_action\", \"source\": \"Cortex\", \"platforms\": [\"linux\"], \"applied_globally\": true}, {\"expiration\": \"2022-02-22T13:36:02.776389915Z\", \"type\": \"ipv4\", \"Severity\": \"Informational\", \"value\": \"2.1.4.8\", \"action\": \"no_action\", \"source\": \"Cortex\", \"platforms\": [\"linux\"], \"applied_globally\": true}, {\"expiration\": \"2022-02-16T13:02:46Z\", \"type\": \"ipv4\", \"Severity\": \"Informational\", \"value\": \"4.5.8.9\", \"action\": \"no_action\", \"source\": \"Cortex\", \"platforms\": [\"linux\"], \"applied_globally\": true}]"
    }
}

Human Readable Output

TransformIndicatorToCSFalconIOC is done

value expiration Severity Tags type
9.6.3.5 2022-02-16T13:02:26Z Informational test ipv4
4.6.8.7 2022-02-22T13:36:02.776329896Z Informational   ipv4
4.7.8.7 2022-02-22T13:41:02.960974457Z Informational   ipv4
9.1.4.8 2022-02-22T13:41:02.960919913Z Informational   ipv4
2.1.4.8 2022-02-22T13:36:02.776389915Z Informational   ipv4
4.5.8.9 2022-02-16T13:02:46Z Informational   ipv4

Source

TransformIndicatorToCSFalconIOC.py TransformIndicatorToCSFalconIOC_test.py TransformIndicatorToCSFalconIOC.yml
Download History Raw 
import pytest
from TransformIndicatorToCSFalconIOC import *

CS_IOC_BY_VALUE = [
    {
        "expiration": "2022-02-10T17:02:59.193836+02:00",
        "type": "ipv4",
        "severity": "High",
        "value": "1.2.3.4",
        "action": "no_action",
        "platforms": ["mac"],
        "applied_globally": True,
        "source": "Cortex XSOAR",
    }
]

XSOAR_INDICATOR_BY_VALUE = [
    {"expiration": "2022-02-10T17:02:59.193836+02:00", "indicator_type": "IP", "score": 3, "value": "1.2.3.4"}
]

XSOAR_INDICATOR_IPV6 = [
    {
        "expiration": "2022-02-10T17:02:59.193836+02:00",
        "indicator_type": "IP",
        "score": 1,
        "value": "2000:db1:3333:4444:5555:6666:7777:8888",
    }
]

CS_INDICATOR_IPV6 = [
    {
        "expiration": "2022-02-10T17:02:59.193836+02:00",
        "type": "ipv6",
        "severity": "Informational",
        "value": "2000:db1:3333:4444:5555:6666:7777:8888",
        "action": "no_action",
        "platforms": ["mac"],
        "source": "Cortex XSOAR",
        "applied_globally": True,
    }
]

XSOAR_INDICATOR_FILE = [
    {
        "expiration": "2022-02-10T17:02:59.193836+02:00",
        "indicator_type": "File",
        "score": 1,
        "value": "098f6bcd4621d373cade4e832627b4f6",
    }
]

CS_IOC_FILE = [
    {
        "expiration": "2022-02-10T17:02:59.193836+02:00",
        "type": "md5",
        "severity": "Informational",
        "value": "098f6bcd4621d373cade4e832627b4f6",
        "action": "no_action",
        "platforms": ["mac"],
        "source": "Cortex XSOAR",
        "applied_globally": True,
    }
]

XSOAR_INDICATOR_FILE_SHA256 = [
    {
        "expiration": "2022-02-10T17:02:59.193836+02:00",
        "indicator_type": "File",
        "score": 1,
        "value": "e444c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    }
]

CS_IOC_FILE_SHA256 = [
    {
        "expiration": "2022-02-10T17:02:59.193836+02:00",
        "type": "sha256",
        "severity": "Informational",
        "value": "e444c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "action": "no_action",
        "platforms": ["mac"],
        "source": "Cortex XSOAR",
        "applied_globally": True,
    }
]

XSOAR_INDICATOR_DOMAIN = [
    {"expiration": "2022-02-10T17:02:59.193836+02:00", "indicator_type": "Domain", "score": 1, "value": "test.com"}
]

CS_INDICATOR_DOMAIN = [
    {
        "expiration": "2022-02-10T17:02:59.193836+02:00",
        "type": "domain",
        "severity": "Informational",
        "value": "test.com",
        "action": "no_action",
        "platforms": ["mac"],
        "source": "Cortex XSOAR",
        "applied_globally": True,
    }
]


@pytest.mark.parametrize(
    "args, xsoar_indicator, cs_ioc",
    [
        (
            {"query": "value=1.2.3.4", "action": "no_action", "platforms": "mac", "applied_globally": True},
            XSOAR_INDICATOR_BY_VALUE,
            CS_IOC_BY_VALUE,
        ),
        (
            {"query": "type:File", "action": "no_action", "platforms": "mac", "applied_globally": True},
            XSOAR_INDICATOR_FILE,
            CS_IOC_FILE,
        ),
        (
            {"query": "type:File", "action": "no_action", "platforms": "mac", "applied_globally": True},
            XSOAR_INDICATOR_FILE_SHA256,
            CS_IOC_FILE_SHA256,
        ),
        (
            {"query": "type:Domain", "action": "no_action", "platforms": "mac", "applied_globally": True},
            XSOAR_INDICATOR_DOMAIN,
            CS_INDICATOR_DOMAIN,
        ),
        (
            {
                "query": "value:2000:db1:3333:4444:5555:6666:7777:8888",
                "action": "no_action",
                "platforms": "mac",
                "applied_globally": True,
            },
            XSOAR_INDICATOR_IPV6,
            CS_INDICATOR_IPV6,
        ),
    ],
)
def test_get_indicators_by_query(mocker, args, xsoar_indicator, cs_ioc):
    mocker.patch("TransformIndicatorToCSFalconIOC.execute_command", return_value=xsoar_indicator)
    mocker.patch.object(demisto, "args", return_value=args)
    assert get_indicators_by_query() == cs_ioc


def test_get_indicators_by_query_no_indicators(mocker):
    mocker.patch("TransformIndicatorToCSFalconIOC.execute_command", return_value=[])
    mocker.patch.object(
        demisto,
        "args",
        return_value={"query": "value=1.2.3.4", "action": "no_action", "platforms": "mac", "applied_globally": True},
    )
    assert get_indicators_by_query() == []