category: Endpoint
provider: CrowdStrike
sectionorder:
- Connect
- Collect
commonfields:
  id: CrowdstrikeFalcon
  version: -1
configuration:
- defaultvalue: 'false'
  display: Use legacy API
  name: legacy_version
  type: 8
  section: Connect
  advanced: true
  hidden: true
  additionalinfo: "Use the legacy version of the API, which refers to versions prior to the 'Next Generation Raptor release.'"
- display: Server URL (e.g., https://api.crowdstrike.com)
  name: url
  type: 0
  section: Connect
  required: true
  defaultvalue: https://api.crowdstrike.com
- display: Client ID
  name: credentials
  type: 9
  section: Connect
  required: false
  displaypassword: Secret
- display: Client ID
  name: client_id
  type: 0
  hidden: true
  section: Connect
  required: false
- display: Secret
  name: secret
  type: 4
  section: Connect
  required: false
  hidden: true
- display: Source Reliability
  name: Reliability
  type: 15
  defaultvalue: 'A+ - 3rd party enrichment'
  section: Collect
  required: false
  additionalinfo: Reliability of the source providing the intelligence data. Currently used for “CVE” reputation  command.
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  advanced: true
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  defaultvalue: 'false'
  hidden:
  - marketplacev2
  supportedModules:
  - "xsiam"
  - "agentix"
- display: 'Incident Fetch types'
  defaultvalue: 'Endpoint Detection'
  name: fetch_incidents_or_detections
  type: 16
  section: Collect
  required: false
  additionalinfo: |-
    Choose what incident types to fetch - You can choose any combination. Note:
    Records from the detection endpoint of the CrowdStrike Falcon UI could be of types: 'Endpoint Detection' and 'OFP Detection'.
  options:
  - IDP Detection
  - Endpoint Detection
  - Indicator of Misconfiguration
  - Indicator of Attack
  - Mobile Detection
  - On-Demand Scans Detection
  - OFP Detection
  - Third Party Detection
  - NGSIEM Detection
  - NGSIEM Automated Lead
  - NGSIEM Case
  - NGSIEM Incident (XDR Alert)
  - Recon notifications
  hidden:
  - marketplacev2
  supportedModules:
  - "xsiam"
  - "agentix"
- display: Incident type
  name: incidentType
  type: 13
  section: Connect
  required: false
  hidden:
  - marketplacev2
  supportedModules:
  - "xsiam"
  - "agentix"
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetch_time
  type: 0
  defaultvalue: '3 days'
  section: Collect
  required: false
  additionalinfo: Supported in Cortex XSOAR and Cortex Platform.
  hidden:
  - marketplacev2
  supportedModules:
  - "xsiam"
  - "agentix"
- display: Max incidents per fetch
  name: incidents_per_fetch
  type: 0
  section: Collect
  advanced: true
  required: false
  defaultvalue: '15'
  additionalinfo: Supported in Cortex XSOAR and Cortex Platform. Input a value between 1-500. Default is 15.
  hidden:
  - marketplacev2
  supportedModules:
  - "xsiam"
  - "agentix"
- display: 'Incidents Fetch Interval'
  defaultvalue: '1'
  name: incidentFetchInterval
  additionalinfo: Supported in Cortex XSOAR and Cortex Platform.
  type: 19
  section: Collect
  advanced: true
  required: false
  hidden:
  - marketplacev2
  supportedModules:
  - "xsiam"
  - "agentix"
- display: 'Advanced: Time in minutes to look back when fetching incidents and detections'
  additionalinfo: Use this parameter to determine the look-back period for searching for incidents that were created before the last run time and did not match the query when they were created.
  defaultvalue: 2
  name: look_back
  type: 0
  section: Collect
  advanced: true
  required: false
  hidden:
  - marketplacev2
  supportedModules:
  - "xsiam"
  - "agentix"
- display: Endpoint Detections filter query
  name: fetch_query
  type: 0
  section: Collect
  advanced: true
  required: false
  additionalinfo: 'Use the Falcon Query Language to refine the data collected. For more information, refer to the FQL syntax documentation: https://www.falconpy.io/Usage/Falcon-Query-Language.html'
- display: IDP Detections filter query
  name: idp_detections_fetch_query
  type: 0
  section: Collect
  required: false
  advanced: true
  additionalinfo: 'Use Falcon Query Language (FQL) to filter results. For more information, see the [FQL Syntax Documentation](https://www.falconpy.io/Usage/Falcon-Query-Language.html).'
- display: Mobile Detections filter query
  name: mobile_detections_fetch_query
  type: 0
  section: Collect
  required: false
  advanced: true
  additionalinfo: 'Use Falcon Query Language (FQL) to filter results. For more information, see the [FQL Syntax Documentation](https://www.falconpy.io/Usage/Falcon-Query-Language.html).'
- display: IOM filter query
  name: iom_fetch_query
  type: 0
  section: Collect
  required: false
  advanced: true
  additionalinfo: 'Use Falcon Query Language (FQL) to filter results. For more information, see the [FQL Syntax Documentation](https://www.falconpy.io/Usage/Falcon-Query-Language.html).'
  hidden:
  - marketplacev2
  supportedModules:
  - "xsiam"
  - "agentix"
- display: IOA filter query
  name: ioa_fetch_query
  type: 0
  section: Collect
  required: false
  advanced: true
  additionalinfo: "The Indicator of Attack (IOA) fetch query. This is an FQL filter that is combined with the time-range filter using AND. For example: cloud_provider:'aws'. For more information, see the Falcon Query Language (FQL) documentation at: https://www.falconpy.io/Usage/Falcon-Query-Language.html."
  hidden:
  - marketplacev2
  supportedModules:
  - "xsiam"
  - "agentix"
- display: Detections from On-Demand Scans filter query
  name: on_demand_fetch_query
  type: 0
  section: Collect
  required: false
  advanced: true
  additionalinfo: 'Use Falcon Query Language (FQL) to filter results. For more information, see the [FQL Syntax Documentation](https://www.falconpy.io/Usage/Falcon-Query-Language.html).'
- display: OFP Detections filter query
  name: ofp_detection_fetch_query
  type: 0
  section: Collect
  required: false
  advanced: true
  additionalinfo: 'Use Falcon Query Language (FQL) to filter results. For more information, see the [FQL Syntax Documentation](https://www.falconpy.io/Usage/Falcon-Query-Language.html).'
- display: Third Party Detection fetch query
  name: third_party_detection_fetch_query
  type: 0
  section: Collect
  required: false
  advanced: true
  additionalinfo: 'Use Falcon Query Language (FQL) to filter results. For more information, see the [FQL Syntax Documentation](https://www.falconpy.io/Usage/Falcon-Query-Language.html).'
- display: NGSIEM Detection fetch query
  name: ngsiem_detection_fetch_query
  type: 0
  section: Collect
  required: false
  advanced: true
  additionalinfo: 'Use Falcon Query Language (FQL) to filter results. For more information, see the [FQL Syntax Documentation](https://www.falconpy.io/Usage/Falcon-Query-Language.html).'
- display: NGSIEM automated leads fetch query
  name: automated_leads_fetch_query
  type: 0
  section: Collect
  required: false
  advanced: true
  additionalinfo: 'Use Falcon Query Language (FQL) to filter results. For more information, see the [FQL Syntax Documentation](https://www.falconpy.io/Usage/Falcon-Query-Language.html).'
- display: NGSIEM cases fetch query
  name: ngsiem_cases_fetch_query
  type: 0
  section: Collect
  required: false
  advanced: true
  additionalinfo: 'Use Falcon Query Language (FQL) to filter results. For more information, see the [FQL Syntax Documentation](https://www.falconpy.io/Usage/Falcon-Query-Language.html).'
- display: NGSIEM incidents fetch query
  name: ngsiem_incidents_fetch_query
  type: 0
  section: Collect
  required: false
  advanced: true
  additionalinfo: 'Use Falcon Query Language (FQL) to filter results. For more information, see the [FQL Syntax Documentation](https://www.falconpy.io/Usage/Falcon-Query-Language.html).'
- display: Recon filter query
  name: recon_fetch_query
  type: 0
  section: Collect
  required: false
  advanced: true
  additionalinfo: 'Use Falcon Query Language (FQL) to filter results. For more information, see the [FQL Syntax Documentation](https://www.falconpy.io/Usage/Falcon-Query-Language.html).'
- display: 'Mirroring Direction'
  name: mirror_direction
  type: 15
  section: Collect
  required: false
  additionalinfo: 'Choose the direction to mirror the detection: Incoming (from CrowdStrike Falcon to Cortex XSOAR), Outgoing (from Cortex XSOAR to CrowdStrike Falcon), or Incoming and Outgoing (to/from CrowdStrike Falcon and Cortex XSOAR).'
  defaultvalue: None
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  hidden:
  - marketplacev2
  - platform
- display: 'Close Mirrored XSOAR Incident'
  defaultvalue: 'false'
  name: close_incident
  type: 8
  section: Collect
  advanced: true
  required: false
  additionalinfo: When selected, closing the CrowdStrike Falcon incident is mirrored in Cortex XSOAR.
  hidden:
  - marketplacev2
  - platform
- display: 'Close Mirrored CrowdStrike Falcon Incident or Detection'
  defaultvalue: 'false'
  name: close_in_cs_falcon
  type: 8
  section: Collect
  advanced: true
  required: false
  additionalinfo: When selected, closing the Cortex XSOAR incident is mirrored in CrowdStrike Falcon, according to the types that were chosen to be fetched and mirrored.
  hidden:
  - marketplacev2
  - platform
- display: 'Reopen Statuses'
  additionalinfo: CrowdStrike Falcon statuses that will reopen an incident in Cortex XSOAR if closed. You can choose any combination.
  defaultvalue: 'New,In progress,True positive,False positive,Reopened,Ignored'
  name: reopen_statuses
  type: 16
  section: Collect
  advanced: true
  required: false
  options:
  - New
  - In progress
  - True positive
  - False positive
  - Reopened
  - Ignored
  hidden:
  - marketplacev2
  - platform
- display: Fetch events
  name: isFetchEvents
  type: 8
  section: Collect
  required: false
  defaultvalue: 'false'
  hidden:
  - xsoar
  supportedModules:
  - "xsiam"
- display: 'Event Fetch types'
  defaultvalue: 'IDP Detection,Endpoint Detection,Mobile Detection,On-Demand Scans Detection,OFP Detection'
  name: fetch_events_or_detections
  type: 16
  section: Collect
  required: false
  additionalinfo: |-
    Choose what event types to fetch - You can choose any combination. Note: Records from the detection endpoint of the CrowdStrike Falcon UI could be of types: 'Endpoint Detection' and 'OFP Detection'.
  options:
  - IDP Detection
  - Endpoint Detection
  - Mobile Detection
  - On-Demand Scans Detection
  - OFP Detection
  hidden:
  - xsoar
  - xpanse
  supportedModules:
  - "xsiam"
  - "edr"
  - "cloud"
  - "cloud_runtime_security"
- display: 'Events Fetch Interval'
  defaultvalue: '1'
  name: eventFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
  hidden:
  - xsoar
  - xpanse
  supportedModules:
  - "xsiam"
- display: 'Advanced: Time in minutes to look back when fetching events and detections'
  additionalinfo: Use this parameter to determine the look-back period for searching for events that were created before the last run time and did not match the query when they were created.
  defaultvalue: 2
  name: look_back_xsiam
  type: 0
  section: Collect
  advanced: true
  required: false
  hidden:
  - xsoar
  - xpanse
  supportedModules:
  - "xsiam"
  - "edr"
  - "cloud"
  - "cloud_runtime_security"
- display: Fetch assets and vulnerabilities
  name: isFetchAssets
  type: 8
  section: Collect
  required: false
  defaultvalue: 'false'
  hidden:
  - xsoar
  - xpanse
  supportedModules:
  - "xsiam"
  - "exposure_management"
- display: 'Fetch Asset types'
  name: fetch_assets_type
  defaultvalue: 'Spotlight,CNAPP Alerts'
  type: 16
  section: Collect
  advanced: false
  required: false
  additionalinfo: |-
    The asset sources to ingest into the Cortex Unified Asset Inventory.
  options:
  - Spotlight
  - CNAPP Alerts
  hidden:
  - xsoar
  supportedModules:
  - "xsiam"
  - "exposure_management"
- additionalinfo: The fetch interval for assets and vulnerabilities. It is recommended to set it to 1 hour.
  defaultvalue: 60
  display: Assets Fetch Interval
  name: assetsFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
  hidden:
  - xsoar
  - xpanse
  supportedModules:
  - "xsiam"
  - "exposure_management"
- display: 'Trust any certificate (not secure)'
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: 'Use system proxy settings'
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: The CrowdStrike Falcon OAuth 2 API (formerly the Falcon Firehose API), enables fetching and resolving detections, searching devices, getting behaviors by ID, containing hosts, and lifting host containment.
display: CrowdStrike Falcon
name: CrowdstrikeFalcon
script:
  commands:
  - arguments:
    - name: extended_data
      predefined:
      - Yes
      - No
      description: Whether or not to get additional data about the device.
      auto: PREDEFINED
    - description: The query by which to filter the device. The query format should be `filter_parameter_name:'filter_value'`.
      name: filter
    - description: The maximum records to return [1-5000].
      name: limit
      defaultValue: 50
    - description: The offset to start retrieving records from.
      name: offset
      defaultValue: 0
    - description: 'A comma-separated list of device IDs to limit the results.'
      name: ids
    - description: The status of the device.
      name: status
      auto: PREDEFINED
      predefined:
      - 'normal'
      - containment_pending
      - contained
      - lift_containment_pending
    - description: The hostname of the device.
      name: hostname
    - description: The platform name of the device.
      name: platform_name
      auto: PREDEFINED
      predefined:
      - 'Windows'
      - Mac
      - Linux
    - description: 'The site name of the device.'
      name: site_name
    - description: The property to sort by (e.g., status.desc or hostname.asc).
      name: sort
    description: Searches for a device that matches the query.
    name: cs-falcon-search-device
    outputs:
    - contextPath: CrowdStrike.Device.ID
      description: The ID of the device.
      type: String
    - contextPath: CrowdStrike.Device.LocalIP
      description: The local IP address of the device.
      type: String
    - contextPath: CrowdStrike.Device.ExternalIP
      description: The external IP address of the device.
      type: String
    - contextPath: CrowdStrike.Device.Hostname
      description: The hostname of the device.
      type: String
    - contextPath: CrowdStrike.Device.OS
      description: The operating system of the device.
      type: String
    - contextPath: CrowdStrike.Device.MacAddress
      description: The MAC address of the device.
      type: String
    - contextPath: CrowdStrike.Device.FirstSeen
      description: The first time the device was seen.
      type: String
    - contextPath: CrowdStrike.Device.LastSeen
      description: The last time the device was seen.
      type: String
    - contextPath: CrowdStrike.Device.PolicyType
      description: The policy type of the device.
      type: String
    - contextPath: CrowdStrike.Device.Status
      description: The device status.
      type: String
    - contextPath: Endpoint.Hostname
      description: The endpoint hostname.
      type: String
    - contextPath: Endpoint.OS
      description: The endpoint operation system.
      type: String
    - contextPath: Endpoint.IPAddress
      description: The endpoint IP address.
      type: String
    - contextPath: Endpoint.ID
      description: The endpoint ID.
      type: String
    - contextPath: Endpoint.Status
      description: The endpoint status.
      type: String
    - contextPath: Endpoint.IsIsolated
      description: The endpoint isolation status.
      type: String
    - contextPath: Endpoint.MACAddress
      description: The endpoint MAC address.
      type: String
    - contextPath: Endpoint.Vendor
      description: The integration name of the endpoint vendor.
      type: String
    - contextPath: Endpoint.OSVersion
      description: The endpoint operation system version.
      type: String
  - arguments:
    - description: The ID of the behavior. The ID of the behavior can be retrieved by running the cs-falcon-search-detection or cs-falcon-get-detections-for-incident command.
      name: behavior_id
      required: true
    description: Searches for and fetches the behavior that matches the query. Deprecated - No replacement available.
    name: cs-falcon-get-behavior
    outputs:
    - contextPath: CrowdStrike.Behavior.FileName
      description: The filename of the behavior.
      type: String
    - contextPath: CrowdStrike.Behavior.Scenario
      description: The scenario name of the behavior.
      type: String
    - contextPath: CrowdStrike.Behavior.MD5
      description: The MD5 hash of the IOC in the behavior.
      type: String
    - contextPath: CrowdStrike.Behavior.SHA256
      description: The SHA256 hash of the IOC in the behavior.
      type: String
    - contextPath: CrowdStrike.Behavior.IOCType
      description: The type of the indicator of compromise.
      type: String
    - contextPath: CrowdStrike.Behavior.IOCValue
      description: The value of the indicator of compromise.
      type: String
    - contextPath: CrowdStrike.Behavior.CommandLine
      description: The command line executed in the behavior.
      type: String
    - contextPath: CrowdStrike.Behavior.UserName
      description: The username related to the behavior.
      type: String
    - contextPath: CrowdStrike.Behavior.SensorID
      description: The sensor ID related to the behavior.
      type: String
    - contextPath: CrowdStrike.Behavior.ParentProcessID
      description: The ID of the parent process.
      type: String
    - contextPath: CrowdStrike.Behavior.ProcessID
      description: The process ID of the behavior.
      type: String
    - contextPath: CrowdStrike.Behavior.ID
      description: The ID of the behavior.
      type: String
    deprecated: true
  - arguments:
    - description: A comma-separated list of IDs of the detections to search. If provided, will override other arguments.
      isArray: true
      name: ids
    - description: |-
        Filter detections using a query in Falcon Query Language (FQL).
        For example, filter="device.hostname:'CS-SE-TG-W7-01'"
        For a full list of valid filter options, see: https://falcon.crowdstrike.com/support/documentation/2/query-api-reference#detectionsearch
      name: filter
      defaultValue: "product:'epp'+type:'ldt'"
    - auto: PREDEFINED
      description: Whether to get additional data such as device and behaviors processed.
      name: extended_data
      predefined:
      - Yes
      - No
    description: Search for details of specific detections, either using a filter query, or by providing the IDs of the detections.
    name: cs-falcon-search-detection
    outputs:
    - contextPath: CrowdStrike.Detection.Behavior.FileName
      description: The filename of the behavior.
      type: String
    - contextPath: CrowdStrike.Detection.Behavior.Scenario
      description: The scenario name of the behavior.
      type: String
    - contextPath: CrowdStrike.Detection.Behavior.MD5
      description: The MD5 hash of the IOC of the behavior.
      type: String
    - contextPath: CrowdStrike.Detection.Behavior.SHA256
      description: The SHA256 hash of the IOC of the behavior.
      type: String
    - contextPath: CrowdStrike.Detection.Behavior.IOCType
      description: The type of the IOC.
      type: String
    - contextPath: CrowdStrike.Detection.Behavior.IOCValue
      description: The value of the IOC.
      type: String
    - contextPath: CrowdStrike.Detection.Behavior.CommandLine
      description: The command line executed in the behavior.
      type: String
    - contextPath: CrowdStrike.Detection.Behavior.UserName
      description: The username related to the behavior.
      type: String
    - contextPath: CrowdStrike.Detection.Behavior.SensorID
      description: The sensor ID related to the behavior.
      type: String
    - contextPath: CrowdStrike.Detection.Behavior.ParentProcessID
      description: The ID of the parent process.
      type: String
    - contextPath: CrowdStrike.Detection.Behavior.ProcessID
      description: The process ID of the behavior.
      type: String
    - contextPath: CrowdStrike.Detection.Behavior.ID
      description: The ID of the behavior.
      type: String
    - contextPath: CrowdStrike.Detection.System
      description: The system name of the detection.
      type: String
    - contextPath: CrowdStrike.Detection.CustomerID
      description: The ID of the customer (CID).
      type: String
    - contextPath: CrowdStrike.Detection.MachineDomain
      description: The name of the domain of the detection machine.
      type: String
    - contextPath: CrowdStrike.Detection.ID
      description: The detection ID.
      type: String
    - contextPath: CrowdStrike.Detection.ProcessStartTime
      description: The start time of the process that generated the detection.
      type: Date
  - arguments:
    - description: A comma-separated list of one or more IDs to resolve.
      name: ids
      required: true
    - auto: PREDEFINED
      description: "The status to transition a detection to."
      name: status
      predefined:
      - new
      - in_progress
      - closed
      - reopened
    - description: 'A user ID, for example: 1234567855512345678. username and assigned_to_uuid are mutually exclusive.'
      name: assigned_to_uuid
    - description: Optional comment to add to the detection. Comments are displayed with the detection in CrowdStrike Falcon and provide context or notes for other Falcon users.
      name: comment
    - auto: PREDEFINED
      description: If true, displays the detection in the UI.
      name: show_in_ui
      predefined:
      - 'true'
      - 'false'
    - description: Username to assign the detections to. (This is usually the user's email address, but may vary based on your configuration). username and assigned_to_uuid are mutually exclusive.
      name: username
    - description: The tag to add to the detection, supported only for API V3.
      name: tag
    description: Resolves and updates a detection using the provided arguments. At least one optional argument must be passed, otherwise no change will take place. Note that IDP detections are not supported.
    name: cs-falcon-resolve-detection
  - arguments:
    - description: A comma-separated list of host agent IDs (AID) of the host to contain. Get an agent ID from a detection.
      isArray: true
      name: ids
      required: true
    description: Contains containment for a specified host. When contained, a host can only communicate with the CrowdStrike cloud and any IPs specified in your containment policy.
    name: cs-falcon-contain-host
    compliantpolicies:
    - EndPoint Isolation
  - arguments:
    - description: A comma-separated list of host agent IDs (AIDs) of the hosts to contain. Get an agent ID from a detection.
      isArray: true
      name: ids
      required: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to lift filesystem containment instead of network containment. When set to true, uses the lift_filesystem_containment_all action to remove filesystem containment from the specified hosts.
      name: lift_filesystem_containment_all
      predefined:
      - 'true'
      - 'false'
    description: Lifts containment on the host, which returns its network communications to normal. When lift_filesystem_containment_all is set to true, lifts filesystem containment instead.
    name: cs-falcon-lift-host-containment
    compliantpolicies:
    - EndPoint Isolation
  - arguments:
    - description: Any commands run against an offline-queued session will be queued up and executed when the host comes online.
      name: queue_offline
      defaultValue: false
    - description: A comma-separated list of host agent IDs to run commands for. The list of host agent IDs can be retrieved by running the 'cs-falcon-search-device' command.
      name: host_ids
      required: true
    - description: The type of command to run.
      name: command_type
      required: true
    - description: The full command to run.
      name: full_command
      required: true
    - auto: PREDEFINED
      defaultValue: read
      description: 'The scope to run the command for. (NOTE: In order to run the CrowdStrike RTR `put` command, it is necessary to pass `scope=admin`).'
      name: scope
      predefined:
      - read
      - write
      - admin
    - name: timeout
      description: The amount of time (in seconds) that a request will wait for a client to establish a connection to a remote machine before a timeout occurs.
      defaultValue: "180"
      type: unknown
    - auto: PREDEFINED
      defaultValue: batch
      description: The target to run the command for.
      name: target
      predefined:
      - batch
      - single
    - description: A batch ID to execute the command on.
      name: batch_id
    description: Sends commands to hosts.
    name: cs-falcon-run-command
    outputs:
    - contextPath: CrowdStrike.Command.HostID
      description: The ID of the host the command was running for.
      type: String
    - contextPath: CrowdStrike.Command.SessionID
      description: The session ID of the host.
      type: string
    - contextPath: CrowdStrike.Command.Stdout
      description: The standard output of the command.
      type: String
    - contextPath: CrowdStrike.Command.Stderr
      description: The standard error of the command.
      type: String
    - contextPath: CrowdStrike.Command.BaseCommand
      description: The base command.
      type: String
    - contextPath: CrowdStrike.Command.FullCommand
      description: The full command.
      type: String
    - contextPath: CrowdStrike.Command.TaskID
      description: (For single host) The ID of the command request which has been accepted.
      type: string
    - contextPath: CrowdStrike.Command.Complete
      description: (For single host) True if the command completed.
      type: boolean
    - contextPath: CrowdStrike.Command.NextSequenceID
      description: (For single host) The next sequence ID.
      type: number
    - contextPath: CrowdStrike.Command.BatchID
      description: The Batch ID that the command was executed on.
      type: String
  - arguments:
    - description: The script name to upload.
      name: name
      required: true
    - auto: PREDEFINED
      defaultValue: private
      description: 'The permission type for the custom script. Possible values are: "private", which is used only by the user who uploaded it, "group", which is used by all RTR Admins, and "public", which is used by all active-responders and RTR admins.'
      name: permission_type
      predefined:
      - private
      - group
      - public
    - description: The content of the PowerShell script.
      name: content
      required: true
    description: Uploads a script to Falcon CrowdStrike.
    name: cs-falcon-upload-script
  - arguments:
    - description: The file entry ID to upload.
      name: entry_id
      required: true
    description: Uploads a file to the CrowdStrike cloud. (Can be used for the RTR 'put' command).
    name: cs-falcon-upload-file
  - arguments:
    - description: The ID of the file to delete. Either this argument or file_name is required. When both are specified, file_id takes precedence.
      name: file_id
    - description: The name of the file to delete. Either this argument or file_id is required. When both are specified, file_id takes precedence.
      name: file_name
    description: Deletes a file based on the provided ID or name. Can delete only one file at a time.
    name: cs-falcon-delete-file
  - arguments:
    - description: A comma-separated list of file IDs to get. The list of file IDs can be retrieved by running the 'cs-falcon-list-files' command.
      name: file_id
      required: true
    description: Returns files based on the provided IDs. These files are used for the RTR 'put' command.
    name: cs-falcon-get-file
    outputs:
    - contextPath: CrowdStrike.File.ID
      description: The ID of the file.
      type: String
    - contextPath: CrowdStrike.File.CreatedBy
      description: The email address of the user who created the file.
      type: String
    - contextPath: CrowdStrike.File.CreatedTime
      description: The datetime the file was created.
      type: Date
    - contextPath: CrowdStrike.File.Description
      description: The description of the file.
      type: String
    - contextPath: CrowdStrike.File.Type
      description: The type of the file. For example, script.
      type: String
    - contextPath: CrowdStrike.File.ModifiedBy
      description: The email address of the user who modified the file.
      type: String
    - contextPath: CrowdStrike.File.ModifiedTime
      description: The datetime the file was modified.
      type: Date
    - contextPath: CrowdStrike.File.Name
      description: The full name of the file.
      type: String
    - contextPath: CrowdStrike.File.Permission
      description: 'The permission type of the file. Possible values are: "private", which is used only by the user who uploaded it, "group", which is used by all RTR Admins, and "public", which is used by all active-responders and RTR admins.'
      type: String
    - contextPath: CrowdStrike.File.SHA256
      description: The SHA-256 hash of the file.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.Name
      description: The full name of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA-256 hash of the file.
      type: String
    - contextPath: File.Size
      description: The size of the file in bytes.
      type: Number
  - arguments: []
    description: Returns a list of put-file IDs that are available for the user in the 'put' command. Due to an API limitation, the maximum number of files returned is 100.
    name: cs-falcon-list-files
    outputs:
    - contextPath: CrowdStrike.File.ID
      description: The ID of the file.
      type: String
    - contextPath: CrowdStrike.File.CreatedBy
      description: The email address of the user who created the file.
      type: String
    - contextPath: CrowdStrike.File.CreatedTime
      description: The datetime the file was created.
      type: Date
    - contextPath: CrowdStrike.File.Description
      description: The description of the file.
      type: String
    - contextPath: CrowdStrike.File.Type
      description: The type of the file. For example, script.
      type: String
    - contextPath: CrowdStrike.File.ModifiedBy
      description: The email address of the user who modified the file.
      type: String
    - contextPath: CrowdStrike.File.ModifiedTime
      description: The datetime the file was modified.
      type: Date
    - contextPath: CrowdStrike.File.Name
      description: The full name of the file.
      type: String
    - contextPath: CrowdStrike.File.Permission
      description: 'The permission type of the file. Possible values are: "private", which is used only by the user who uploaded it, "group", which is used by all RTR Admins, and "public", which is used by all active-responders and RTR admins.'
      type: String
    - contextPath: CrowdStrike.File.SHA256
      description: The SHA-256 hash of the file.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.Name
      description: The full name of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA-256 hash of the file.
      type: String
    - contextPath: File.Size
      description: The size of the file in bytes.
      type: Number
  - arguments:
    - description: A comma-separated list of script IDs to return. The script IDs can be retrieved by running the 'cs-falcon-list-scripts' command.
      name: script_id
      required: true
    description: Returns custom scripts based on the provided ID. Used for the RTR 'runscript' command.
    name: cs-falcon-get-script
    outputs:
    - contextPath: CrowdStrike.Script.ID
      description: The ID of the script.
      type: String
    - contextPath: CrowdStrike.Script.CreatedBy
      description: The email address of the user who created the script.
      type: String
    - contextPath: CrowdStrike.Script.CreatedTime
      description: The datetime the script was created.
      type: Date
    - contextPath: CrowdStrike.Script.Description
      description: The description of the script.
      type: String
    - contextPath: CrowdStrike.Script.ModifiedBy
      description: The email address of the user who modified the script.
      type: String
    - contextPath: CrowdStrike.Script.ModifiedTime
      description: The datetime the script was modified.
      type: Date
    - contextPath: CrowdStrike.Script.Name
      description: The script name.
      type: String
    - contextPath: CrowdStrike.Script.Permission
      description: 'Permission type of the script. Possible values are: "private", which is used only by the user who uploaded it, "group", which is used by all RTR Admins, and "public", which is used by all active-responders and RTR admins.'
      type: String
    - contextPath: CrowdStrike.Script.SHA256
      description: The SHA-256 hash of the script file.
      type: String
    - contextPath: CrowdStrike.Script.RunAttemptCount
      description: The number of times the script attempted to run.
      type: Number
    - contextPath: CrowdStrike.Script.RunSuccessCount
      description: The number of times the script ran successfully.
      type: Number
    - contextPath: CrowdStrike.Script.Platform
      description: The list of operating system platforms on which the script can run. For example, Windows.
      type: String
    - contextPath: CrowdStrike.Script.WriteAccess
      description: Whether the user has write access to the script.
      type: Boolean
  - arguments:
    - description: The script ID to delete. The script IDs can be retrieved by running the 'cs-falcon-list-scripts' command.
      name: script_id
      required: true
    description: Deletes a custom-script based on the provided ID. Can delete only one script at a time.
    name: cs-falcon-delete-script
  - arguments: []
    description: Returns a list of custom script IDs that are available for the user in the 'runscript' command.
    name: cs-falcon-list-scripts
    outputs:
    - contextPath: CrowdStrike.Script.ID
      description: The ID of the script.
      type: String
    - contextPath: CrowdStrike.Script.CreatedBy
      description: The email address of the user who created the script.
      type: String
    - contextPath: CrowdStrike.Script.CreatedTime
      description: The datetime the script was created.
      type: Date
    - contextPath: CrowdStrike.Script.Description
      description: The description of the script.
      type: String
    - contextPath: CrowdStrike.Script.ModifiedBy
      description: The email address of the user who modified the script.
      type: String
    - contextPath: CrowdStrike.Script.ModifiedTime
      description: The datetime the script was modified.
      type: Date
    - contextPath: CrowdStrike.Script.Name
      description: The script name.
      type: String
    - contextPath: CrowdStrike.Script.Permission
      description: 'Permission type of the script. Possible values are: "private", which is used only by the user who uploaded it, "group", which is used by all RTR Admins, and "public", which is used by all active-responders and RTR admins.'
      type: String
    - contextPath: CrowdStrike.Script.SHA256
      description: The SHA-256 hash of the script file.
      type: String
    - contextPath: CrowdStrike.Script.RunAttemptCount
      description: The number of times the script attempted to run.
      type: Number
    - contextPath: CrowdStrike.Script.RunSuccessCount
      description: The number of times the script ran successfully.
      type: Number
    - contextPath: CrowdStrike.Script.Platform
      description: The list of operating system platforms on which the script can run. For example, Windows.
      type: String
    - contextPath: CrowdStrike.Script.WriteAccess
      description: Whether the user has write access to the script.
      type: Boolean
  - arguments:
    - description: The name of the script to run.
      name: script_name
    - description: A comma-separated list of host agent IDs to run commands. The list of host agent IDs can be retrieved by running the 'cs-falcon-search-device' command.
      name: host_ids
      required: true
    - description: The PowerShell script code to run.
      name: raw
    - defaultValue: '30'
      description: Timeout for how long to wait for the request in seconds. Maximum is 600 (10 minutes).
      name: timeout
    - description: Whether the command will run against an offline-queued session and be queued for execution when the host comes online.
      name: queue_offline
      defaultValue: false
    description: Runs a script on the agent host.
    name: cs-falcon-run-script
    outputs:
    - contextPath: CrowdStrike.Command.HostID
      description: The ID of the host for which the command was running.
      type: String
    - contextPath: CrowdStrike.Command.SessionID
      description: The ID of the session of the host.
      type: String
    - contextPath: CrowdStrike.Command.Stdout
      description: The standard output of the command.
      type: String
    - contextPath: CrowdStrike.Command.Stderr
      description: The standard error of the command.
      type: String
    - contextPath: CrowdStrike.Command.BaseCommand
      description: The base command.
      type: String
    - contextPath: CrowdStrike.Command.FullCommand
      description: The full command.
      type: String
  - arguments:
    - description: A comma-separated list of host agent IDs on which to run the RTR command.
      isArray: true
      name: host_ids
      required: true
    - description: Full path to the file that will be retrieved from each host in the batch.
      name: file_path
      required: true
    - description: A comma-separated list of a subset of hosts on which to run the command.
      name: optional_hosts
      isArray: true
    - description: 'The number of seconds to wait for the request before it times out. In ISO time format. For example: 2019-10-17T13:41:48.487520845Z.'
      name: timeout
    - description: 'The amount of time to wait for the request before it times out. In duration syntax. For example, 10s. Valid units are: ns, us, ms, s, m, h. Maximum value is 10 minutes.'
      name: timeout_duration
    description: Batch executes 'get' command across hosts to retrieve files.
    name: cs-falcon-run-get-command
    outputs:
    - contextPath: CrowdStrike.Command.HostID
      description: The ID of the host on which the command was running.
      type: string
    - contextPath: CrowdStrike.Command.Stdout
      description: The standard output of the command.
      type: string
    - contextPath: CrowdStrike.Command.Stderr
      description: The standard error of the command.
      type: string
    - contextPath: CrowdStrike.Command.BaseCommand
      description: The base command.
      type: string
    - contextPath: CrowdStrike.Command.TaskID
      description: The ID of the command that was running on the host.
      type: string
    - contextPath: CrowdStrike.Command.GetRequestID
      description: The ID of the command request that was accepted.
      type: string
    - contextPath: CrowdStrike.Command.Complete
      description: True if the command completed.
      type: boolean
    - contextPath: CrowdStrike.Command.FilePath
      description: The file path.
      type: string
  - arguments:
    - description: A comma-separated list of IDs of the command requested.
      isArray: true
      name: request_ids
      required: true
    - description: 'The number of seconds to wait for the request before it times out. In ISO time format. For example: 2019-10-17T13:41:48.487520845Z.'
      name: timeout
    - description: 'The amount of time to wait for the request before it times out. In duration syntax. For example, 10s. Valid units are: ns, us, ms, s, m, h. Maximum value is 10 minutes.'
      name: timeout_duration
    description: Retrieves the status of the specified batch 'get' command.
    name: cs-falcon-status-get-command
    outputs:
    - contextPath: CrowdStrike.File.ID
      description: The ID of the file.
      type: string
    - contextPath: CrowdStrike.File.TaskID
      description: The ID of the command that is running.
      type: string
    - contextPath: CrowdStrike.File.CreatedAt
      description: The date the file was created.
      type: date
    - contextPath: CrowdStrike.File.DeletedAt
      description: The date the file was deleted.
      type: date
    - contextPath: CrowdStrike.File.UpdatedAt
      description: The date the file was last updated.
      type: date
    - contextPath: CrowdStrike.File.Name
      description: The full name of the file.
      type: string
    - contextPath: CrowdStrike.File.SHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: CrowdStrike.File.Size
      description: The size of the file in bytes.
      type: number
    - contextPath: File.Name
      description: The full name of the file.
      type: string
    - contextPath: File.Size
      description: The size of the file in bytes.
      type: number
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
  - arguments:
    - description: The ID of the command requested.
      name: request_id
      required: true
    - description: The sequence ID in chunk requests.
      name: sequence_id
    - auto: PREDEFINED
      defaultValue: read
      description: The scope to run the command for.
      name: scope
      predefined:
      - read
      - write
      - admin
    description: Gets the status of a command executed on a host.
    name: cs-falcon-status-command
    outputs:
    - contextPath: CrowdStrike.Command.TaskID
      description: The ID of the command request that was accepted.
      type: string
    - contextPath: CrowdStrike.Command.Stdout
      description: The standard output of the command.
      type: string
    - contextPath: CrowdStrike.Command.Stderr
      description: The standard error of the command.
      type: string
    - contextPath: CrowdStrike.Command.BaseCommand
      description: The base command.
      type: string
    - contextPath: CrowdStrike.Command.Complete
      description: True if the command completed.
      type: boolean
    - contextPath: CrowdStrike.Command.SequenceID
      description: The sequence ID in the current request.
      type: number
    - contextPath: CrowdStrike.Command.NextSequenceID
      description: The sequence ID for the next request in the chunk request.
      type: number
  - arguments:
    - description: The host agent ID.
      name: host_id
      required: true
    - description: The SHA256 hash of the file.
      name: sha256
      required: true
    - description: The filename to use for the archive name and the file within the archive.
      name: filename
    description: Gets the RTR extracted file contents for the specified session and SHA256 hash.
    name: cs-falcon-get-extracted-file
  - arguments:
    - description: The ID of the host agent that lists files in the session.
      name: host_id
      required: true
    - description: The ID of the existing session with the agent.
      name: session_id
    description: Gets a list of files for the specified RTR session on a host.
    name: cs-falcon-list-host-files
    outputs:
    - contextPath: CrowdStrike.Command.HostID
      description: The ID of the host the command was running for.
      type: string
    - contextPath: CrowdStrike.Command.TaskID
      description: The ID of the command request that was accepted.
      type: string
    - contextPath: CrowdStrike.Command.SessionID
      description: The ID of the session of the host.
      type: string
    - contextPath: CrowdStrike.File.ID
      description: The ID of the file.
      type: string
    - contextPath: CrowdStrike.File.CreatedAt
      description: The date the file was created.
      type: date
    - contextPath: CrowdStrike.File.DeletedAt
      description: The date the file was deleted.
      type: date
    - contextPath: CrowdStrike.File.UpdatedAt
      description: The date the file was last updated.
      type: date
    - contextPath: CrowdStrike.File.Name
      description: The full name of the file.
      type: string
    - contextPath: CrowdStrike.File.SHA256
      description: The SHA256 hash of the file.
      type: string
    - contextPath: CrowdStrike.File.Size
      description: The size of the file in bytes.
      type: number
    - contextPath: File.Name
      description: The full name of the file.
      type: string
    - contextPath: File.Size
      description: The size of the file in bytes.
      type: number
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: string
  - arguments:
    - description: The ID of the host to extend the session for.
      name: host_id
      required: true
    description: Refresh a session timeout on a single host.
    name: cs-falcon-refresh-session
  - arguments:
    - description: 'A comma-separated list of indicator types. Valid types are: "sha256", "sha1", "md5", "domain", "ipv4", "ipv6".'
      isArray: true
      name: types
    - description: A comma-separated list of indicator values.
      isArray: true
      name: values
    - description: A comma-separated list of indicator policies.
      isArray: true
      name: policies
    - description: The level the indicator will be shared at. Only "red" share level (not shared) is supported, which indicates that the IOC is not shared with other CrowdStrike Falcon Host customers.
      isArray: true
      name: share_levels
    - description: A comma-separated list of IOC sources.
      isArray: true
      name: sources
    - description: Start of date range to search in YYYY-MM-DD format.
      name: from_expiration_date
    - description: End of date range to search in YYYY-MM-DD format.
      name: to_expiration_date
    - description: The maximum number of records to return. The minimum is 1 and the maximum is 500. Default is 100.
      name: limit
    - auto: PREDEFINED
      description: The order the results are returned in.
      name: sort
      predefined:
      - type.asc
      - type.desc
      - value.asc
      - value.desc
      - policy.asc
      - policy.desc
      - share_level.asc
      - share_level.desc
      - expiration_timestamp.asc
      - expiration_timestamp.desc
    - description: The offset to begin the list from. For example, start from the 10th record and return the list.
      name: offset
    deprecated: true
    description: Deprecated. Use the cs-falcon-search-custom-iocs command instead.
    name: cs-falcon-search-iocs
    outputs:
    - contextPath: CrowdStrike.IOC.Type
      description: The type of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Value
      description: The string representation of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.ID
      description: The full ID of the indicator (type:value).
      type: string
    - contextPath: CrowdStrike.IOC.Policy
      description: The policy of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.Source
      description: The source of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.ShareLevel
      description: The level at which the indicator will be shared.
      type: string
    - contextPath: CrowdStrike.IOC.Expiration
      description: The datetime the indicator will expire.
      type: string
    - contextPath: CrowdStrike.IOC.Description
      description: The description of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.CreatedTime
      description: The datetime the IOC was created.
      type: string
    - contextPath: CrowdStrike.IOC.CreatedBy
      description: The identity of the user/process who created the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.ModifiedTime
      description: The datetime the indicator was last modified.
      type: string
    - contextPath: CrowdStrike.IOC.ModifiedBy
      description: The identity of the user/process who last updated the IOC.
      type: string
  - arguments:
    - auto: PREDEFINED
      description: The IOC type to retrieve.
      name: type
      predefined:
      - sha256
      - sha1
      - md5
      - domain
      - ipv4
      - ipv6
      required: true
    - description: The string representation of the indicator.
      name: value
      required: true
    deprecated: true
    description: Deprecated. Use the cs-falcon-get-custom-ioc command instead.
    name: cs-falcon-get-ioc
    outputs:
    - contextPath: CrowdStrike.IOC.Type
      description: The type of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Value
      description: The string representation of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.ID
      description: The full ID of the indicator (type:value).
      type: string
    - contextPath: CrowdStrike.IOC.Policy
      description: The policy of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.Source
      description: The source of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.ShareLevel
      description: The level at which the indicator will be shared.
      type: string
    - contextPath: CrowdStrike.IOC.Expiration
      description: The datetime when the indicator will expire.
      type: string
    - contextPath: CrowdStrike.IOC.Description
      description: The description of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.CreatedTime
      description: The datetime the IOC was created.
      type: string
    - contextPath: CrowdStrike.IOC.CreatedBy
      description: The identity of the user/process who created the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.ModifiedTime
      description: The datetime the indicator was last modified.
      type: string
    - contextPath: CrowdStrike.IOC.ModifiedBy
      description: The identity of the user/process who last updated the IOC.
      type: string
  - arguments:
    - auto: PREDEFINED
      description: The type of the indicator.
      name: ioc_type
      predefined:
      - sha256
      - md5
      - domain
      - ipv4
      - ipv6
      required: true
    - description: The string representation of the indicator.
      name: value
      required: true
    - auto: PREDEFINED
      defaultValue: detect
      description: 'The policy to enact when the value is detected on a host. A value of "none" is equivalent to turning the indicator off.'
      name: policy
      predefined:
      - detect
      - none
    - auto: PREDEFINED
      description: The level the indicator will be shared at. Only "red" share level (not shared) is supported, which indicates that the IOC is not shared with other Falcon Host customers.
      name: share_level
      predefined:
      - red
    - description: The number of days the indicator should be valid for. This only applies to domain, ipv4, and ipv6 types.
      name: expiration_days
    - description: The source where this indicator originated. This can be used for tracking where this indicator was defined. Limited to 200 characters.
      name: source
    - description: A meaningful description of the indicator. Limited to 200 characters.
      name: description
    deprecated: true
    description: Deprecated. Use the cs-falcon-upload-custom-ioc command instead.
    name: cs-falcon-upload-ioc
    outputs:
    - contextPath: CrowdStrike.IOC.Type
      description: The type of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Value
      description: The string representation of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.ID
      description: The full ID of the indicator (type:value).
      type: string
    - contextPath: CrowdStrike.IOC.Policy
      description: The policy of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.Source
      description: The source of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.ShareLevel
      description: The level at which the indicator will be shared.
      type: string
    - contextPath: CrowdStrike.IOC.Expiration
      description: The datetime the indicator will expire.
      type: string
    - contextPath: CrowdStrike.IOC.Description
      description: The description of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.CreatedTime
      description: The datetime the IOC was created.
      type: string
    - contextPath: CrowdStrike.IOC.CreatedBy
      description: The identity of the user/process who created the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.ModifiedTime
      description: The datetime the indicator was last modified.
      type: string
    - contextPath: CrowdStrike.IOC.ModifiedBy
      description: The identity of the user/process who last updated the IOC.
      type: string
  - arguments:
    - auto: PREDEFINED
      description: The type of the indicator.
      name: ioc_type
      predefined:
      - sha256
      - md5
      - sha1
      - domain
      - ipv4
      - ipv6
      required: true
    - description: The string representation of the indicator.
      name: value
      required: true
    - auto: PREDEFINED
      defaultValue: detect
      description: 'The policy to enact when the value is detected on a host. A value of "none" is equivalent to turning the indicator off.'
      name: policy
      predefined:
      - detect
      - none
    - auto: PREDEFINED
      description: The level the indicator will be shared at. Only "red" share level (not shared) is supported, which indicates that the IOC is not shared with other Falcon Host customers.
      name: share_level
      predefined:
      - red
    - description: The number of days the indicator should be valid for. This only applies to domain, ipv4, and ipv6 types.
      name: expiration_days
    - description: The source where this indicator originated. This can be used for tracking where this indicator was defined. Limited to 200 characters.
      name: source
    - description: A meaningful description of the indicator. Limited to 200 characters.
      name: description
    deprecated: true
    description: Deprecated. Use the cs-falcon-update-custom-ioc command instead.
    name: cs-falcon-update-ioc
    outputs:
    - contextPath: CrowdStrike.IOC.Type
      description: The type of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Value
      description: The string representation of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.ID
      description: The full ID of the indicator (type:value).
      type: string
    - contextPath: CrowdStrike.IOC.Policy
      description: The policy of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.Source
      description: The source of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.ShareLevel
      description: The level at which the indicator will be shared.
      type: string
    - contextPath: CrowdStrike.IOC.Expiration
      description: The datetime the indicator will expire.
      type: string
    - contextPath: CrowdStrike.IOC.Description
      description: The description of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.CreatedTime
      description: The datetime the IOC was created.
      type: string
    - contextPath: CrowdStrike.IOC.CreatedBy
      description: The identity of the user/process who created the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.ModifiedTime
      description: The datetime the indicator was last modified.
      type: string
    - contextPath: CrowdStrike.IOC.ModifiedBy
      description: The identity of the user/process who last updated the IOC.
      type: string
  - arguments:
    - auto: PREDEFINED
      description: The IOC type to delete.
      name: type
      predefined:
      - sha256
      - sha1
      - md5
      - domain
      - ipv4
      - ipv6
      required: true
    - description: The string representation of the indicator.
      name: value
      required: true
    deprecated: true
    description: Deprecated. Use the cs-falcon-delete-custom-ioc command instead.
    name: cs-falcon-delete-ioc
  - arguments:
    - auto: PREDEFINED
      description: A comma-separated list of indicator types.
      isArray: true
      name: types
      predefined:
      - sha256
      - sha1
      - md5
      - domain
      - ipv4
      - ipv6
    - description: A comma-separated list of indicator values.
      isArray: true
      name: values
    - description: A comma-separated list of IOC sources.
      isArray: true
      name: sources
    - description: The datetime the indicator will become inactive (ISO 8601 format, i.e., YYYY-MM-DDThh:mm:ssZ).
      name: expiration
    - defaultValue: '50'
      description: The maximum number of records to return. The minimum is 1 and the maximum is 500.
      name: limit
    - auto: PREDEFINED
      description: The order the results are returned in.
      name: sort
      predefined:
      - type.asc
      - type.desc
      - value.asc
      - value.desc
      - policy.asc
      - policy.desc
      - share_level.asc
      - share_level.desc
      - expiration_timestamp.asc
      - expiration_timestamp.desc
    - description: The offset to begin the list from. For example, start from the 10th record and return the list.
      name: offset
    - description: A pagination token used with the limit parameter to manage pagination of results. Matching the 'after' parameter in the API. Use instead of offset.
      name: next_page_token
    description: Returns a list of your uploaded IOCs that match the search criteria.
    name: cs-falcon-search-custom-iocs
    outputs:
    - contextPath: CrowdStrike.IOC.Type
      description: The type of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Value
      description: The string representation of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.ID
      description: The full ID of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.Severity
      description: The severity level to apply to this indicator.
      type: string
    - contextPath: CrowdStrike.IOC.Source
      description: The source of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Action
      description: Action to take when a host observes the custom IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Expiration
      description: The datetime the indicator will expire.
      type: string
    - contextPath: CrowdStrike.IOC.Description
      description: The description of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.CreatedTime
      description: The datetime the IOC was created.
      type: date
    - contextPath: CrowdStrike.IOC.CreatedBy
      description: The identity of the user/process who created the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.ModifiedTime
      description: The datetime the indicator was last modified.
      type: date
    - contextPath: CrowdStrike.IOC.ModifiedBy
      description: The identity of the user/process who last updated the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.MobileAction
      description: The action to take on mobile devices when a host observes the custom IOC.
      type: string
    - contextPath: CrowdStrike.NextPageToken
      description: A pagination token used with the limit parameter to manage pagination of results.
  - arguments:
    - auto: PREDEFINED
      description: The IOC type to retrieve. Either ioc_id or ioc_type and value must be provided.
      name: type
      predefined:
      - sha256
      - sha1
      - md5
      - domain
      - ipv4
      - ipv6
    - description: The string representation of the indicator. Either ioc_id or ioc_type and value must be provided.
      name: value
    - description: The ID of the IOC to get. The ID of the IOC can be retrieved by running the 'cs-falcon-search-custom-iocs' command. Either ioc_id or ioc_type and value must be provided.
      name: ioc_id
    description: Gets the full definition of one or more indicators that you are watching.
    name: cs-falcon-get-custom-ioc
    outputs:
    - contextPath: CrowdStrike.IOC.Type
      description: The type of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Value
      description: The string representation of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.ID
      description: The full ID of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.Severity
      description: The severity level to apply to this indicator.
      type: string
    - contextPath: CrowdStrike.IOC.Source
      description: The source of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Action
      description: Action to take when a host observes the custom IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Expiration
      description: The datetime when the indicator will expire.
      type: string
    - contextPath: CrowdStrike.IOC.Description
      description: The description of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.CreatedTime
      description: The datetime the IOC was created.
      type: date
    - contextPath: CrowdStrike.IOC.CreatedBy
      description: The identity of the user/process who created the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.ModifiedTime
      description: The datetime the indicator was last modified.
      type: date
    - contextPath: CrowdStrike.IOC.ModifiedBy
      description: The identity of the user/process who last updated the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.MobileAction
      description: The action to take on mobile devices when a host observes the custom IOC.
      type: string
  - arguments:
    - auto: PREDEFINED
      description: The type of the indicator.
      name: ioc_type
      predefined:
      - sha256
      - md5
      - domain
      - ipv4
      - ipv6
      required: true
    - description: |-
        A comma-separated list of indicators.
        More than one value can be supplied to upload multiple IOCs of the same type but with different values. Note that the uploaded IOCs will have the same properties (as supplied in other arguments).
      isArray: true
      name: value
      required: true
    - auto: PREDEFINED
      description: 'Action to take when a host observes the custom IOC. Possible values are: no_action - Save the indicator for future use, but take no action. No severity required. allow - Applies to hashes only. Allow the indicator and do not detect it. Severity does not apply and should not be provided. prevent_no_ui - Applies to hashes only. Block and detect the indicator, but hide it from Activity > Detections. Has a default severity value. prevent - Applies to hashes only. Block the indicator and show it as a detection at the selected severity. detect - Enable detections for the indicator at the selected severity.'
      name: action
      predefined:
      - no_action
      - allow
      - prevent_no_ui
      - prevent
      - detect
      required: true
    - auto: PREDEFINED
      description: A comma-separated list of the platforms that the indicator applies to.
      isArray: true
      name: platforms
      predefined:
      - mac
      - windows
      - linux
      - android
      - ios
      required: true
    - auto: PREDEFINED
      description: The severity level to apply to this indicator. Required for the prevent and detect actions. Optional for no_action.
      name: severity
      predefined:
      - informational
      - low
      - medium
      - high
      - critical
    - description: The datetime the indicator will become inactive (ISO 8601 format, i.e., YYYY-MM-DDThh:mm:ssZ).
      name: expiration
    - description: The source where this indicator originated. This can be used for tracking where this indicator was defined. Limited to 200 characters.
      name: source
    - description: A meaningful description of the indicator. Limited to 200 characters.
      name: description
    - auto: PREDEFINED
      description: Whether the indicator is applied globally. Either applied_globally or host_groups must be provided.
      name: applied_globally
      predefined:
      - 'true'
      - 'false'
    - description: A comma-separated list of host group IDs that the indicator applies to. The list of host group IDs can be retrieved by running the 'cs-falcon-list-host-groups' command. Either applied_globally or host_groups must be provided.
      isArray: true
      name: host_groups
    - description: A comma-separated list of tags to apply to the indicator.
      isArray: true
      name: tags
    - description: Name of the file for file indicators. Applies to hashes only. A common filename, or a filename in your environment. Filenames can be helpful for identifying hashes or filtering IOCs.
      name: file_name
    - auto: PREDEFINED
      description: |-
        The action to take on mobile devices when a host observes the custom IOC.
        Note: To use this argument, a mobile platform (android or ios) must be included in the platforms argument.
        - no_action: The indicator is saved for future use, but no action is taken (no severity required).
        - allow: The indicator is allowed and not detected (severity does not apply and should not be provided).
        - detect: The connection is allowed and a detection is generated.
        - prevent: The indicator is blocked and shown as a detection.
      name: mobile_action
      predefined:
      - no_action
      - allow
      - detect
      - prevent
    description: Uploads an indicator for CrowdStrike to monitor.
    name: cs-falcon-upload-custom-ioc
    outputs:
    - contextPath: CrowdStrike.IOC.Type
      description: The type of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Value
      description: The string representation of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.ID
      description: The full ID of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.Severity
      description: The severity level to apply to this indicator.
      type: string
    - contextPath: CrowdStrike.IOC.Source
      description: The source of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Action
      description: Action to take when a host observes the custom IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Expiration
      description: The datetime when the indicator will expire.
      type: string
    - contextPath: CrowdStrike.IOC.Description
      description: The description of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.CreatedTime
      description: The datetime the IOC was created.
      type: date
    - contextPath: CrowdStrike.IOC.CreatedBy
      description: The identity of the user/process who created the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.ModifiedTime
      description: The datetime the indicator was last modified.
      type: date
    - contextPath: CrowdStrike.IOC.ModifiedBy
      description: The identity of the user/process who last updated the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Tags
      description: The tags of the IOC.
      type: Unknown
    - contextPath: CrowdStrike.IOC.Platforms
      description: The platforms of the IOC.
      type: Unknown
    - contextPath: CrowdStrike.IOC.Filename
      description: Name of the file for file indicators. Applies to hashes only. A common filename, or a filename in your environment. Filenames can be helpful for identifying hashes or filtering IOCs.
      type: string
    - contextPath: CrowdStrike.IOC.MobileAction
      description: The action to take on mobile devices when a host observes the custom IOC.
      type: string
    compliantpolicies:
    - Domain Blockage
    - IP Blockage
  - arguments:
    - description: The ID of the IOC to update. The ID of the IOC can be retrieved by running the 'cs-falcon-search-custom-iocs' command.
      name: ioc_id
      required: true
    - auto: PREDEFINED
      description: 'Action to take when a host observes the custom IOC. Possible values are: no_action - Save the indicator for future use, but take no action. No severity required. allow - Applies to hashes only. Allow the indicator and do not detect it. Severity does not apply and should not be provided. prevent_no_ui - Applies to hashes only. Block and detect the indicator, but hide it from Activity > Detections. Has a default severity value. prevent - Applies to hashes only. Block the indicator and show it as a detection at the selected severity. detect - Enable detections for the indicator at the selected severity.'
      name: action
      predefined:
      - no_action
      - allow
      - prevent_no_ui
      - prevent
      - detect
    - auto: PREDEFINED
      description: A comma-separated list of the platforms that the indicator applies to.
      name: platforms
      predefined:
      - mac
      - windows
      - linux
    - auto: PREDEFINED
      description: The severity level to apply to this indicator. Required for the prevent and detect actions. Optional for no_action.
      name: severity
      predefined:
      - informational
      - low
      - medium
      - high
      - critical
    - description: The datetime the indicator will become inactive (ISO 8601 format, i.e., YYYY-MM-DDThh:mm:ssZ).
      name: expiration
    - description: The source where this indicator originated. This can be used for tracking where this indicator was defined. Limited to 200 characters.
      name: source
    - description: A meaningful description of the indicator. Limited to 200 characters.
      name: description
    - description: Name of the file for file indicators. Applies to hashes only. A common filename, or a filename in your environment. Filenames can be helpful for identifying hashes or filtering IOCs.
      name: file_name
    - auto: PREDEFINED
      description: |-
        The action to take on mobile devices when a host observes the custom IOC.
        Note: To use this argument, a mobile platform (android or ios) must be included in the platforms argument.
        - no_action: The indicator is saved for future use, but no action is taken (no severity required).
        - allow: The indicator is allowed and not detected (severity does not apply and should not be provided).
        - detect: The connection is allowed and a detection is generated.
        - prevent: The indicator is blocked and shown as a detection.
      name: mobile_action
      predefined:
      - no_action
      - allow
      - detect
      - prevent
    description: Updates an indicator for CrowdStrike to monitor.
    name: cs-falcon-update-custom-ioc
    outputs:
    - contextPath: CrowdStrike.IOC.Type
      description: The type of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Value
      description: The string representation of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.ID
      description: The full ID of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.Severity
      description: The severity level to apply to this indicator.
      type: string
    - contextPath: CrowdStrike.IOC.Source
      description: The source of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Action
      description: Action to take when a host observes the custom IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Expiration
      description: The datetime when the indicator will expire.
      type: string
    - contextPath: CrowdStrike.IOC.Description
      description: The description of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.CreatedTime
      description: The datetime the IOC was created.
      type: date
    - contextPath: CrowdStrike.IOC.CreatedBy
      description: The identity of the user/process who created the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.ModifiedTime
      description: The datetime the indicator was last modified.
      type: date
    - contextPath: CrowdStrike.IOC.ModifiedBy
      description: The identity of the user/process who last updated the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Filename
      description: Name of the file for file indicators. Applies to hashes only. A common filename, or a filename in your environment. Filenames can be helpful for identifying hashes or filtering IOCs.
      type: string
    - contextPath: CrowdStrike.IOC.MobileAction
      description: The action to take on mobile devices when a host observes the custom IOC.
      type: string

  - arguments:
    - description: The ID of the IOC to delete. The ID of the IOC can be retrieved by running the 'cs-falcon-search-custom-iocs' command.
      name: ioc_id
      required: true
    description: Deletes a monitored indicator.
    name: cs-falcon-delete-custom-ioc
  - arguments:
    - auto: PREDEFINED
      description: The IOC type.
      name: type
      predefined:
      - sha256
      - sha1
      - md5
      - domain
      - ipv4
      - ipv6
      required: true
    - description: The string representation of the indicator.
      name: value
      required: true
    description: The number of hosts that observed the provided IOC.
    name: cs-falcon-device-count-ioc
    outputs:
    - contextPath: CrowdStrike.IOC.Type
      description: The type of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Value
      description: The string representation of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.ID
      description: The full ID of the indicator (type:value).
      type: string
    - contextPath: CrowdStrike.IOC.DeviceCount
      description: The number of devices the IOC ran on.
      type: number
  - arguments:
    - auto: PREDEFINED
      description: The IOC type.
      name: type
      predefined:
      - sha256
      - sha1
      - md5
      - domain
      - ipv4
      - ipv6
      required: true
    - description: The string representation of the indicator.
      name: value
      required: true
    - description: The device ID to check against.
      name: device_id
      required: true
    description: Get processes associated with a given IOC.
    name: cs-falcon-processes-ran-on
    outputs:
    - contextPath: CrowdStrike.IOC.Type
      description: The type of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Value
      description: The string representation of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.ID
      description: The full ID of the indicator (type:value).
      type: string
    - contextPath: CrowdStrike.IOC.Process.ID
      description: The processes IDs associated with the given IOC.
      type: number
    - contextPath: CrowdStrike.IOC.Process.DeviceID
      description: The device the process ran on.
      type: number
  - arguments:
    - default: true
      description: A comma-separated list of process IDs.
      isArray: true
      name: ids
      required: true
    description: Retrieves the details of a process, according to the process ID that is running or that previously ran.
    name: cs-falcon-process-details
    outputs:
    - contextPath: CrowdStrike.Process.process_id
      description: The process ID.
      type: String
    - contextPath: CrowdStrike.Process.process_id_local
      description: Local ID of the process.
      type: String
    - contextPath: CrowdStrike.Process.device_id
      description: The device the process ran on.
      type: String
    - contextPath: CrowdStrike.Process.file_name
      description: The path of the file that ran the process.
      type: String
    - contextPath: CrowdStrike.Process.command_line
      description: The command line command execution.
      type: String
    - contextPath: CrowdStrike.Process.start_timestamp_raw
      description: 'The start datetime of the process in Unix time format. For example: 132460167512852140.'
      type: String
    - contextPath: CrowdStrike.Process.start_timestamp
      description: 'The start datetime of the process in ISO time format. For example: 2019-10-17T13:41:48.487520845Z.'
      type: String
    - contextPath: CrowdStrike.Process.stop_timestamp_raw
      description: 'The stop datetime of the process in Unix time format. For example: 132460167512852140.'
      type: Date
    - contextPath: CrowdStrike.Process.stop_timestamp
      description: 'The stop datetime of the process in ISO time format. For example: 2019-10-17T13:41:48.487520845Z.'
      type: Date
  - arguments:
    - auto: PREDEFINED
      description: 'The type of indicator.'
      name: type
      predefined:
      - domain
      - ipv4
      - ipv6
      - md5
      - sha1
      - sha256
      required: true
    - description: The string representation of the indicator.
      name: value
      required: true
    deprecated: true
    description: Returns a list of device IDs an indicator ran on.
    name: cs-device-ran-on
    outputs:
    - contextPath: CrowdStrike.DeviceIOC.DeviceID
      description: The device IDs an indicator ran on.
      type: string
    - contextPath: CrowdStrike.DeviceIOC.ID
      description: The indicator ID.
      type: string
    - contextPath: CrowdStrike.DeviceIOC.Type
      description: The indicator type.
      type: string
    - contextPath: CrowdStrike.DeviceIOC.Value
      description: The indicator value.
      type: string
  - arguments:
    - auto: PREDEFINED
      description: The type of indicator.
      name: type
      predefined:
      - domain
      - ipv4
      - ipv6
      - md5
      - sha1
      - sha256
      required: true
    - description: The string representation of the indicator.
      name: value
      required: true
    description: Returns a list of device IDs an indicator ran on.
    name: cs-falcon-device-ran-on
    outputs:
    - contextPath: CrowdStrike.DeviceID
      description: Device IDs an indicator ran on.
      type: string
  - arguments:
    - description: The query used to filter the results.
      name: fetch_query
    - description: A comma-separated list of detection IDs. For example, ldt:1234:1234,ldt:5678:5678. If you use this argument, the fetch_query argument will be ignored.
      isArray: true
      name: ids
    description: Lists detection summaries.
    name: cs-falcon-list-detection-summaries
    outputs:
    - contextPath: CrowdStrike.Detections.cid
      description: The organization's customer ID (CID).
      type: String
    - contextPath: CrowdStrike.Detections.created_timestamp
      description: 'The datetime the detection occurred in ISO time format. For example: 2019-10-17T13:41:48.487520845Z.'
      type: Date
    - contextPath: CrowdStrike.Detections.detection_id
      description: The ID of the detection.
      type: String
    - contextPath: CrowdStrike.Detections.device.device_id
      description: The device ID as seen by CrowdStrike Falcon.
      type: String
    - contextPath: CrowdStrike.Detections.device.cid
      description: The CrowdStrike Customer ID (CID) to which the device belongs.
      type: String
    - contextPath: CrowdStrike.Detections.device.agent_load_flags
      description: The CrowdStrike Falcon agent load flags.
      type: String
    - contextPath: CrowdStrike.Detections.device.agent_local_time
      description: The local time of the sensor.
      type: Date
    - contextPath: CrowdStrike.Detections.device.agent_version
      description: 'The version of the agent that the device is running. For example: 5.32.11406.0.'
      type: String
    - contextPath: CrowdStrike.Detections.device.bios_manufacturer
      description: The BIOS manufacturer.
      type: String
    - contextPath: CrowdStrike.Detections.device.bios_version
      description: The device's BIOS version.
      type: String
    - contextPath: CrowdStrike.Detections.device.config_id_base
      description: The base of the sensor that the device is running.
      type: String
    - contextPath: CrowdStrike.Detections.device.config_id_build
      description: 'The version of the sensor that the device is running. For example: 11406.'
      type: String
    - contextPath: CrowdStrike.Detections.device.config_id_platform
      description: The platform ID of the sensor that the device is running.
      type: String
    - contextPath: CrowdStrike.Detections.device.external_ip
      description: The external IP address of the device.
      type: String
    - contextPath: CrowdStrike.Detections.device.hostname
      description: The hostname of the device.
      type: String
    - contextPath: CrowdStrike.Detections.device.first_seen
      description: The datetime the host was first seen by CrowdStrike Falcon.
      type: Date
    - contextPath: CrowdStrike.Detections.device.last_seen
      description: The datetime the host was last seen by CrowdStrike Falcon.
      type: Date
    - contextPath: CrowdStrike.Detections.device.local_ip
      description: The local IP address of the device.
      type: String
    - contextPath: CrowdStrike.Detections.device.mac_address
      description: The MAC address of the device.
      type: String
    - contextPath: CrowdStrike.Detections.device.major_version
      description: The major version of the operating system.
      type: String
    - contextPath: CrowdStrike.Detections.device.minor_version
      description: The minor version of the operating system.
      type: String
    - contextPath: CrowdStrike.Detections.device.os_version
      description: The operating system of the device.
      type: String
    - contextPath: CrowdStrike.Detections.device.platform_id
      description: The platform ID of the device that runs the sensor.
      type: String
    - contextPath: CrowdStrike.Detections.device.platform_name
      description: The platform name of the device.
      type: String
    - contextPath: CrowdStrike.Detections.device.product_type_desc
      description: The value indicating the product type. For example, 1 = Workstation, 2 = Domain Controller, 3 = Server.
      type: String
    - contextPath: CrowdStrike.Detections.device.status
      description: 'The containment status of the machine. Possible values are: "normal", "containment_pending", "contained", and "lift_containment_pending".'
      type: String
    - contextPath: CrowdStrike.Detections.device.system_manufacturer
      description: The system manufacturer of the device.
      type: String
    - contextPath: CrowdStrike.Detections.device.system_product_name
      description: The product name of the system.
      type: String
    - contextPath: CrowdStrike.Detections.device.modified_timestamp
      description: 'The datetime the device was last modified in ISO time format. For example: 2019-10-17T13:41:48.487520845Z.'
      type: Date
    - contextPath: CrowdStrike.Detections.behaviors.device_id
      description: The ID of the device associated with the behavior.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.timestamp
      description: 'The datetime the behavior detection occurred in ISO time format. For example: 2019-10-17T13:41:48.487520845Z.'
      type: Date
    - contextPath: CrowdStrike.Detections.behaviors.filename
      description: The filename of the triggering process.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.alleged_filetype
      description: The file extension of the behavior's filename.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.cmdline
      description: The command line of the triggering process.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.scenario
      description: The name of the scenario the behavior belongs to.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.objective
      description: The name of the objective associated with the behavior.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.tactic
      description: The name of the tactic associated with the behavior.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.technique
      description: The name of the technique associated with the behavior.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.severity
      description: The severity rating for the behavior. The value can be any integer between 1-100.
      type: Number
    - contextPath: CrowdStrike.Detections.behaviors.confidence
      description: The true positive confidence rating for the behavior. The value can be any integer between 1-100.
      type: Number
    - contextPath: CrowdStrike.Detections.behaviors.ioc_type
      description: 'The type of the triggering IOC. Possible values are: "hash_sha256", "hash_md5", "domain", "filename", "registry_key", "command_line", and "behavior".'
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.ioc_value
      description: The IOC value.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.user_name
      description: The user name.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.user_id
      description: The Security Identifier (SID) of the user in Windows.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.control_graph_id
      description: The behavior hit key for the Threat Graph API.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.triggering_process_graph_id
      description: The ID of the process that triggered the behavior detection.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.sha256
      description: The SHA256 of the triggering process.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.md5
      description: The MD5 hash of the triggering process.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.parent_details.parent_sha256
      description: The SHA256 hash of the parent process.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.parent_details.parent_md5
      description: The MD5 hash of the parent process.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.parent_details.parent_cmdline
      description: The command line of the parent process.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.parent_details.parent_process_graph_id
      description: The process graph ID of the parent process.
      type: String
    - contextPath: CrowdStrike.Detections.behaviors.pattern_disposition
      description: The pattern associated with the action performed on the behavior.
      type: Number
    - contextPath: CrowdStrike.Detections.behaviors.pattern_disposition_details.indicator
      description: Whether the detection behavior is similar to an indicator.
      type: Boolean
    - contextPath: CrowdStrike.Detections.behaviors.pattern_disposition_details.detect
      description: Whether this behavior is detected.
      type: Boolean
    - contextPath: CrowdStrike.Detections.behaviors.pattern_disposition_details.inddet_mask
      description: Whether this behavior is an inddet mask.
      type: Boolean
    - contextPath: CrowdStrike.Detections.behaviors.pattern_disposition_details.sensor_only
      description: Whether this detection is sensor only.
      type: Boolean
    - contextPath: CrowdStrike.Detections.behaviors.pattern_disposition_details.rooting
      description: Whether this behavior is rooting.
      type: Boolean
    - contextPath: CrowdStrike.Detections.behaviors.pattern_disposition_details.kill_process
      description: Whether this detection kills the process.
      type: Boolean
    - contextPath: CrowdStrike.Detections.behaviors.pattern_disposition_details.kill_subprocess
      description: Whether this detection kills the subprocess.
      type: Boolean
    - contextPath: CrowdStrike.Detections.behaviors.pattern_disposition_details.quarantine_machine
      description: Whether this detection was on a quarantined machine.
      type: Boolean
    - contextPath: CrowdStrike.Detections.behaviors.pattern_disposition_details.quarantine_file
      description: Whether this detection was on a quarantined file.
      type: Boolean
    - contextPath: CrowdStrike.Detections.behaviors.pattern_disposition_details.policy_disabled
      description: Whether this policy is disabled.
      type: Boolean
    - contextPath: CrowdStrike.Detections.behaviors.pattern_disposition_details.kill_parent
      description: Whether this detection kills the parent process.
      type: Boolean
    - contextPath: CrowdStrike.Detections.behaviors.pattern_disposition_details.operation_blocked
      description: Whether the operation is blocked.
      type: Boolean
    - contextPath: CrowdStrike.Detections.behaviors.pattern_disposition_details.process_blocked
      description: Whether the process is blocked.
      type: Boolean
    - contextPath: CrowdStrike.Detections.behaviors.pattern_disposition_details.registry_operation_blocked
      description: Whether the registry operation is blocked.
      type: Boolean
    - contextPath: CrowdStrike.Detections.email_sent
      description: Whether an email is sent about this detection.
      type: Boolean
    - contextPath: CrowdStrike.Detections.show_in_ui
      description: Whether the detection displays in the UI.
      type: Boolean
    - contextPath: CrowdStrike.Detections.status
      description: The status of the detection.
      type: String
    - contextPath: CrowdStrike.Detections.hostinfo.domain
      description: The domain of the Active Directory.
      type: String
    - contextPath: CrowdStrike.Detections.seconds_to_triaged
      description: The amount of time it took to move a detection from "new" to "in_progress".
      type: Number
    - contextPath: CrowdStrike.Detections.seconds_to_resolved
      description: The amount of time it took to move a detection from new to a resolved state ("true_positive", "false_positive", and "ignored").
      type: Number
  - arguments:
    - description: A comma-separated list of case IDs.
      isArray: true
      name: ids
    description: Lists case summaries.
    name: cs-falcon-list-case-summaries
    outputs:
    - contextPath: CrowdStrike.Case.id
      description: The ID of the case.
      type: String
    - contextPath: CrowdStrike.Case.name
      description: The name of the case.
      type: String
    - contextPath: CrowdStrike.Case.created_timestamp
      description: The date and time the case was created.
      type: Date
    - contextPath: CrowdStrike.Case.status
      description: The status of the case.
      type: String
    - contextPath: CrowdStrike.Case.version
      description: The version of the case.
      type: String
    - contextPath: CrowdStrike.Case.description
      description: The description of the case.
      type: String
    - contextPath: CrowdStrike.Case.severity
      description: The severity of the case.
      type: String
    - contextPath: CrowdStrike.Case.assigned_to
      description: The name of the user assigned to the case.
      type: String
    - contextPath: CrowdStrike.Case.tags
      description: The tags of the case.
      type: String
  - arguments:
    - description: The ID of the case to retrieve evidence for.
      name: id
      required: true
    description: Get evidence for a specific case.
    name: cs-falcon-get-evidence-for-case
    outputs:
    - contextPath: CrowdStrike.CaseEvidence.alerts
      description: The alerts associated with the case.
      type: Array
    - contextPath: CrowdStrike.CaseEvidence.events
      description: The events associated with the case.
      type: Array
    - contextPath: CrowdStrike.CaseEvidence.leads
      description: The leads associated with the case.
      type: Array
  - arguments:
    - description: A comma-separated list of tags.
      isArray: true
      name: tags
      required: true
    - description: The ID of the case the tags will be added to.
      name: id
      required: true
    description: Adds tags to the specified case.
    name: cs-falcon-add-case-tag
  - arguments:
    - description: The ID of the case the tags will be deleted from.
      name: id
      required: true
    - description: The tag to delete.
      name: tag
      required: true
    description: Deletes a tag from the specified case.
    name: cs-falcon-delete-case-tag
  - arguments:
    - description: The ID of the case to resolve.
      name: id
      required: true
    - description: The status to set for the case.
      name: status
      auto: PREDEFINED
      predefined:
      - new
      - in_progress
      - closed
      - reopened
    - description: A UUID of a user to assign the case to.
      name: assigned_to_uuid
    - description: A new description for the case.
      name: description
    - description: "Whether to remove case assignment from the current user.\nIf set to true and assigned_to_uuid is not provided, the case becomes unassigned.\nIf set to false and assigned_to_uuid is provided, the case is reassigned to the specified user UUID.\nIf set to true and assigned_to_uuid is provided, the case is reassigned to the specified user UUID.\nIf this field is omitted and assigned_to_uuid is provided, the case is reassigned to the specified user UUID."
      name: remove_user_assignment
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'false'
    - description: The new case severity rating (10-100).
      name: severity
    - description: The unique ID of the template to apply to the case.
      name: template_id
    - description: The new name for the case.
      name: name
    description: Resolves or updates a case.
    name: cs-falcon-resolve-case
  - arguments:
    - description: The endpoint ID.
      name: id
    - default: true
      description: The endpoint IP address.
      name: ip
    - description: The endpoint hostname.
      name: hostname
    description: Returns information about an endpoint. Does not support regex.
    name: endpoint
    outputs:
    - contextPath: Endpoint.Hostname
      description: The endpoint's hostname.
      type: String
    - contextPath: Endpoint.OS
      description: The endpoint's operation system.
      type: String
    - contextPath: Endpoint.IPAddress
      description: The endpoint's IP address.
      type: String
    - contextPath: Endpoint.ID
      description: The endpoint's ID.
      type: String
    - contextPath: Endpoint.Status
      description: The endpoint's status.
      type: String
    - contextPath: Endpoint.IsIsolated
      description: The endpoint's isolation status.
      type: String
    - contextPath: Endpoint.MACAddress
      description: The endpoint's MAC address.
      type: String
    - contextPath: Endpoint.Vendor
      description: The integration name of the endpoint vendor.
      type: String
    - contextPath: Endpoint.OSVersion
      description: The endpoint's operation system version.
      type: String
  - arguments:
    - description: The name of the host.
      name: name
      required: true
    - auto: PREDEFINED
      description: The group type of the group.
      name: group_type
      predefined:
      - static
      - dynamic
      required: true
    - description: The description of the host.
      name: description
    - description: The assignment rule.
      name: assignment_rule
    description: Create a host group.
    name: cs-falcon-create-host-group
    outputs:
    - contextPath: CrowdStrike.HostGroup.id
      description: The ID of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.group_type
      description: The group type of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.name
      description: The name of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.description
      description: The description of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.created_by
      description: The client that created the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.created_timestamp
      description: 'The datetime the host group was created in ISO time format. For example: 2019-10-17T13:41:48.487520845Z.'
      type: Date
    - contextPath: CrowdStrike.HostGroup.modified_by
      description: The client that modified the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.modified_timestamp
      description: 'The datetime the host group was last modified in ISO time format. For example: 2019-10-17T13:41:48.487520845Z.'
      type: Date
  - arguments:
    - description: The query by which to filter the devices that belong to the host group.
      name: filter
    - description: Page offset.
      name: offset
    - default: true
      defaultValue: '50'
      description: Maximum number of results on a page.
      name: limit
      type: string
    description: List the available host groups.
    name: cs-falcon-list-host-groups
    outputs:
    - contextPath: CrowdStrike.HostGroup.id
      description: The ID of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.group_type
      description: The group type of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.name
      description: The name of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.description
      description: The description of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.created_by
      description: The client that created the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.created_timestamp
      description: 'The datetime the host group was created in ISO time format. For example: 2019-10-17T13:41:48.487520845Z.'
      type: Date
    - contextPath: CrowdStrike.HostGroup.modified_by
      description: The client that modified the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.modified_timestamp
      description: 'The datetime the host group was last modified in ISO time format. For example: 2019-10-17T13:41:48.487520845Z.'
      type: Date
  - arguments:
    - description: A comma-separated list of the IDs of the host groups to be deleted.
      isArray: true
      name: host_group_id
      required: true
    description: Deletes the requested host groups.
    name: cs-falcon-delete-host-groups
  - arguments:
    - description: The ID of the host group.
      name: host_group_id
      required: true
    - description: The name of the host group.
      name: name
    - description: The description of the host group.
      name: description
    - description: The assignment rule.
      name: assignment_rule
    description: Updates a host group.
    name: cs-falcon-update-host-group
    outputs:
    - contextPath: CrowdStrike.HostGroup.id
      description: The ID of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.group_type
      description: The group type of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.name
      description: The name of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.description
      description: The description of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.created_by
      description: The client that created the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.created_timestamp
      description: 'The datetime the host group was created in ISO time format. For example: 2019-10-17T13:41:48.487520845Z.'
      type: Date
    - contextPath: CrowdStrike.HostGroup.modified_by
      description: The client that modified the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.modified_timestamp
      description: 'The datetime the host group was last modified in ISO time format. For example: 2019-10-17T13:41:48.487520845Z.'
      type: Date
  - arguments:
    - description: The ID of the host group.
      name: host_group_id
    - description: The query to filter the devices that belong to the host group.
      name: filter
    - description: Page offset.
      name: offset
    - default: true
      defaultValue: '50'
      description: The maximum number of results on a page.
      name: limit
    - description: The property to sort by (e.g., status.desc or hostname.asc).
      name: sort
    description: Gets the list of host group members.
    name: cs-falcon-list-host-group-members
    outputs:
    - contextPath: CrowdStrike.Device.ID
      description: The ID of the device.
      type: String
    - contextPath: CrowdStrike.Device.LocalIP
      description: The local IP address of the device.
      type: String
    - contextPath: CrowdStrike.Device.ExternalIP
      description: The external IP address of the device.
      type: String
    - contextPath: CrowdStrike.Device.Hostname
      description: The hostname of the device.
      type: String
    - contextPath: CrowdStrike.Device.OS
      description: The operating system of the device.
      type: String
    - contextPath: CrowdStrike.Device.MacAddress
      description: The MAC address of the device.
      type: String
    - contextPath: CrowdStrike.Device.FirstSeen
      description: The first time the device was seen.
      type: String
    - contextPath: CrowdStrike.Device.LastSeen
      description: The last time the device was seen.
      type: String
    - contextPath: CrowdStrike.Device.Status
      description: The device status.
      type: String
  - arguments:
    - description: The ID of the host group.
      name: host_group_id
      required: true
    - description: A comma-separated list of host agent IDs to run commands. The list of host agent IDs can be retrieved by running the 'cs-falcon-search-device' command.
      isArray: true
      name: host_ids
      required: true
    description: Add host group members.
    name: cs-falcon-add-host-group-members
    outputs:
    - contextPath: CrowdStrike.HostGroup.id
      description: The ID of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.group_type
      description: The group type of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.name
      description: The name of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.description
      description: The description of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.created_by
      description: The client that created the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.created_timestamp
      description: 'The datetime the host group was created in ISO time format. For example: 2019-10-17T13:41:48.487520845Z.'
      type: Date
    - contextPath: CrowdStrike.HostGroup.modified_by
      description: The client that modified the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.modified_timestamp
      description: 'The datetime the host group was last modified in ISO time format. For example: 2019-10-17T13:41:48.487520845Z.'
      type: Date
  - arguments:
    - description: The ID of the host group.
      name: host_group_id
      required: true
    - description: A comma-separated list of host agent IDs to run commands. The list of host agent IDs can be retrieved by running the 'cs-falcon-search-device' command.
      isArray: true
      name: host_ids
      required: true
    description: Remove host group members.
    name: cs-falcon-remove-host-group-members
    outputs:
    - contextPath: CrowdStrike.HostGroup.id
      description: The ID of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.group_type
      description: The group type of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.name
      description: The name of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.description
      description: The description of the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.created_by
      description: The client that created the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.created_timestamp
      description: 'The datetime the host group was created in ISO time format. For example: 2019-10-17T13:41:48.487520845Z.'
      type: Date
    - contextPath: CrowdStrike.HostGroup.modified_by
      description: The client that modified the host group.
      type: String
    - contextPath: CrowdStrike.HostGroup.modified_timestamp
      description: 'The datetime the host group was last modified in ISO time format. For example: 2019-10-17T13:41:48.487520845Z.'
      type: Date
  - arguments:
    - description: A JSON object with a list of CrowdStrike Falcon indicators to upload.
      isArray: true
      name: multiple_indicators_json
      required: true
    - name: timeout
      description: The amount of time (in seconds) that a request will wait for a client to establish a connection to a remote machine before a timeout occurs.
      defaultValue: "180"
      type: unknown
    description: Uploads a batch of indicators.
    name: cs-falcon-batch-upload-custom-ioc
    outputs:
    - contextPath: CrowdStrike.IOC.Type
      description: The type of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Value
      description: The string representation of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.ID
      description: The full ID of the indicator.
      type: string
    - contextPath: CrowdStrike.IOC.Severity
      description: The severity level to apply to this indicator.
      type: string
    - contextPath: CrowdStrike.IOC.Source
      description: The source of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Action
      description: The action to take when a host observes the custom IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Expiration
      description: The datetime the indicator will expire.
      type: string
    - contextPath: CrowdStrike.IOC.Description
      description: The description of the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.CreatedTime
      description: The datetime the IOC was created.
      type: date
    - contextPath: CrowdStrike.IOC.CreatedBy
      description: The identity of the user/process who created the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.ModifiedTime
      description: The datetime the indicator was last modified.
      type: date
    - contextPath: CrowdStrike.IOC.ModifiedBy
      description: The identity of the user/process who last updated the IOC.
      type: string
    - contextPath: CrowdStrike.IOC.Tags
      description: The tags of the IOC.
      type: Unknown
    - contextPath: CrowdStrike.IOC.Platforms
      description: The platforms of the IOC.
      type: Unknown
    - contextPath: CrowdStrike.IOC.MobileAction
      description: The action to take on mobile devices when a host observes the custom IOC.
      type: string
  - arguments:
    - description: The host ID to kill the given process for.
      name: host_id
      required: true
    - description: A comma-separated list of process IDs to kill.
      isArray: true
      name: process_ids
      required: true
    - description: Whether the command will run against an offline-queued session and be queued for execution when the host comes online.
      name: queue_offline
      defaultValue: false
    - name: timeout
      description: The amount of time (in seconds) that a request will wait for a client to establish a connection to a remote machine before a timeout occurs.
    description: Execute an active responder kill command on a single host.
    name: cs-falcon-rtr-kill-process
    outputs:
    - contextPath: CrowdStrike.Command.kill.ProcessID
      description: The process ID that was killed.
      type: String
    - contextPath: CrowdStrike.Command.kill.Error
      description: The error message raised if the command failed.
      type: String
    - contextPath: CrowdStrike.Command.kill.HostID
      description: The host ID.
      type: String
  - arguments:
    - description: A comma-separated list of the hosts IDs to remove the file for.
      isArray: true
      name: host_ids
      required: true
    - description: The path to a file or a directory to remove.
      name: file_path
      required: true
    - auto: PREDEFINED
      description: The operating system of the hosts given. Since the remove command is different in each operating system, you can choose only one operating system.
      name: os
      predefined:
      - Windows
      - Linux
      - Mac
      required: true
    - description: Whether the command will run against an offline-queued session and be queued for execution when the host comes online.
      name: queue_offline
      defaultValue: false
    - name: timeout
      description: The amount of time (in seconds) that a request will wait for a client to establish a connection to a remote machine before a timeout occurs.
    description: Batch executes an RTR active-responder remove file across the hosts mapped to the given batch ID.
    name: cs-falcon-rtr-remove-file
    outputs:
    - contextPath: CrowdStrike.Command.rm.HostID
      description: The host ID.
      type: String
    - contextPath: CrowdStrike.Command.rm.Error
      description: The error message raised if the command failed.
      type: String
  - arguments:
    - description: The host ID to get the processes list from.
      name: host_id
      required: true
    - description: Whether the command will run against an offline-queued session and be queued for execution when the host comes online.
      name: queue_offline
      defaultValue: false
    - name: timeout
      description: The amount of time (in seconds) that a request will wait for a client to establish a connection to a remote machine before a timeout occurs.
    description: Executes an RTR active-responder ps command to get a list of active processes across the given host.
    name: cs-falcon-rtr-list-processes
    outputs:
    - contextPath: CrowdStrike.Command.ps.Filename
      description: The name of the result file to be returned.
      type: String
  - arguments:
    - description: The host ID to get the network status and protocol statistics list from.
      name: host_id
      required: true
    - description: Whether the command will run against an offline-queued session and be queued for execution when the host comes online.
      name: queue_offline
      defaultValue: false
    - name: timeout
      description: The amount of time (in seconds) that a request will wait for a client to establish a connection to a remote machine before a timeout occurs.
    description: Executes an RTR active-responder netstat command to get a list of network status and protocol statistics across the given host.
    name: cs-falcon-rtr-list-network-stats
    outputs:
    - contextPath: CrowdStrike.Command.netstat.Filename
      description: The name of the result file to be returned.
      type: String
  - arguments:
    - description: A comma-separated list of the host IDs to get the registry keys from.
      isArray: true
      name: host_ids
      required: true
    - description: A comma-separated list of the registry keys, sub-keys, or value to get.
      isArray: true
      name: registry_keys
      required: true
    - description: Whether the command will run against an offline-queued session and be queued for execution when the host comes online.
      name: queue_offline
      defaultValue: false
    - name: timeout
      description: The amount of time (in seconds) that a request will wait for a client to establish a connection to a remote machine before a timeout occurs.
    description: Executes an RTR active-responder read registry keys command across the given hosts. This command is valid only for Windows hosts.
    name: cs-falcon-rtr-read-registry
  - arguments:
    - description: A comma-separated list of the hosts IDs to get the list of scheduled tasks from.
      isArray: true
      name: host_ids
      required: true
    - description: Whether the command will run against an offline-queued session and be queued for execution when the host comes online.
      name: queue_offline
      defaultValue: false
    - name: timeout
      description: The amount of time (in seconds) that a request will wait for a client to establish a connection to a remote machine before a timeout occurs.
    description: Executes an RTR active-responder netstat command to get a list of scheduled tasks across the given host. This command is valid only for Windows hosts.
    name: cs-falcon-rtr-list-scheduled-tasks
  - arguments:
    - description: A comma-separated list of the hosts IDs to get the file from.
      isArray: true
      name: host_ids
      required: true
    - description: The file path of the required file to extract.
      name: file_path
      required: true
    - description: The filename to use for the archive name and the file within the archive.
      name: filename
    - description: Interval between polling. Default is 60 seconds. Must be higher than 10.
      name: interval_in_seconds
    - description: This is an internal argument used for the polling process, not to be used by the user.
      isArray: true
      name: hosts_and_requests_ids
    - description: This is an internal argument used for the polling process, not to be used by the user.
      isArray: true
      name: SHA256
    - description: Whether the command will run against an offline-queued session and be queued for execution when the host comes online.
      name: queue_offline
      defaultValue: false
    - name: timeout
      description: The amount of time (in seconds) that a request will wait for a client to establish a connection to a remote machine before a timeout occurs.
    - name: polling_timeout
      description: Timeout for polling. Default is 600 seconds.
    description: Gets the RTR extracted file contents for the specified file path.
    name: cs-falcon-rtr-retrieve-file
    outputs:
    - contextPath: CrowdStrike.File.FileName
      description: The filename.
      type: String
    - contextPath: CrowdStrike.File.HostID
      description: The host ID.
      type: String
    - contextPath: File.Size
      description: The size of the file.
      type: Number
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Name
      description: The name of the file.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: The entry ID of the file.
      type: String
    - contextPath: File.Info
      description: Information about the file.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: The extension of the file.
      type: String
    polling: true
  - arguments: []
    description: Returns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes. Note that this command is supported in Cortex XSOAR only.
    name: get-mapping-fields
  - arguments:
    - description: The remote incident or detection ID.
      name: id
      required: true
    - defaultValue: '0'
      description: The UTC timestamp in seconds of the last update. The incident or detection is only updated if it was modified after the last update time.
      name: lastUpdate
    description: Gets remote data from a remote incident or detection. This method does not update the current incident or detection, and should be used for debugging purposes only. Note that this command is supported in Cortex XSOAR only.
    name: get-remote-data
  - arguments:
    - description: Date string representing the local time in UTC timestamp in seconds. The incident or detection is only returned if it was modified after the last update time.
      name: lastUpdate
    description: Gets the list of incidents and detections that were modified since the last update time. This method is used for debugging purposes. The get-modified-remote-data command is used as part of the Mirroring feature that was introduced in Cortex XSOAR version 6.1. Note that this command is supported in Cortex XSOAR only.
    name: get-modified-remote-data
  - arguments: []
    description: Updates the remote incident or detection with local incident or detection changes. This method is only used for debugging purposes and will not update the current incident or detection. Note that this command is supported in Cortex XSOAR only.
    name: update-remote-system
  - arguments:
    - description: Limit the vulnerabilities returned to specific properties. Each value must be enclosed in single quotes and placed immediately after the colon with no space. For example, 'filter=status:'open'+cve.id:['CVE-2013-3900','CVE-2021-1675']'.
      name: filter
    - description: A comma-separated list of unique agent identifiers (AIDs) of a sensor.
      name: aid
      isArray: true
    - description: A comma-separated list of unique identifiers for a vulnerability as cataloged in the National Vulnerability Database (NVD). This filter supports multiple values and negation.
      name: cve_id
      isArray: true
    - description: "A comma-separated list of severities of the CVE. The possible values are: CRITICAL, HIGH, MEDIUM, LOW, UNKNOWN, or NONE."
      name: cve_severity
      isArray: true
    - description: A comma-separated list of names of a tag assigned to a host. Retrieve tags from Host Tags APIs.
      name: tags
      isArray: true
    - description: "Status of a vulnerability. This filter supports multiple values and negation. The possible values are: open, closed, reopen, expired."
      name: status
      isArray: true
    - description: "Operating system platform. This filter supports negation. The possible values are: Windows, Mac, Linux."
      name: platform_name
    - description: A comma-separated list of unique system-assigned IDs of a host group. Retrieve the host group ID from Host Group APIs.
      name: host_group
      isArray: true
    - description: A comma-separated list of types of hosts a sensor is running on.
      name: host_type
      isArray: true
    - description: Filter for vulnerabilities based on the number of days since a host last connected to CrowdStrike Falcon. Enter a numeric value from 3 to 45 to indicate the number of days  to look back. For example, last_seen_within:10.
      name: last_seen_within
    - auto: PREDEFINED
      description: Indicates if the vulnerability is suppressed by a suppression rule.
      name: is_suppressed
      isArray: false
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Display remediation information type of data to be returned for each vulnerability entity.
      defaultValue: 'True'
      name: display_remediation_info
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: Whether to return logic information type of data for each vulnerability entity.
      defaultValue: 'True'
      name: display_evaluation_logic_info
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: Whether to return host information type of data for each vulnerability entity.
      name: display_host_info
      defaultValue: 'False'
      predefined:
      - 'True'
      - 'False'
    - description: The maximum number of items to return (1-2500). Use `next_token` to retrieve additional pages.
      defaultValue: '50'
      type: String
      name: limit
    - description: "Pagination cursor from a previous run's `CrowdStrike.VulnerabilityNextToken` output. Provide this value to fetch the next page of vulnerabilities. Expires in 120 seconds."
      name: next_token
    description: Retrieve vulnerability details according to the selected filter. Each request requires at least one filter parameter. Supported with the CrowdStrike Spotlight license.
    name: cs-falcon-spotlight-search-vulnerability
    outputs:
    - contextPath: CrowdStrike.Vulnerability.id
      description: Unique system-assigned ID of the vulnerability.
      type: String
    - contextPath: CrowdStrike.Vulnerability.cid
      description: Unique system-generated customer identifier (CID) of the account.
      type: String
    - contextPath: CrowdStrike.Vulnerability.aid
      description: Unique agent identifier (AID) of the sensor where the vulnerability was found.
      type: String
    - contextPath: CrowdStrike.Vulnerability.created_timestamp
      description: UTC date and time of when the vulnerability was created in Spotlight.
      type: Date
    - contextPath: CrowdStrike.Vulnerability.updated_timestamp
      description: UTC date and time of the last update made on the vulnerability.
      type: Date
    - contextPath: CrowdStrike.Vulnerability.status
      description: "Vulnerability's current status. Possible values are: open, closed, reopen, or expired."
      type: String
    - contextPath: CrowdStrike.Vulnerability.apps.product_name_version
      description: Name and version of the product associated with the vulnerability.
      type: String
    - contextPath: CrowdStrike.Vulnerability.apps.sub_status
      description: "Status of each product associated with the vulnerability. Possible values are: open, closed, or reopen."
      type: String
    - contextPath: CrowdStrike.Vulnerability.apps.remediation.ids
      description: Remediation ID of each product associated with the vulnerability.
      type: String
    - contextPath: CrowdStrike.Vulnerability.host_info.hostname
      description: Name of the machine.
      type: String
    - contextPath: CrowdStrike.Vulnerability.host_info.instance_id
      description: Cloud instance ID of the host.
      type: String
    - contextPath: CrowdStrike.Vulnerability.host_info.service_provider_account_id
      description: Cloud service provider account ID for the host.
      type: String
    - contextPath: CrowdStrike.Vulnerability.host_info.service_provider
      description: Cloud service provider for the host.
      type: String
    - contextPath: CrowdStrike.Vulnerability.host_info.os_build
      description: Operating system build.
      type: String
    - contextPath: CrowdStrike.Vulnerability.host_info.product_type_desc
      description: Type of host a sensor is running on.
      type: String
    - contextPath: CrowdStrike.Vulnerability.host_info.local_ip
      description: Device's local IP address.
      type: String
    - contextPath: CrowdStrike.Vulnerability.host_info.machine_domain
      description: Active directory domain name.
      type: String
    - contextPath: CrowdStrike.Vulnerability.host_info.os_version
      description: Operating system version.
      type: String
    - contextPath: CrowdStrike.Vulnerability.host_info.ou
      description: Active directory organizational unit name.
      type: String
    - contextPath: CrowdStrike.Vulnerability.host_info.site_name
      description: Active directory site name.
      type: String
    - contextPath: CrowdStrike.Vulnerability.host_info.system_manufacturer
      description: Name of the system manufacturer.
      type: String
    - contextPath: CrowdStrike.Vulnerability.host_info.groups.id
      description: Array of host group IDs that the host is assigned to.
      type: String
    - contextPath: CrowdStrike.Vulnerability.host_info.groups.name
      description: Array of host group names that the host is assigned to.
      type: String
    - contextPath: CrowdStrike.Vulnerability.host_info.tags
      description: Name of a tag assigned to a host.
      type: String
    - contextPath: CrowdStrike.Vulnerability.host_info.platform
      description: Operating system platform. This filter supports negation.
      type: String
    - contextPath: CrowdStrike.Vulnerability.remediation.entities.id
      description: Unique ID of the remediation.
      type: String
    - contextPath: CrowdStrike.Vulnerability.remediation.entities.reference
      description: Relevant reference for the remediation that can be used to get additional details for the remediation.
      type: String
    - contextPath: CrowdStrike.Vulnerability.remediation.entities.title
      description: Short description of the remediation.
      type: String
    - contextPath: CrowdStrike.Vulnerability.remediation.entities.action
      description: Expanded description of the remediation.
      type: String
    - contextPath: CrowdStrike.Vulnerability.remediation.entities.link
      description: Link to the remediation page for the vendor. In certain cases, this field is null.
      type: String
    - contextPath: CrowdStrike.Vulnerability.cve.id
      description: Unique identifier for a vulnerability as cataloged in the National Vulnerability Database (NVD).
      type: String
    - contextPath: CrowdStrike.Vulnerability.cve.base_score
      description: Base score of the CVE (float value between 1 and 10).
      type: Number
    - contextPath: CrowdStrike.Vulnerability.cve.severity
      description: CVSS severity rating of the vulnerability.
      type: String
    - contextPath: CrowdStrike.Vulnerability.cve.exploit_status
      description: Numeric value of the most severe known exploit.
      type: Number
    - contextPath: CrowdStrike.Vulnerability.cve.exprt_rating
      description: ExPRT rating assigned by CrowdStrike's predictive AI rating system.
      type: String
    - contextPath: CrowdStrike.Vulnerability.cve.description
      description: Brief description of the CVE.
      type: String
    - contextPath: CrowdStrike.Vulnerability.cve.published_date
      description: UTC timestamp with the date and time of when the vendor published the CVE.
      type: Date
    - contextPath: CrowdStrike.Vulnerability.cve.vendor_advisory
      description: Link to the vendor page where the CVE was disclosed.
      type: String
    - contextPath: CrowdStrike.Vulnerability.cve.exploitability_score
      description: Exploitability score of the CVE (float values from 1-4).
      type: Number
    - contextPath: CrowdStrike.Vulnerability.cve.impact_score
      description: Impact score of the CVE (float values from 1-6).
      type: Number
    - contextPath: CrowdStrike.Vulnerability.cve.vector
      description: Textual representation of the metric values used to score the vulnerability.
      type: String
    - contextPath: CrowdStrike.Vulnerability.cve.remediation_level
      description: CVSS remediation level of the vulnerability (U = Unavailable, or O = Official fix).
      type: String
    - contextPath: CrowdStrike.Vulnerability.cve.cisa_info.is_cisa_kev
      description: Whether to filter for vulnerabilities that are in the CISA Known Exploited Vulnerabilities (KEV) catalog.
      type: Boolean
    - contextPath: CrowdStrike.Vulnerability.cve.cisa_info.due_date
      description: Date before which CISA mandates subject organizations to patch the vulnerability.
      type: Date
    - contextPath: CrowdStrike.Vulnerability.cve.spotlight_published_date
      description: UTC timestamp with the date and time Spotlight enabled coverage for the vulnerability.
      type: Date
    - contextPath: CrowdStrike.Vulnerability.cve.actors
      description: Adversaries associated with the vulnerability.
      type: String
    - contextPath: CrowdStrike.Vulnerability.cve.name
      description: The vulnerability name.
      type: String
    - contextPath: CrowdStrike.VulnerabilityNextToken
      description: "Pagination cursor returned by CrowdStrike when more results are available. Pass this value back as the `next_token` argument on the next invocation. Absent when no more pages exist. Expires in 120 seconds."
      type: String
  - arguments:
    - description: Deprecated. Use cve instead.
      name: cve_id
      isArray: true
      deprecated: true
    - description: Unique identifier for a vulnerability as cataloged in the National Vulnerability Database (NVD). This filter supports multiple values and negation.
      name: cve
      isArray: true
      default: true
    description: Retrieve vulnerability details according to the selected filter. Each request requires at least one filter parameter. Supported with the CrowdStrike Spotlight license.
    name: cve
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
  - arguments:
    - description: Maximum number of items to return (1-5000).
      defaultValue: '50'
      name: limit
    - description: Unique identifier for a vulnerability as cataloged in the National Vulnerability Database (NVD). This filter supports multiple values and negation.
      name: cve_ids
      isArray: true
      required: true
    description: Retrieve vulnerability details for a specific ID and host. Supported with the CrowdStrike Spotlight license.
    name: cs-falcon-spotlight-list-host-by-vulnerability
    outputs:
    - contextPath: CrowdStrike.VulnerabilityHost.id
      description: Unique system-assigned ID of the vulnerability.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.cid
      description: Unique system-generated customer identifier (CID) of the account.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.aid
      description: Unique agent identifier (AID) of the sensor where the vulnerability was found.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.created_timestamp
      description: UTC date and time of when the vulnerability was created in Spotlight.
      type: Date
    - contextPath: CrowdStrike.VulnerabilityHost.updated_timestamp
      description: UTC date and time of the last update made on the vulnerability.
      type: Date
    - contextPath: CrowdStrike.VulnerabilityHost.status
      description: "Vulnerability's current status. Possible values are: open, closed, reopen, or expired."
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.apps.product_name_version
      description: Name and version of the product associated with the vulnerability.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.apps.sub_status
      description: "Status of each product associated with the vulnerability. Possible values are: open, closed, or reopen."
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.apps.remediation.ids
      description: Remediation ID of each product associated with the vulnerability.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.apps.evaluation_logic.id
      description: Unique system-assigned ID of the vulnerability evaluation logic.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.suppression_info.is_suppressed
      description: Indicates if the vulnerability is suppressed by a suppression rule.
      type: Boolean
    - contextPath: CrowdStrike.VulnerabilityHost.host_info.hostname
      description: Name of the machine.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.host_info.local_ip
      description: Device's local IP address.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.host_info.machine_domain
      description: Active directory domain name.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.host_info.os_version
      description: Operating system version.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.host_info.ou
      description: Active directory organizational unit name.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.host_info.site_name
      description: Active directory site name.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.host_info.system_manufacturer
      description: Name of the system manufacturer.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.host_info.platform
      description: Operating system platform. This filter supports negation.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.host_info.instance_id
      description: Cloud instance ID of the host.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.host_info.service_provider_account_id
      description: Cloud service provider account ID for the host.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.host_info.service_provider
      description: Cloud service provider for the host.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.host_info.os_build
      description: Operating system build.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.host_info.product_type_desc
      description: Type of host a sensor is running on.
      type: String
    - contextPath: CrowdStrike.VulnerabilityHost.cve.id
      description: Unique identifier for a vulnerability as cataloged in the National Vulnerability Database (NVD).
      type: String
  - arguments:
    - description: Value to match for exclusion.
      name: value
      required: true
    - description: "A comma-separated list from where to exclude the exclusion. Possible values are: blocking, extraction."
      name: excluded_from
      required: true
      isArray: true
    - description: Comment describing why the exclusions were created.
      name: comment
    - description: A comma-separated list of group ID(s) impacted by the exclusion OR all if empty.
      name: groups
      isArray: true
    description: Create an ML exclusion.
    name: cs-falcon-create-ml-exclusion
    outputs:
    - contextPath: CrowdStrike.MLExclusion.id
      description: The ML exclusion ID.
      type: String
    - contextPath: CrowdStrike.MLExclusion.value
      description: The ML exclusion value.
      type: String
    - contextPath: CrowdStrike.MLExclusion.regexp_value
      description: A regular expression for matching the excluded value.
      type: String
    - contextPath: CrowdStrike.MLExclusion.value_hash
      description: An hash of the value field.
      type: String
    - contextPath: CrowdStrike.MLExclusion.excluded_from
      description: What the exclusion applies to (e.g., a specific ML model).
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.id
      description: Group ID that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.group_type
      description: Group type that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.name
      description: Group name that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.description
      description: Group description that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.assignment_rule
      description: Group assignment rule that the exclusion is associated with.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.created_by
      description: Indicate who created the group.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.created_timestamp
      description: The date when the group was created.
      type: Date
    - contextPath: CrowdStrike.MLExclusion.groups.modified_by
      description: Indicate who last modified the group.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.modified_timestamp
      description: The date when the group was last modified.
      type: Date
    - contextPath: CrowdStrike.MLExclusion.applied_globally
      description: Whether the exclusion rule applies globally or only to specific entities.
      type: Boolean
    - contextPath: CrowdStrike.MLExclusion.last_modified
      description: The date when the exclusion rule was last modified.
      type: Date
    - contextPath: CrowdStrike.MLExclusion.modified_by
      description: Indicate who last modified the rule.
      type: String
    - contextPath: CrowdStrike.MLExclusion.created_on
      description: The date when the exclusion rule was created.
      type: Date
    - contextPath: CrowdStrike.MLExclusion.created_by
      description: Indicate who created the rule.
      type: String
  - arguments:
    - description: The ID of the exclusion to update.
      name: id
      required: true
    - description: Value to match for the exclusion (the exclusion pattern).
      name: value
    - description: Comment describing why the exclusions were created.
      name: comment
    - description: A comma-separated list of group ID(s) impacted by the exclusion.
      name: groups
      isArray: true
    description: Updates an ML exclusion. At least one argument is required in addition to the id argument.
    name: cs-falcon-update-ml-exclusion
    outputs:
    - contextPath: CrowdStrike.MLExclusion.id
      description: The ML exclusion ID.
      type: String
    - contextPath: CrowdStrike.MLExclusion.value
      description: The ML exclusion value.
      type: String
    - contextPath: CrowdStrike.MLExclusion.regexp_value
      description: A regular expression for matching the excluded value.
      type: String
    - contextPath: CrowdStrike.MLExclusion.value_hash
      description: A hash of the value field.
      type: String
    - contextPath: CrowdStrike.MLExclusion.excluded_from
      description: What the exclusion applies to (e.g., a specific ML model).
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.id
      description: Group ID that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.group_type
      description: Group type that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.name
      description: Group name that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.description
      description: Group description that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.assignment_rule
      description: Group assignment rule that the exclusion is associated with.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.created_by
      description: Indicate who created the group.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.created_timestamp
      description: The date when the group was created.
      type: Date
    - contextPath: CrowdStrike.MLExclusion.groups.modified_by
      description: Indicate who last modified the group.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.modified_timestamp
      description: The date when the group was last modified.
      type: Date
    - contextPath: CrowdStrike.MLExclusion.applied_globally
      description: Whether the exclusion rule applies globally or only to specific entities.
      type: Boolean
    - contextPath: CrowdStrike.MLExclusion.last_modified
      description: The date when the exclusion rule was last modified.
      type: Date
    - contextPath: CrowdStrike.MLExclusion.modified_by
      description: Indicate who last modified the rule.
      type: String
    - contextPath: CrowdStrike.MLExclusion.created_on
      description: The date when the exclusion rule was created.
      type: Date
    - contextPath: CrowdStrike.MLExclusion.created_by
      description: Indicate who created the rule.
      type: String
  - arguments:
    - description: A comma-separated list of exclusion IDs to delete.
      name: ids
      required: true
      isArray: true
    description: Delete the ML exclusions by ID.
    name: cs-falcon-delete-ml-exclusion
  - arguments:
    - description: "A custom filter by which the exclusions should be filtered.\n The syntax follows the pattern `<property>:[operator]'<value>'`. For example: value:'test'.\n Available filters: applied_globally, created_by, created_on, last_modified, modified_by, value.\n For more information, see: https://falcon.crowdstrike.com/documentation/page/d3c84a1b/falcon-query-language-fql."
      name: filter
    - description: The value by which the exclusions should be filtered.
      name: value
    - description: A comma-separated list of exclusion IDs to retrieve. The IDs overwrite the filter and value.
      name: ids
      isArray: true
    - description: The maximum number of records to return. [1-500]. Applies only if the ids argument is not supplied.
      name: limit
    - description: The offset to start retrieving records from. Applies only if the ids argument is not supplied.
      name: offset
    - auto: PREDEFINED
      description: How to sort the retrieved exclusions.
      name: sort
      predefined:
      - applied_globally.asc
      - applied_globally.desc
      - created_by.asc
      - created_by.desc
      - created_on.asc
      - created_on.desc
      - last_modified.asc
      - last_modified.desc
      - modified_by.asc
      - modified_by.desc
      - value.asc
      - value.desc
    description: Get a list of ML exclusions by specifying their IDs, value, or a specific filter.
    name: cs-falcon-search-ml-exclusion
    outputs:
    - contextPath: CrowdStrike.MLExclusion.id
      description: The ML exclusion ID.
      type: String
    - contextPath: CrowdStrike.MLExclusion.value
      description: The ML exclusion value.
      type: String
    - contextPath: CrowdStrike.MLExclusion.regexp_value
      description: A regular expression for matching the excluded value.
      type: String
    - contextPath: CrowdStrike.MLExclusion.value_hash
      description: A hash of the value field.
      type: String
    - contextPath: CrowdStrike.MLExclusion.excluded_from
      description: What the exclusion applies to (e.g., a specific ML model).
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.id
      description: Group ID that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.group_type
      description: Group type that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.name
      description: Group name that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.description
      description: Group description that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.assignment_rule
      description: Group assignment rule that the exclusion is associated with.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.created_by
      description: Indicate who created the group.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.created_timestamp
      description: The date when the group was created.
      type: Date
    - contextPath: CrowdStrike.MLExclusion.groups.modified_by
      description: Indicate who last modified the group.
      type: String
    - contextPath: CrowdStrike.MLExclusion.groups.modified_timestamp
      description: The date when the group was last modified.
      type: Date
    - contextPath: CrowdStrike.MLExclusion.applied_globally
      description: Whether the exclusion rule applies globally or only to specific entities.
      type: Boolean
    - contextPath: CrowdStrike.MLExclusion.last_modified
      description: The date when the exclusion rule was last modified.
      type: Date
    - contextPath: CrowdStrike.MLExclusion.modified_by
      description: Indicate who last modified the rule.
      type: String
    - contextPath: CrowdStrike.MLExclusion.created_on
      description: The date when the exclusion rule was created.
      type: Date
    - contextPath: CrowdStrike.MLExclusion.created_by
      description: Indicate who created the rule.
      type: String
  - arguments:
    - description: Name of the exclusion.
      name: exclusion_name
      required: true
    - description: Name of the exclusion pattern.
      name: pattern_name
    - description: ID of the exclusion pattern.
      name: pattern_id
      required: true
    - description: Command line regular expression.
      name: cl_regex
      required: true
    - description: Image filename regular expression.
      name: ifn_regex
      required: true
    - description: Comment describing why the exclusions were created.
      name: comment
    - description: Exclusion description.
      name: description
    - description: JSON formatted detection template.
      name: detection_json
    - description: A comma-separated list of group ID(s) impacted by the exclusion OR all if empty.
      name: groups
      required: true
      isArray: true
    description: Create an IOA exclusion.
    name: cs-falcon-create-ioa-exclusion
    outputs:
    - contextPath: CrowdStrike.IOAExclusion.id
      description: A unique identifier for the IOA exclusion.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.name
      description: The name of the IOA exclusion.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.description
      description: A description of the IOA exclusion.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.pattern_id
      description: The identifier of the pattern associated with the IOA exclusion.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.pattern_name
      description: The name of the pattern associated with the IOA exclusion.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.ifn_regex
      description: A regular expression used for filename matching.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.cl_regex
      description: A regular expression used for command line matching.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.detection_json
      description: A JSON string that describes the detection logic for the IOA exclusion.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.id
      description: Group ID that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.group_type
      description: Group type that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.name
      description: Group name that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.description
      description: Group description that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.assignment_rule
      description: Group assignment rule that the exclusion is associated with.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.created_by
      description: Indicate who created the group.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.created_timestamp
      description: The date when the group was created.
      type: Date
    - contextPath: CrowdStrike.IOAExclusion.groups.modified_by
      description: Indicate who last modified the group.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.modified_timestamp
      description: The date when the group was last modified.
      type: Date
    - contextPath: CrowdStrike.IOAExclusion.applied_globally
      description: Whether the exclusion rule applies globally or only to specific entities.
      type: Boolean
    - contextPath: CrowdStrike.IOAExclusion.last_modified
      description: The date when the exclusion rule was last modified.
      type: Date
    - contextPath: CrowdStrike.IOAExclusion.modified_by
      description: Indicate who last modified the rule.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.created_on
      description: The date when the exclusion rule was created.
      type: Date
    - contextPath: CrowdStrike.IOAExclusion.created_by
      description: Indicate who created the rule.
      type: String
  - arguments:
    - description: ID of the exclusion to update.
      name: id
      required: true
    - description: Name of the exclusion.
      name: exclusion_name
    - description: ID of the exclusion pattern to update.
      name: pattern_id
    - description: Name of the exclusion pattern.
      name: pattern_name
    - description: Command line regular expression.
      name: cl_regex
    - description: Image filename regular expression.
      name: ifn_regex
    - description: Comment describing why the exclusions was created.
      name: comment
    - description: Exclusion description.
      name: description
    - description: JSON formatted detection template.
      name: detection_json
    - description: A comma-separated list of group ID(s) impacted by the exclusion.
      name: groups
      isArray: true
    description: Updates an IOA exclusion. At least one argument is required in addition to the id argument.
    name: cs-falcon-update-ioa-exclusion
    outputs:
    - contextPath: CrowdStrike.IOAExclusion.id
      description: A unique identifier for the IOA exclusion.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.name
      description: The name of the IOA exclusion.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.description
      description: A description of the IOA exclusion.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.pattern_id
      description: The identifier of the pattern associated with the IOA exclusion.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.pattern_name
      description: The name of the pattern associated with the IOA exclusion.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.ifn_regex
      description: A regular expression used for filename matching.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.cl_regex
      description: A regular expression used for command line matching.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.detection_json
      description: A JSON string that describes the detection logic for the IOA exclusion.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.id
      description: Group ID that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.group_type
      description: Group type that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.name
      description: Group name that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.description
      description: Group description that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.assignment_rule
      description: Group assignment rule that the exclusion is associated with.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.created_by
      description: Indicate who created the group.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.created_timestamp
      description: The date when the group was created.
      type: Date
    - contextPath: CrowdStrike.IOAExclusion.groups.modified_by
      description: Indicate who last modified the group.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.modified_timestamp
      description: The date when the group was last modified.
      type: Date
    - contextPath: CrowdStrike.IOAExclusion.applied_globally
      description: Whether the exclusion rule applies globally or only to specific entities.
      type: Boolean
    - contextPath: CrowdStrike.IOAExclusion.last_modified
      description: The date when the exclusion rule was last modified.
      type: Date
    - contextPath: CrowdStrike.IOAExclusion.modified_by
      description: Indicate who last modified the rule.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.created_on
      description: The date when the exclusion rule was created.
      type: Date
    - contextPath: CrowdStrike.IOAExclusion.created_by
      description: Indicate who created the rule.
      type: String
  - arguments:
    - description: A comma-separated list of exclusion IDs to delete.
      name: ids
      required: true
      isArray: true
    description: Delete the IOA exclusions by ID.
    name: cs-falcon-delete-ioa-exclusion
  - arguments:
    - description: "A custom filter by which the exclusions should be filtered.\n The syntax follows the pattern `<property>:[operator]'<value>'`. For example: name:'test'.\n Available filters: applied_globally, created_by, created_on, name, last_modified, modified_by, value, pattern.\n For more information, see: https://www.falconpy.io/Service-Collections/Falcon-Query-Language."
      name: filter
    - description: The name by which the exclusions should be filtered.
      name: name
    - description: A comma-separated list of exclusion IDs to retrieve. The IDs overwrite the filter and name.
      name: ids
      isArray: true
    - description: The limit of how many exclusions to retrieve. Default is 50. Applies only if the ids argument is not supplied.
      name: limit
    - description: The offset of how many exclusions to skip. Default is 0. Applies only if the ids argument is not supplied.
      name: offset
    description: Get a list of IOA exclusions by specifying their IDs or a filter.
    name: cs-falcon-search-ioa-exclusion
    outputs:
    - contextPath: CrowdStrike.IOAExclusion.id
      description: A unique identifier for the IOA exclusion.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.name
      description: The name of the IOA exclusion.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.description
      description: A description of the IOA exclusion.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.pattern_id
      description: The identifier of the pattern associated with the IOA exclusion.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.pattern_name
      description: The name of the pattern associated with the IOA exclusion.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.ifn_regex
      description: A regular expression used for filename matching.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.cl_regex
      description: A regular expression used for command line matching.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.detection_json
      description: A JSON string that describes the detection logic for the IOA exclusion.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.id
      description: Group ID that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.group_type
      description: Group type that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.name
      description: Group name that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.description
      description: Group description that the exclusion rule is associated with.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.assignment_rule
      description: Group assignment rule that the exclusion is associated with.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.created_by
      description: Indicate who created the group.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.created_timestamp
      description: The date when the group was created.
      type: Date
    - contextPath: CrowdStrike.IOAExclusion.groups.modified_by
      description: Indicate who last modified the group.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.groups.modified_timestamp
      description: The date when the group was last modified.
      type: Date
    - contextPath: CrowdStrike.IOAExclusion.applied_globally
      description: Whether the exclusion rule applies globally or only to specific entities.
      type: Boolean
    - contextPath: CrowdStrike.IOAExclusion.last_modified
      description: The date when the exclusion rule was last modified.
      type: Date
    - contextPath: CrowdStrike.IOAExclusion.modified_by
      description: Indicate who last modified the rule.
      type: String
    - contextPath: CrowdStrike.IOAExclusion.created_on
      description: The date when the exclusion rule was created.
      type: Date
    - contextPath: CrowdStrike.IOAExclusion.created_by
      description: Indicate who created the rule.
      type: String
  - arguments:
    - description: A comma-separated list of quarantined file IDs to retrieve.
      name: ids
      isArray: true
    - description: A custom filter by which the retrieved quarantined file should be filtered.
      name: filter
    - description: A comma-separated list of SHA256 hash of the files to retrieve.
      name: sha256
      isArray: true
    - description: A comma-separated list of the name of the files to retrieve.
      name: filename
      isArray: true
    - description: Filter the retrieved files by state.
      name: state
    - description: A comma-separated list of the hostnames of the files to retrieve.
      name: hostname
      isArray: true
    - description: A comma-separated list of the usernames of the files to retrieve.
      name: username
      isArray: true
    - description: Maximum number of IDs to return. Max 5000. Default 50.
      name: limit
    - description: Starting index of the overall result set from which to return IDs. Default 0.
      name: offset
    description: Get quarantine file metadata by specified IDs or filter.
    name: cs-falcon-list-quarantined-file
    outputs:
    - contextPath: CrowdStrike.QuarantinedFile.id
      description: A unique identifier for the quarantined file.
      type: String
    - contextPath: CrowdStrike.QuarantinedFile.aid
      description: The agent identifier of the agent that quarantined the file.
      type: String
    - contextPath: CrowdStrike.QuarantinedFile.cid
      description: The unique customer identifier of the agent that quarantined the file.
      type: String
    - contextPath: CrowdStrike.QuarantinedFile.sha256
      description: The SHA256 hash value of the quarantined file.
      type: String
    - contextPath: CrowdStrike.QuarantinedFile.paths.path
      description: The full path of the quarantined file.
      type: String
    - contextPath: CrowdStrike.QuarantinedFile.paths.filename
      description: The name of the quarantined file.
      type: String
    - contextPath: CrowdStrike.QuarantinedFile.paths.state
      description: The current state of the quarantined file path (e.g., "purged").
      type: String
    - contextPath: CrowdStrike.QuarantinedFile.state
      description: The current state of the quarantined file (e.g., "unrelease_pending").
      type: String
    - contextPath: CrowdStrike.QuarantinedFile.detect_ids
      description: The detection identifiers associated with the quarantined file.
      type: String
    - contextPath: CrowdStrike.QuarantinedFile.hostname
      description: The hostname of the agent that quarantined the file.
      type: String
    - contextPath: CrowdStrike.QuarantinedFile.username
      description: The username associated with the quarantined file.
      type: String
    - contextPath: CrowdStrike.QuarantinedFile.date_updated
      description: The date the quarantined file was last updated.
      type: Date
    - contextPath: CrowdStrike.QuarantinedFile.date_created
      description: The date the quarantined file was created.
      type: Date
  - arguments:
    - description: A comma-separated list of quarantined file IDs to update.
      name: ids
      isArray: true
    - auto: PREDEFINED
      description: Action to perform against the quarantined file.
      name: action
      required: true
      predefined:
      - delete
      - release
      - unrelease
    - description: Comment to appear along with the action taken.
      name: comment
      required: true
    - description: Update files based on a custom filter.
      name: filter
    - description: A comma-separated list of quarantined SHA256 files to update.
      name: sha256
      isArray: true
    - description: A comma-separated list of quarantined filenames to update.
      name: filename
      isArray: true
    - description: Update files based on the state.
      name: state
    - description: A comma-separated list of quarantined file hostnames to update.
      name: hostname
      isArray: true
    - description: A comma-separated list of quarantined file usernames to update.
      name: username
      isArray: true
    description: Apply action to quarantined files by file IDs or filter.
    name: cs-falcon-apply-quarantine-file-action
  - arguments:
    - description: Whether to poll for results.
      auto: PREDEFINED
      name: wait_for_result
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
      hidden: true
    - description: Valid CS-Falcon-FQL filter to query with.
      name: filter
    - description: Comma-separated list of scan IDs to retrieve details about. If set, will override all other arguments.
      isArray: true
      name: ids
    - description: Comma-separated list of scan initiation sources to filter by.
      isArray: true
      name: initiated_from
    - description: Comma-separated list of scan statuses to filter by.
      isArray: true
      name: status
    - description: Comma-separated list of scan severities to filter by.
      isArray: true
      name: severity
    - description: UTC-format of the scan start time to filter by.
      name: scan_started_on
    - description: UTC-format of the scan completion time to filter by.
      name: scan_completed_on
    - description: Starting index of overall result set from which to return IDs.
      name: offset
    - description: Maximum number of resources to return.
      name: limit
    - description: The interval in seconds between each poll.
      name: interval_in_seconds
      defaultValue: '30'
      hidden: true
    - description: The timeout in seconds until polling ends.
      name: timeout_in_seconds
      defaultValue: '600'
      hidden: true
    - name: hide_polling_output
      hidden: true
      description: Whether to hide the polling message and only print the final status at the end (automatically filled by polling. Can be used for testing purposes).
      defaultValue: true
    description: Retrieve ODS scan details.
    name: cs-falcon-ods-query-scan
    polling: true
    outputs:
    - contextPath: CrowdStrike.ODSScan.id
      description: A unique identifier for the scan event.
      type: String
    - contextPath: CrowdStrike.ODSScan.cid
      description: A unique identifier for the client that triggered the scan.
      type: String
    - contextPath: CrowdStrike.ODSScan.profile_id
      description: A unique identifier for the scan profile used in the scan.
      type: String
    - contextPath: CrowdStrike.ODSScan.description
      description: The ID of the description of the scan.
      type: String
    - contextPath: CrowdStrike.ODSScan.scan_inclusions
      description: The files or folders included in the scan.
      type: String
    - contextPath: CrowdStrike.ODSScan.initiated_from
      description: The source of the scan initiation.
      type: String
    - contextPath: CrowdStrike.ODSScan.quarantine
      description: Whether the scan was set to quarantine.
      type: Boolean
    - contextPath: CrowdStrike.ODSScan.cpu_priority
      description: The CPU priority for the scan (1-5).
      type: Number
    - contextPath: CrowdStrike.ODSScan.preemption_priority
      description: The preemption priority for the scan.
      type: Number
    - contextPath: CrowdStrike.ODSScan.metadata.host_id
      description: A unique identifier for the host that was scanned.
      type: String
    - contextPath: CrowdStrike.ODSScan.metadata.host_scan_id
      description: A unique identifier for the scan that was performed on the host.
      type: String
    - contextPath: CrowdStrike.ODSScan.metadata.scan_host_metadata_id
      description: A unique identifier for the metadata associated with the host scan.
      type: String
    - contextPath: CrowdStrike.ODSScan.metadata.filecount.scanned
      description: The number of files that were scanned.
      type: Number
    - contextPath: CrowdStrike.ODSScan.metadata.filecount.malicious
      description: The number of files that were identified as malicious.
      type: Number
    - contextPath: CrowdStrike.ODSScan.metadata.filecount.quarantined
      description: The number of files that were quarantined.
      type: Number
    - contextPath: CrowdStrike.ODSScan.metadata.filecount.skipped
      description: The number of files that were skipped during the scan.
      type: Number
    - contextPath: CrowdStrike.ODSScan.metadata.filecount.traversed
      description: The number of files that were traversed during the scan.
      type: Number
    - contextPath: CrowdStrike.ODSScan.metadata.status
      description: The status of the scan on this host. (e.g., "pending", "running", "completed", or "failed").
      type: String
    - contextPath: CrowdStrike.ODSScan.metadata.started_on
      description: The date and time that the scan started.
      type: Date
    - contextPath: CrowdStrike.ODSScan.metadata.completed_on
      description: The date and time that the scan completed.
      type: Date
    - contextPath: CrowdStrike.ODSScan.metadata.last_updated
      description: The date and time that the metadata was last updated.
      type: Date
    - contextPath: CrowdStrike.ODSScan.status
      description: The status of the scan (e.g., "pending", "running", "completed", or "failed").
      type: String
    - contextPath: CrowdStrike.ODSScan.hosts
      description: A list of the host IDs that were scanned.
      type: String
    - contextPath: CrowdStrike.ODSScan.endpoint_notification
      description: Indicates whether endpoint notifications are enabled.
      type: Boolean
    - contextPath: CrowdStrike.ODSScan.pause_duration
      description: The number of hours to pause between scanning each file.
      type: Number
    - contextPath: CrowdStrike.ODSScan.max_duration
      description: The maximum amount of time to allow for the scan job in hours.
      type: Number
    - contextPath: CrowdStrike.ODSScan.max_file_size
      description: The maximum file size (in MB) to scan.
      type: Number
    - contextPath: CrowdStrike.ODSScan.sensor_ml_level_detection
      description: The level of detection sensitivity for the local sensor machine learning model.
      type: Number
    - contextPath: CrowdStrike.ODSScan.sensor_ml_level_prevention
      description: The level of prevention sensitivity for the local sensor machine learning model.
      type: Number
    - contextPath: CrowdStrike.ODSScan.cloud_ml_level_detection
      description: The level of detection sensitivity for the cloud machine learning model.
      type: Number
    - contextPath: CrowdStrike.ODSScan.cloud_ml_level_prevention
      description: The level of prevention sensitivity for the cloud machine learning model.
      type: Number
    - contextPath: CrowdStrike.ODSScan.policy_setting
      description: A list of policy setting IDs for the scan job (these correspond to specific policy settings in the Falcon console).
      type: Number
    - contextPath: CrowdStrike.ODSScan.scan_started_on
      description: The timestamp when the scan was started.
      type: Date
    - contextPath: CrowdStrike.ODSScan.scan_completed_on
      description: The timestamp when the scan was completed.
      type: Date
    - contextPath: CrowdStrike.ODSScan.created_on
      description: The timestamp when the scan was created.
      type: Date
    - contextPath: CrowdStrike.ODSScan.created_by
      description: The ID of the user who created the scan job.
      type: String
    - contextPath: CrowdStrike.ODSScan.last_updated
      description: The timestamp when the scan job was last updated.
      type: Date
  - arguments:
    - description: Valid CS-Falcon-FQL filter to query with.
      name: filter
    - description: Comma-separated list of scan IDs to retrieve details about. If set, will override all other arguments.
      isArray: true
      name: ids
    - description: Comma-separated list of scan initiation sources to filter by.
      isArray: true
      name: initiated_from
    - description: Comma-separated list of scan statuses to filter by.
      isArray: true
      name: status
    - description: UTC-format of the scan creation time to filter by.
      name: created_on
    - description: UTC-format time of the scan creator to filter by.
      name: created_by
    - description: UTC-format of scan start time to filter by.
      name: start_timestamp
    - description: Deleted scans only.
      name: deleted
    - description: Starting index of overall result set from which to return IDs.
      name: offset
    - description: Maximum number of resources to return.
      name: limit
    description: Retrieve ODS scheduled scan details.
    name: cs-falcon-ods-query-scheduled-scan
    outputs:
    - contextPath: CrowdStrike.ODSScheduledScan.id
      description: Unique identifier for the scan.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.cid
      description: Identifier for the customer or organization that owns the scan.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.description
      description: The ID of the description of the scan.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.file_paths
      description: The file or folder paths scanned.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.scan_exclusions
      description: The file or folder exclusions from the scan.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.initiated_from
      description: The source of the scan initiation.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.cpu_priority
      description: The CPU priority for the scan (1-5).
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.preemption_priority
      description: The preemption priority for the scan.
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.status
      description: The status of the scan, whether it's "scheduled", "running", "completed", etc.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.host_groups
      description: The host groups targeted by the scan.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.endpoint_notification
      description: Whether notifications of the scan were sent to endpoints.
      type: Boolean
    - contextPath: CrowdStrike.ODSScheduledScan.pause_duration
      description: The pause duration of the scan in hours.
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.max_duration
      description: The maximum duration of the scan in hours.
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.max_file_size
      description: The maximum file size that the scan can handle in MB.
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.sensor_ml_level_detection
      description: The machine learning detection level for the sensor.
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.cloud_ml_level_detection
      description: The machine learning detection level for the cloud.
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.schedule.start_timestamp
      description: The timestamp when the first scan was created.
      type: Date
    - contextPath: CrowdStrike.ODSScheduledScan.schedule.interval
      description: The interval between scans.
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.created_on
      description: The timestamp when the scan was created.
      type: Date
    - contextPath: CrowdStrike.ODSScheduledScan.created_by
      description: The user who created the scan.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.last_updated
      description: The timestamp when the scan was last updated.
      type: Date
    - contextPath: CrowdStrike.ODSScheduledScan.deleted
      description: Whether the scan was deleted.
      type: Boolean
    - contextPath: CrowdStrike.ODSScheduledScan.quarantine
      description: Whether the scan was set to quarantine.
      type: Boolean
    - contextPath: CrowdStrike.ODSScheduledScan.metadata.host_id
      description: Scan host IDs.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.metadata.last_updated
      description: The date and time when the detection event was last updated.
      type: Date
    - contextPath: CrowdStrike.ODSScheduledScan.sensor_ml_level_prevention
      description: The machine learning prevention level for the sensor.
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.cloud_ml_level_prevention
      description: The machine learning prevention level for the cloud.
      type: Number
  - arguments:
    - description: Valid CS-Falcon-FQL filter to query with.
      name: filter
    - description: Comma-separated list of host IDs to filter by.
      isArray: true
      name: host_ids
    - description: Comma-separated list of scan IDs to filter by.
      isArray: true
      name: scan_ids
    - description: Comma-separated list of scan statuses to filter by.
      isArray: true
      name: status
    - description: UTC-format of scan start time to filter by.
      name: started_on
    - description: UTC-format of scan completion time to filter by.
      name: completed_on
    - description: Starting index of the overall result set from which to return IDs.
      name: offset
    - description: Maximum number of resources to return.
      name: limit
    description: Retrieve ODS scan host details.
    name: cs-falcon-ods-query-scan-host
    outputs:
    - contextPath: CrowdStrike.ODSScanHost.id
      description: A unique identifier for the scan event.
      type: String
    - contextPath: CrowdStrike.ODSScanHost.cid
      description: A unique identifier for the client that triggered the scan.
      type: String
    - contextPath: CrowdStrike.ODSScanHost.scan_id
      description: A unique identifier for the scan.
      type: String
    - contextPath: CrowdStrike.ODSScanHost.profile_id
      description: A unique identifier for the scan profile used in the scan.
      type: String
    - contextPath: CrowdStrike.ODSScanHost.host_id
      description: A unique identifier for the host that was scanned.
      type: String
    - contextPath: CrowdStrike.ODSScanHost.host_scan_id
      description: A unique identifier for the scan that was performed on the host.
      type: String
    - contextPath: CrowdStrike.ODSScanHost.filecount.scanned
      description: The number of files that were scanned during the scan.
      type: Number
    - contextPath: CrowdStrike.ODSScanHost.filecount.malicious
      description: The number of files that were detected as malicious during the scan.
      type: Number
    - contextPath: CrowdStrike.ODSScanHost.filecount.quarantined
      description: The number of files that were quarantined during the scan.
      type: Number
    - contextPath: CrowdStrike.ODSScanHost.filecount.skipped
      description: The number of files that were skipped during the scan.
      type: Number
    - contextPath: CrowdStrike.ODSScanHost.status
      description: The status of the scan. (e.g., "completed", "pending", "cancelled", "running", or "failed").
      type: String
    - contextPath: CrowdStrike.ODSScanHost.severity
      description: A severity score assigned to the scan, ranging from 0 to 100.
      type: Number
    - contextPath: CrowdStrike.ODSScanHost.started_on
      description: The date and time when the scan started.
      type: Date
    - contextPath: CrowdStrike.ODSScanHost.completed_on
      description: The date and time when the scan completed.
      type: Date
    - contextPath: CrowdStrike.ODSScanHost.last_updated
      description: The date and time when the scan event was last updated.
      type: Date
  - arguments:
    - description: Valid CS-Falcon-FQL filter to query with.
      name: filter
    - description: Comma-separated list of malicious file IDs to retrieve details about. If set, will override all other arguments.
      isArray: true
      name: file_ids
    - description: Comma-separated list of host IDs to filter by.
      isArray: true
      name: host_ids
    - description: Comma-separated list of scan IDs to filter by.
      isArray: true
      name: scan_ids
    - description: Comma-separated list of file paths to filter by.
      isArray: true
      name: file_paths
    - description: Comma-separated list of filenames to filter by.
      isArray: true
      name: file_names
    - description: Comma-separated list of hashes to filter by.
      isArray: true
      name: hash
    - description: Starting index of the overall result set from which to return IDs.
      name: offset
    - description: Maximum number of resources to return.
      name: limit
    description: Retrieve ODS malicious file details.
    name: cs-falcon-ods-query-malicious-files
    outputs:
    - contextPath: CrowdStrike.ODSMaliciousFile.id
      description: A unique identifier of the detection event.
      type: String
    - contextPath: CrowdStrike.ODSMaliciousFile.cid
      description: A unique identifier for the client that triggered the detection event.
      type: String
    - contextPath: CrowdStrike.ODSMaliciousFile.scan_id
      description: A unique identifier for the scan that triggered the detection event.
      type: String
    - contextPath: CrowdStrike.ODSMaliciousFile.host_id
      description: A unique identifier for the host that was scanned.
      type: String
    - contextPath: CrowdStrike.ODSMaliciousFile.host_scan_id
      description: A unique identifier for the scan that detected the file on the host.
      type: String
    - contextPath: CrowdStrike.ODSMaliciousFile.filepath
      description: The full path to the malicious file on the host system.
      type: String
    - contextPath: CrowdStrike.ODSMaliciousFile.filename
      description: The name of the malicious file.
      type: String
    - contextPath: CrowdStrike.ODSMaliciousFile.hash
      description: A SHA256 hash of the malicious file, which can be used to identify it.
      type: String
    - contextPath: CrowdStrike.ODSMaliciousFile.pattern_id
      description: The identifier of the pattern used to detect the malicious file.
      type: Number
    - contextPath: CrowdStrike.ODSMaliciousFile.severity
      description: A severity score assigned to the detection event, ranging from 0 to 100.
      type: Number
    - contextPath: CrowdStrike.ODSMaliciousFile.quarantined
      description: Indicates whether the file was quarantined.
      type: Boolean
    - contextPath: CrowdStrike.ODSMaliciousFile.last_updated
      description: The date and time when the detection event was last updated.
      type: Date
  - arguments:
    - description: A comma-separated list of hosts to be scanned. "hosts" OR "host_groups" must be set.
      isArray: true
      name: hosts
    - description: A comma-separated list of host groups to be scanned. "hosts" OR "host_groups" must be set.
      isArray: true
      name: host_groups
    - description: A comma-separated list of file paths to be scanned. "file_paths" OR "scan_inclusions" must be set.
      isArray: true
      name: file_paths
    - description: A comma-separated list of included files or locations for this scan. "file_paths" OR "scan_inclusions" must be set.
      isArray: true
      name: scan_inclusions
    - description: A comma-separated list of excluded files or locations for this scan.
      isArray: true
      name: scan_exclusions
    - description: Scan origin.
      name: initiated_from
    - description: The scan CPU priority.
      name: cpu_priority
      auto: PREDEFINED
      defaultValue: Low
      predefined:
      - Highest
      - High
      - Medium
      - Low
      - Lowest
    - description: Scan description.
      name: description
    - description: Flag indicating if identified threats should be quarantined.
      name: quarantine
    - description: Amount of time (in hours) for scan pauses.
      name: pause_duration
      defaultValue: '2'
    - description: Sensor ML detection level.
      name: sensor_ml_level_detection
    - description: Sensor ML prevention level.
      name: sensor_ml_level_prevention
    - description: Cloud ML detection level for the scan.
      name: cloud_ml_level_detection
    - description: Cloud ML prevention level for the scan.
      name: cloud_ml_level_prevention
    - description: Maximum time (in hours) the scan is allowed to execute.
      name: max_duration
      defaultValue: '2'
    - description: The interval in seconds between each poll.
      name: interval_in_seconds
      defaultValue: '30'
    - description: The timeout in seconds until polling ends.
      name: timeout_in_seconds
      defaultValue: '600'
    - name: cloud_pup_adware_level_detection
      required: false
      description: 'Potentially unwanted programs (PUPs) adware detection level. Possible values are 0–4 (0 = Disabled). If not specified, CrowdStrike applies the default behavior (Disabled).'
      auto: PREDEFINED
      predefined:
      - '0'
      - '1'
      - '2'
      - '3'
      - '4'
    - name: cloud_pup_adware_level_prevention
      required: false
      description: 'Potentially unwanted programs (PUPs) adware prevention level. Possible values are 0–4 (0 = Disabled). If not specified, CrowdStrike applies the default behavior (Disabled).'
      auto: PREDEFINED
      predefined:
      - '0'
      - '1'
      - '2'
      - '3'
      - '4'
    - name: polling
      description: Whether to use polling to wait for the scan result. If set to false, the command will only create the scan and return immediately without waiting for results.
      defaultValue: 'true'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    description: Create an ODS scan and wait for the results.
    name: cs-falcon-ods-create-scan
    polling: true
    outputs:
    - contextPath: CrowdStrike.ODSScan.id
      description: A unique identifier for the scan event.
      type: String
    - contextPath: CrowdStrike.ODSScan.cid
      description: A unique identifier for the client that triggered the scan.
      type: String
    - contextPath: CrowdStrike.ODSScan.profile_id
      description: A unique identifier for the scan profile used in the scan.
      type: String
    - contextPath: CrowdStrike.ODSScan.description
      description: The ID of the description of the scan.
      type: String
    - contextPath: CrowdStrike.ODSScan.scan_inclusions
      description: The files or folders included in the scan.
      type: String
    - contextPath: CrowdStrike.ODSScan.initiated_from
      description: The source of the scan initiation.
      type: String
    - contextPath: CrowdStrike.ODSScan.quarantine
      description: Whether the scan was set to quarantine.
      type: Boolean
    - contextPath: CrowdStrike.ODSScan.cpu_priority
      description: The CPU priority for the scan (1-5).
      type: Number
    - contextPath: CrowdStrike.ODSScan.preemption_priority
      description: The preemption priority for the scan.
      type: Number
    - contextPath: CrowdStrike.ODSScan.metadata.host_id
      description: A unique identifier for the host that was scanned.
      type: String
    - contextPath: CrowdStrike.ODSScan.metadata.host_scan_id
      description: A unique identifier for the scan that was performed on the host.
      type: String
    - contextPath: CrowdStrike.ODSScan.metadata.scan_host_metadata_id
      description: A unique identifier for the metadata associated with the host scan.
      type: String
    - contextPath: CrowdStrike.ODSScan.metadata.filecount.scanned
      description: The number of files that were scanned.
      type: Number
    - contextPath: CrowdStrike.ODSScan.metadata.filecount.malicious
      description: The number of files that were identified as malicious.
      type: Number
    - contextPath: CrowdStrike.ODSScan.metadata.filecount.quarantined
      description: The number of files that were quarantined.
      type: Number
    - contextPath: CrowdStrike.ODSScan.metadata.filecount.skipped
      description: The number of files that were skipped during the scan.
      type: Number
    - contextPath: CrowdStrike.ODSScan.metadata.filecount.traversed
      description: The number of files that were traversed during the scan.
      type: Number
    - contextPath: CrowdStrike.ODSScan.metadata.status
      description: The status of the scan on this host (e.g., "pending", "running", "completed", or "failed").
      type: String
    - contextPath: CrowdStrike.ODSScan.metadata.started_on
      description: The date and time that the scan started.
      type: Date
    - contextPath: CrowdStrike.ODSScan.metadata.completed_on
      description: The date and time that the scan completed.
      type: Date
    - contextPath: CrowdStrike.ODSScan.metadata.last_updated
      description: The date and time that the metadata was last updated.
      type: Date
    - contextPath: CrowdStrike.ODSScan.status
      description: The status of the scan (e.g., "pending", "running", "completed", or "failed").
      type: String
    - contextPath: CrowdStrike.ODSScan.hosts
      description: A list of the host IDs that were scanned.
      type: String
    - contextPath: CrowdStrike.ODSScan.endpoint_notification
      description: Indicates whether endpoint notifications are enabled.
      type: Boolean
    - contextPath: CrowdStrike.ODSScan.pause_duration
      description: The number of hours to pause between scanning each file.
      type: Number
    - contextPath: CrowdStrike.ODSScan.max_duration
      description: The maximum amount of time to allow for the scan job in hours.
      type: Number
    - contextPath: CrowdStrike.ODSScan.max_file_size
      description: The maximum file size (in MB) to scan.
      type: Number
    - contextPath: CrowdStrike.ODSScan.sensor_ml_level_detection
      description: The level of detection sensitivity for the local sensor machine learning model.
      type: Number
    - contextPath: CrowdStrike.ODSScan.sensor_ml_level_prevention
      description: The level of prevention sensitivity for the local sensor machine learning model.
      type: Number
    - contextPath: CrowdStrike.ODSScan.cloud_ml_level_detection
      description: The level of detection sensitivity for the cloud machine learning model.
      type: Number
    - contextPath: CrowdStrike.ODSScan.cloud_ml_level_prevention
      description: The level of prevention sensitivity for the cloud machine learning model.
      type: Number
    - contextPath: CrowdStrike.ODSScan.policy_setting
      description: A list of policy setting IDs for the scan job (these correspond to specific policy settings in the Falcon console).
      type: Number
    - contextPath: CrowdStrike.ODSScan.scan_started_on
      description: The timestamp when the scan was started.
      type: Date
    - contextPath: CrowdStrike.ODSScan.scan_completed_on
      description: The timestamp when the scan was completed.
      type: Date
    - contextPath: CrowdStrike.ODSScan.created_on
      description: The timestamp when the scan was created.
      type: Date
    - contextPath: CrowdStrike.ODSScan.created_by
      description: The ID of the user who created the scan job.
      type: String
    - contextPath: CrowdStrike.ODSScan.last_updated
      description: The timestamp when the scan job was last updated.
      type: Date
    - contextPath: CrowdStrike.ODSScan.cloud_pup_adware_level_detection
      description: Potentially unwanted programs (PUPs) Adware detection level.
      type: Number
    - contextPath: CrowdStrike.ODSScan.cloud_pup_adware_level_prevention
      description: Potentially unwanted programs (PUPs) Adware prevention level.
      type: Number
  - arguments:
    - description: A comma-separated list of host groups to be scanned.
      isArray: true
      name: host_groups
      required: true
    - description: A comma-separated list of file paths to be scanned. "file_paths" OR "scan_inclusions" must be set.
      isArray: true
      name: file_paths
    - description: A comma-separated list of included files or locations for this scan. "file_paths" OR "scan_inclusions" must be set.
      isArray: true
      name: scan_inclusions
    - description: A comma-separated list of excluded files or locations for this scan.
      isArray: true
      name: scan_exclusions
    - description: Scan origin.
      name: initiated_from
    - description: The scan CPU priority.
      name: cpu_priority
      auto: PREDEFINED
      defaultValue: Low
      predefined:
      - Highest
      - High
      - Medium
      - Low
      - Lowest
    - description: Scan description.
      name: description
    - description: Flag indicating if identified threats should be quarantined.
      name: quarantine
    - description: Amount of time (in hours) for scan pauses.
      name: pause_duration
      defaultValue: '2'
    - description: Sensor ML detection level.
      name: sensor_ml_level_detection
    - description: Sensor ML prevention level.
      name: sensor_ml_level_prevention
    - description: Cloud ML detection level for the scan.
      name: cloud_ml_level_detection
    - description: Cloud ML prevention level for the scan.
      name: cloud_ml_level_prevention
    - description: Maximum time (in hours) the scan is allowed to execute.
      name: max_duration
      defaultValue: '2'
    - description: When to start the first scan. Supports english expressions such as "tomorrow" or "in an hour".
      name: schedule_start_timestamp
      required: true
    - description: The schedule interval.
      name: schedule_interval
      required: true
      auto: PREDEFINED
      predefined:
      - Never
      - Daily
      - Weekly
      - Every other week
      - Every four weeks
      - Monthly
    - name: cloud_pup_adware_level_detection
      required: false
      description: 'Potentially unwanted programs (PUPs) adware detection level. Possible values are 0–4 (0 = Disabled). If not specified, CrowdStrike applies the default behavior (Disabled).'
      auto: PREDEFINED
      predefined:
      - '0'
      - '1'
      - '2'
      - '3'
      - '4'
    - name: cloud_pup_adware_level_prevention
      required: false
      description: 'Potentially unwanted programs (PUPs) adware prevention level. Possible values are 0–4 (0 = Disabled). If not specified, CrowdStrike applies the default behavior (Disabled).'
      auto: PREDEFINED
      predefined:
      - '0'
      - '1'
      - '2'
      - '3'
      - '4'
    description: Create an ODS scheduled scan.
    name: cs-falcon-ods-create-scheduled-scan
    outputs:
    - contextPath: CrowdStrike.ODSScheduledScan.id
      description: Unique identifier for the scan.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.cid
      description: Identifier for the customer or organization that owns the scan.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.description
      description: The ID of the description of the scan.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.file_paths
      description: The file or folder paths scanned.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.scan_exclusions
      description: The file or folder exclusions from the scan.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.initiated_from
      description: The source of the scan initiation.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.cpu_priority
      description: The CPU priority for the scan (1-5).
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.preemption_priority
      description: The preemption priority for the scan.
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.status
      description: The status of the scan, whether it's "scheduled", "running", "completed", etc.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.host_groups
      description: The host groups targeted by the scan.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.endpoint_notification
      description: Whether notifications of the scan were sent to endpoints.
      type: Boolean
    - contextPath: CrowdStrike.ODSScheduledScan.pause_duration
      description: The pause duration of the scan in hours.
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.max_duration
      description: The maximum duration of the scan in hours.
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.max_file_size
      description: The maximum file size that the scan can handle in MB.
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.sensor_ml_level_detection
      description: The machine learning detection level for the sensor.
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.cloud_ml_level_detection
      description: The machine learning detection level for the cloud.
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.schedule.start_timestamp
      description: The timestamp when the first scan was created.
      type: Date
    - contextPath: CrowdStrike.ODSScheduledScan.schedule.interval
      description: The interval between scans.
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.created_on
      description: The timestamp when the scan was created.
      type: Date
    - contextPath: CrowdStrike.ODSScheduledScan.created_by
      description: The user who created the scan.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.last_updated
      description: The timestamp when the scan was last updated.
      type: Date
    - contextPath: CrowdStrike.ODSScheduledScan.deleted
      description: Whether the scan was deleted.
      type: Boolean
    - contextPath: CrowdStrike.ODSScheduledScan.quarantine
      description: Whether the scan was set to quarantine.
      type: Boolean
    - contextPath: CrowdStrike.ODSScheduledScan.metadata.host_id
      description: Scan host IDs.
      type: String
    - contextPath: CrowdStrike.ODSScheduledScan.metadata.last_updated
      description: The date and time when the detection event was last updated.
      type: Date
    - contextPath: CrowdStrike.ODSScheduledScan.sensor_ml_level_prevention
      description: The machine learning prevention level for the sensor.
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.cloud_ml_level_prevention
      description: The machine learning prevention level for the cloud.
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.cloud_pup_adware_level_detection
      description: Potentially unwanted programs (PUPs) Adware detection level.
      type: Number
    - contextPath: CrowdStrike.ODSScheduledScan.cloud_pup_adware_level_prevention
      description: Potentially unwanted programs (PUPs) Adware prevention level.
      type: Number
  - arguments:
    - description: Comma-separated list of scheduled scan IDs to delete.
      isArray: true
      name: ids
    - description: Valid CS-Falcon-FQL filter to delete scans by.
      name: filter
    description: Delete ODS scheduled scans.
    name: cs-falcon-ods-delete-scheduled-scan
    outputs: []
  - arguments:
    - description: API type.
      name: type
      required: true
      predefined:
      - 'USER'
      - 'ENDPOINT'
      auto: PREDEFINED
    - description: The key to sort by.
      name: sort_key
      predefined:
      - RISK_SCORE
      - PRIMARY_DISPLAY_NAME
      - SECONDARY_DISPLAY_NAME
      - MOST_RECENT_ACTIVITY
      - ENTITY_ID
      auto: PREDEFINED
    - description: The sort order.
      name: sort_order
      predefined:
      - 'DESCENDING'
      - 'ASCENDING'
      auto: PREDEFINED
      defaultValue: ASCENDING
    - description: A comma-separated list of entity IDs to look for.
      name: entity_id
      isArray: true
    - description: A comma-separated list of primary display names to filter by.
      name: primary_display_name
      isArray: true
    - description: A comma-separated list of secondary display names to filter by.
      name: secondary_display_name
      isArray: true
    - description: The maximum risk score severity to filter by.
      name: max_risk_score_severity
      predefined:
      - 'NORMAL'
      - 'MEDIUM'
      - 'HIGH'
      auto: PREDEFINED
    - description: The minimum risk score severity to filter by.
      name: min_risk_score_severity
      predefined:
      - 'NORMAL'
      - 'MEDIUM'
      - 'HIGH'
      auto: PREDEFINED
    - description: Whether to get only enabled or disabled identity entities.
      name: enabled
      predefined:
      - 'true'
      - 'false'
      auto: PREDEFINED
    - description: Email to filter by.
      name: email
    - description: The hash for the next page.
      name: next_token
    - description: The maximum number of items to fetch per page. The maximum value allowed is 1000.
      name: page_size
      defaultValue: 50
    - description: The page number. Default is 1.
      name: page
    - description: The maximum number of identity entities to list.
      name: limit
    description: List identity entities.
    name: cs-falcon-list-identity-entities
    outputs:
    - contextPath: CrowdStrike.IDPEntity.Ishuman
      description: Whether the identity entity is human made.
      type: Boolean
    - contextPath: CrowdStrike.IDPEntity.Isprogrammatic
      description: Whether the identity entity is programmatic made.
      type: Boolean
    - contextPath: CrowdStrike.IDPEntity.Isadmin
      description: Whether the identity entity is admin made.
      type: String
    - contextPath: CrowdStrike.IDPEntity.Primarydisplayname
      description: The identity entity primary display name.
      type: String
    - contextPath: CrowdStrike.IDPEntity.Riskfactors.Type
      description: The identity entity risk factor type.
      type: Unknown
    - contextPath: CrowdStrike.IDPEntity.Riskfactors.Severity
      description: The identity entity risk factor severity.
      type: Unknown
    - contextPath: CrowdStrike.IDPEntity.Riskscore
      description: The identity entity risk score.
      type: Number
    - contextPath: CrowdStrike.IDPEntity.Riskscoreseverity
      description: The identity entity risk score severity.
      type: String
    - contextPath: CrowdStrike.IDPEntity.Secondarydisplayname
      description: The identity entity secondary display name.
      type: String
    - contextPath: CrowdStrike.IDPEntity.Emailaddresses
      description: The identity entity email address.
      type: String
  - arguments:
    - description: Comma-separated list of policy IDs to look for.
      name: policy_ids
      isArray: true
      required: true
    description: Given a CSV list of policy IDs, returns detailed policy information.
    name: cs-falcon-cspm-list-policy-details
    outputs:
    - contextPath: CrowdStrike.CSPMPolicy.ID
      description: The policy ID.
      type: Integer
    - contextPath: CrowdStrike.CSPMPolicy.CreatedAt
      description: The creation date.
      type: Date
    - contextPath: CrowdStrike.CSPMPolicy.UpdatedAt
      description: The update date.
      type: Date
    - contextPath: CrowdStrike.CSPMPolicy.DeletedAt
      description: The deletion date.
      type: Date
    - contextPath: CrowdStrike.CSPMPolicy.description
      description: The policy description.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.policy_statement
      description: The policy statement.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.policy_remediation
      description: The policy remediation.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.cloud_service_subtype
      description: The cloud service subtype.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.cloud_document
      description: The cloud document.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.mitre_attack_cloud_matrix
      description: URL to the MITRE attack tactics.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.mitre_attack_cloud_subtype
      description: URL to the MITRE attack techniques.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.alert_logic
      description: The alert logic.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.api_command
      description: The API command.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.cli_command
      description: The CLI command.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.cloud_platform_type
      description: The cloud platform type.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.cloud_service_type
      description: The cloud service type.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.default_severity
      description: The default severity.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.cis_benchmark_ids
      description: The CIS benchmark IDs.
      type: Array
    - contextPath: CrowdStrike.CSPMPolicy.nist_benchmark_ids
      description: The NIST benchmark IDs.
      type: Array
    - contextPath: CrowdStrike.CSPMPolicy.pci_benchmark_ids
      description: The PCI benchmark IDs.
      type: Array
    - contextPath: CrowdStrike.CSPMPolicy.policy_type
      description: The policy type.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.tactic_url
      description: The tactic URL.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.technique_url
      description: The technique URL.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.tactic
      description: The tactic used.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.technique
      description: The technique used.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.tactic_id
      description: The tactic ID.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.technique_id
      description: The technique ID.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.attack_types
      description: The attack types.
      type: Array
    - contextPath: CrowdStrike.CSPMPolicy.asset_type_id
      description: The asset type ID.
      type: Integer
    - contextPath: CrowdStrike.CSPMPolicy.cloud_asset_type
      description: The cloud asset type.
      type: String
    - contextPath: CrowdStrike.CSPMPolicy.is_remediable
      description: Whether the policy is remediable or not.
      type: Boolean
    - contextPath: CrowdStrike.CSPMPolicy.is_enabled
      description: Whether the policy is enabled or not.
      type: Boolean
    - contextPath: CrowdStrike.CSPMPolicy.account_scope
      description: The account scope.
      type: String
  - arguments:
    - description: The policy ID.
      name: policy_id
    - description: The cloud provider.
      name: cloud_platform
      defaultValue: 'aws'
      predefined:
      - 'aws'
      - 'gcp'
      - 'azure'
      auto: PREDEFINED
    - description: Service type to filter by.
      name: service
    - description: The maximum number of entities to list.
      name: limit
      defaultValue: 50
    description: Returns information about current policy settings.
    name: cs-falcon-cspm-list-service-policy-settings
    outputs:
    - contextPath: CrowdStrike.CSPMPolicySetting.is_remediable
      description: Whether the policy setting is remediable or not.
      type: Boolean
    - contextPath: CrowdStrike.CSPMPolicySetting.created_at
      description: The creation date.
      type: String
    - contextPath: CrowdStrike.CSPMPolicySetting.updated_at
      description: The update date.
      type: String
    - contextPath: CrowdStrike.CSPMPolicySetting.policy_id
      description: The policy ID.
      type: Integer
    - contextPath: CrowdStrike.CSPMPolicySetting.name
      description: The policy setting name.
      type: String
    - contextPath: CrowdStrike.CSPMPolicySetting.policy_type
      description: The policy type.
      type: String
    - contextPath: CrowdStrike.CSPMPolicySetting.cloud_service_subtype
      description: The cloud service subtype.
      type: String
    - contextPath: CrowdStrike.CSPMPolicySetting.cloud_service
      description: The cloud service.
      type: String
    - contextPath: CrowdStrike.CSPMPolicySetting.cloud_service_friendly
      description: The cloud friendly service.
      type: String
    - contextPath: CrowdStrike.CSPMPolicySetting.cloud_asset_type
      description: The cloud asset type.
      type: String
    - contextPath: CrowdStrike.CSPMPolicySetting.cloud_asset_type_id
      description: The cloud asset type ID.
      type: Integer
    - contextPath: CrowdStrike.CSPMPolicySetting.cloud_provider
      description: The cloud provider.
      type: String
    - contextPath: CrowdStrike.CSPMPolicySetting.default_severity
      description: The default severity.
      type: String
    - contextPath: CrowdStrike.CSPMPolicySetting.policy_timestamp
      description: The policy timestamp.
      type: Date
    - contextPath: CrowdStrike.CSPMPolicySetting.policy_settings
      description: An array that holds policy settings.
      type: Array
    - contextPath: CrowdStrike.CSPMPolicySetting.policy_settings.account_id
      description: The account ID correlated to the policy.
      type: String
    - contextPath: CrowdStrike.CSPMPolicySetting.policy_settings.regions
      description: The regions in which the policy is configured.
      type: Array
    - contextPath: CrowdStrike.CSPMPolicySetting.policy_settings.severity
      description: The severity of the policy.
      type: String
    - contextPath: CrowdStrike.CSPMPolicySetting.policy_settings.enabled
      description: Whether the policy settings are enabled or not.
      type: Boolean
    - contextPath: CrowdStrike.CSPMPolicySetting.policy_settings.tag_excluded
      description: Whether the tag is excluded or not.
      type: Boolean
    - contextPath: CrowdStrike.CSPMPolicySetting.cis_benchmark
      description: An array of CIS benchmark details.
      type: Array
    - contextPath: CrowdStrike.CSPMPolicySetting.cis_benchmark.id
      description: The CIS benchmark ID.
      type: Integer
    - contextPath: CrowdStrike.CSPMPolicySetting.cis_benchmark.benchmark_short
      description: The CIS benchmark shortname.
      type: String
    - contextPath: CrowdStrike.CSPMPolicySetting.cis_benchmark.recommendation_number
      description: The CIS benchmark recommendation number.
      type: String
    - contextPath: CrowdStrike.CSPMPolicySetting.pci_benchmark
      description: An array of PCI benchmark details.
      type: Array
    - contextPath: CrowdStrike.CSPMPolicySetting.pci_benchmark.id
      description: The PCI benchmark ID.
      type: Integer
    - contextPath: CrowdStrike.CSPMPolicySetting.pci_benchmark.benchmark_short
      description: The PCI benchmark shortname.
      type: String
    - contextPath: CrowdStrike.CSPMPolicySetting.pci_benchmark.recommendation_number
      description: The PCI benchmark recommendation number.
      type: String
    - contextPath: CrowdStrike.CSPMPolicySetting.nist_benchmark
      description: An array of NIST benchmark details.
      type: Array
    - contextPath: CrowdStrike.CSPMPolicySetting.nist_benchmark.id
      description: The NIST benchmark ID.
      type: Integer
    - contextPath: CrowdStrike.CSPMPolicySetting.nist_benchmark.benchmark_short
      description: The NIST benchmark shortname.
      type: String
    - contextPath: CrowdStrike.CSPMPolicySetting.nist_benchmark.recommendation_number
      description: The NIST benchmark recommendation number.
      type: String
    - contextPath: CrowdStrike.CSPMPolicySetting.attack_types
      description: The attack types.
      type: Array
  - arguments:
    - description: Policy ID to be updated.
      name: policy_id
      required: true
    - description: Cloud account ID to impact.
      name: account_id
    - description: Flag indicating if this policy is enabled.
      name: enabled
      defaultValue: 'true'
      predefined:
      - 'false'
      - 'true'
      auto: PREDEFINED
    - description: A comma-separated list of regions where this policy is enforced.
      name: regions
      isArray: true
    - description: Policy severity value.
      name: severity
      predefined:
      - 'critical'
      - 'high'
      - 'medium'
      - 'informational'
      auto: PREDEFINED
    - description: Tag exclusion flag.
      name: tag_excluded
      predefined:
      - 'false'
      - 'true'
      auto: PREDEFINED
    description: Updates a policy setting. Can be used to override policy severity or to disable a policy entirely.
    name: cs-falcon-cspm-update-policy_settings
  - arguments:
    - description: A comma-separated list of IDs of the alerts to update.
      name: ids
      isArray: true
      required: true
    - description: Assign the specified detections to a user based on their username.
      name: assign_to_name
    - description: Assign the specified detections to a user based on their user ID (Email).
      name: assign_to_user_id
    - description: Assign the specified detections to a user based on their UUID.
      name: assign_to_uuid
    - description: Appends a new comment to any existing comments for the specified detections.
      name: append_comment
    - description: Add a tag to the specified detections.
      name: add_tag
    - description: Remove a tag from the specified detections.
      name: remove_tag
    - description: Update the status of the alert to the specified value.
      name: update_status
      predefined:
      - 'new'
      - 'in_progress'
      - 'closed'
      - 'reopened'
      auto: PREDEFINED
    - description: Whether to unassign any assigned users to the specified detections.
      name: unassign
      predefined:
      - 'false'
      - 'true'
      auto: PREDEFINED
    - description: If true, displays the detection in the UI.
      name: show_in_ui
      predefined:
      - 'false'
      - 'true'
      auto: PREDEFINED
    description: Perform actions on identity detection alerts.
    name: cs-falcon-resolve-identity-detection
  - arguments:
    - description: A comma-separated list of IDs of the alerts to update.
      name: ids
      isArray: true
      required: true
    - description: Assign the specified detections to a user based on their username.
      name: assign_to_name
    - description: Assign the specified detections to a user based on their user ID (Email).
      name: assign_to_user_id
    - description: Assign the specified detections to a user based on their UUID.
      name: assign_to_uuid
    - description: Appends a new comment to any existing comments for the specified detections.
      name: append_comment
    - description: Add a tag to the specified detections.
      name: add_tag
    - description: Remove a tag from the specified detections.
      name: remove_tag
    - description: Update the status of the alert to the specified value.
      name: update_status
      predefined:
      - 'new'
      - 'in_progress'
      - 'closed'
      - 'reopened'
      auto: PREDEFINED
    - description: Whether to unassign any assigned users to the specified detections.
      name: unassign
      predefined:
      - 'false'
      - 'true'
      auto: PREDEFINED
    - description: If true, displays the detection in the UI.
      name: show_in_ui
      predefined:
      - 'false'
      - 'true'
      auto: PREDEFINED
    description: Perform actions on mobile detection alerts.
    name: cs-falcon-resolve-mobile-detection
  - arguments:
    - description: A comma-separated list of IDs (UUIDs) of specific users to list.
      name: id
      isArray: true
    - description: 'The filter expression that should be used to limit the results. FQL syntax. Available values: assigned_cids, cid, first_name, last_name, name, uid. Example: "first_name:''John''".'
      name: filter
    - description: The integer offset to start retrieving records from.
      name: offset
      defaultValue: 0
    - description: The maximum number of records to return.
      name: limit
      defaultValue: 50
    description: List users.
    name: cs-falcon-list-users
    outputs:
    - contextPath: CrowdStrike.Users.uuid
      description: The user's UUID.
      type: String
    - contextPath: CrowdStrike.Users.cid
      description: The customer ID.
      type: String
    - contextPath: CrowdStrike.Users.uid
      description: The user's ID.
      type: String
    - contextPath: CrowdStrike.Users.first_name
      description: The user's first name.
      type: String
    - contextPath: CrowdStrike.Users.last_name
      description: The user's last name.
      type: String
    - contextPath: CrowdStrike.Users.last_login_at
      description: The timestamp of the user's last login.
      type: String
    - contextPath: CrowdStrike.Users.created_at
      description: The timestamp of the user's creation.
      type: String
  - arguments:
    - description: A comma-separated list of rule IDs to get IOA rules for.
      name: rule_ids
      isArray: true
      required: true
    description: Get IOA Rules.
    name: cs-falcon-get-ioarules
    outputs:
    - contextPath: CrowdStrike.IOARules.instance_id
      description: The IOA rule's instance ID.
      type: String
    - contextPath: CrowdStrike.IOARules.customer_id
      description: The customer ID.
      type: String
    - contextPath: CrowdStrike.IOARules.action_label
      description: The IOA rule's action label.
      type: String
    - contextPath: CrowdStrike.IOARules.comment
      description: The IOA rule's comment.
      type: String
    - contextPath: CrowdStrike.IOARules.committed_on
      description: The timestamp of the IOA rule's commitment.
      type: String
    - contextPath: CrowdStrike.IOARules.created_by
      description: The IOA rule's creator.
      type: String
    - contextPath: CrowdStrike.IOARules.created_on
      description: The timestamp of the IOA rule's creation.
      type: String
    - contextPath: CrowdStrike.IOARules.deleted
      description: Whether the IOA rule is in a deleted status.
      type: Boolean
    - contextPath: CrowdStrike.IOARules.description
      description: The IOA rule's description.
      type: String
    - contextPath: CrowdStrike.IOARules.disposition_id
      description: The disposition ID used by the IOA rule.
      type: String
    - contextPath: CrowdStrike.IOARules.enabled
      description: Whether the IOA rule is enabled.
      type: Boolean
    - contextPath: CrowdStrike.IOARules.field_values
      description: The IOA rule's field values.
      type: String
    - contextPath: CrowdStrike.IOARules.instance_version
      description: The IOA rule's instance version.
      type: String
    - contextPath: CrowdStrike.IOARules.magic_cookie
      description: The IOA rule's magic cookie.
      type: String
    - contextPath: CrowdStrike.IOARules.modified_by
      description: The last user who modified the IOA rule.
      type: String
    - contextPath: CrowdStrike.IOARules.modified_on
      description: The timestamp of the IOA rule's last modification.
      type: String
    - contextPath: CrowdStrike.IOARules.name
      description: The IOA rule name.
      type: String
    - contextPath: CrowdStrike.IOARules.pattern_id
      description: The IOA rule's pattern ID.
      type: String
    - contextPath: CrowdStrike.IOARules.pattern_severity
      description: The IOA rule's pattern severity.
      type: String
    - contextPath: CrowdStrike.IOARules.rulegroup_id
      description: The IOA rule's rule group ID.
      type: String
    - contextPath: CrowdStrike.IOARules.ruletype_id
      description: The IOA rule's rule type ID.
      type: String
    - contextPath: CrowdStrike.IOARules.ruletype_name
      description: The IOA rule's rule type name.
      type: String
    - contextPath: CrowdStrike.IOARules.version_ids
      description: The IOA rule's version ID.
      type: String
  - arguments:
    - description: The filter to use for the query.
      name: filter
      required: false
    description: Returns a list of CNAPP alerts. Used for debugging fetch-assets.
    name: cs-falcon-list-cnapp-alerts
    outputs:
    - contextPath: CrowdStrike.CnappAlert.containers_impacted_count
      description: The number of containers impacted by the alert.
      type: String
    - contextPath: CrowdStrike.CnappAlert.containers_impacted_ids
      description: The list of the ids of containers impacted by the alert.
      type: Array
    - contextPath: CrowdStrike.CnappAlert.detection_description
      description: The description of the alert.
      type: String
    - contextPath: CrowdStrike.CnappAlert.detection_event_simple_name
      description: The simple name of the alert.
      type: String
    - contextPath: CrowdStrike.CnappAlert.detection_name
      description: The name of the alert.
      type: String
    - contextPath: CrowdStrike.CnappAlert.first_seen_timestamp
      description: The first time the alert was seen.
      type: String
    - contextPath: CrowdStrike.CnappAlert.last_seen_timestamp
      description: The last time the alert was seen.
      type: String
    - contextPath: CrowdStrike.CnappAlert.severity
      description: The severity of the alert.
      type: String
  - arguments:
    - name: repository
      description: |
        The repository to run the query against.
      auto: PREDEFINED
      predefined:
      - search-all
      - third-party
      - falcon_for_it_view
      - forensics_view
      - investigate_view
      defaultValue: search-all
    - name: query
      description: 'The CQL query to use for the search. Note: Double quotes (“) and backslashes (\) in the queryString must be escaped with a backslash to ensure they are properly interpreted. Example: query="#event_simpleName = \"Event_name\""", For more details see: https://library.humio.com/data-analysis/syntax.html.'
      required: true
    - name: start
      description: |
        The start of the search window, based on the event timestamp.
        Note: 'end' must be later than 'start'.
        If both start/end and ingest_start/ingest_end are provided, the server applies BOTH windows (AND).
        Supports relative durations (e.g., "1d", "2h", "30m", "1month"), ISO8601 timestamps (e.g., "2026-01-01T00:00:00Z"; if no time zone is provided, assumes UTC), and epoch timestamps (e.g., 1767225600000).
    - name: end
      description: |
        The end of the search window, based on the event timestamp.
        Note: 'end' must be later than 'start'.
        If both start/end and ingest_start/ingest_end are provided, the server applies BOTH windows (AND).
        Supports relative durations (e.g., "1d", "2h", "30m", "1month"), ISO8601 timestamps (e.g., "2026-01-01T00:00:00Z"; if no time zone is provided, assumes UTC), and epoch timestamps (e.g., 1767225600000).
    - name: around_event_id
      description: The ID of the event to search around. Must be provided together with around_timestamp.
    - name: around_number_events_before
      description: Number of events to return before the target event. Requires around_event_id and around_timestamp.
    - name: around_number_events_after
      description: Number of events to return after the target event. Requires around_event_id and around_timestamp.
    - name: around_timestamp
      description: Timestamp for around search. Must be provided together with around_event_id.
    - name: ingest_start
      description: |
        The start of the search window, based on the event ingesttimestamp.
        Note: 'ingest_end' must be later than 'ingest_start'.
        If both start/end and ingest_start/ingest_end are provided, the server applies BOTH windows (AND).
        Supports relative durations (e.g., "1d", "2h", "30m", "1month"), ISO8601 timestamps (e.g., "2026-01-01T00:00:00Z"; if no time zone is provided, assumes UTC), and epoch timestamps (e.g., 1767225600000).
    - name: ingest_end
      description: |
        The end of the search window, based on the event ingesttimestamp.
        Note: 'ingest_end' must be later than 'ingest_start'.
        If both start/end and ingest_start/ingest_end are provided, the server applies BOTH windows (AND).
        Supports relative durations (e.g., "1d", "2h", "30m", "1month"), ISO8601 timestamps (e.g., "2026-01-01T00:00:00Z"; if no time zone is provided, assumes UTC), and epoch timestamps (e.g., 1767225600000).
    - name: use_ingest_time
      description: When true, the server uses ingest_start/ingest_end as the query window. when false (or not set), it uses start/end. If both windows are provided, results are constrained by BOTH (AND).
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: limit
      description: Maximum number of events to return. Ignored when around_number_events_before or around_number_events_after parameters are specified.
      defaultValue: '50'
    - name: interval_in_seconds
      description: Interval between polling attempts in seconds. To prevent search timeouts, set this value within the 60–90 second range.
      defaultValue: '60'
    - name: timeout_in_seconds
      description: Timeout for polling in seconds.
      defaultValue: '600'
    - name: job_id
      description: Internal argument for polling - job ID from previous run.
      hidden: true
    - name: wait_for_result
      hidden: true
      description: Whether to poll for results.
      auto: PREDEFINED
      defaultValue: 'true'
      predefined:
      - 'true'
      - 'false'
    description: 'Search NGSIEM historical events. Requires NGSIEM scope with read and write permissions.'
    name: cs-falcon-search-ngsiem-events
    polling: true
    outputs:
    - contextPath: CrowdStrike.NGSiemEvent
      description: The list of all events returned from the search.
      type: Array
    - contextPath: CrowdStrike.NGSiemEvent.id
      description: The event ID.
      type: String
    - contextPath: CrowdStrike.NGSiemEvent.timestamp
      description: Event timestamp.
      type: String
  - arguments:
    - description: 'Filters results using a query in Falcon Query Language (FQL). For more information, see the FQL Syntax Documentation: https://www.falconpy.io/Usage/Falcon-Query-Language.html. For a list of available properties, see Workflow execution FQL filters - https://falcon.crowdstrike.com/documentation/page/z028de1a/fusion-workflow-apis#zec519e3'
      name: filter
    - description: The workflow definition ID to filter by. If 'filter' is provided, this argument is ignored.
      name: definition_id
    - description: The activity ID to filter by. If 'filter' is provided, this argument is ignored.
      name: activity_id
    - description: The workflow name to filter by. If 'filter' is provided, this argument is ignored.
      name: name
    - description: The workflow description to filter by. If 'filter' is provided, this argument is ignored.
      name: description
    - description: The offset to start retrieving records from.
      name: offset
      defaultValue: '0'
    - description: The maximum number of records to return. Max is 500.
      name: limit
      defaultValue: '50'
    - description: 'A comma-separated list of properties to sort by in the format property.direction (for example  name.desc, time.asc, created_at.desc).'
      name: sort
    description: Lists workflow definitions from CrowdStrike Falcon.
    name: cs-falcon-list-workflow-definitions
    outputs: []
  - arguments:
    - description: A comma-separated list of workflow definition IDs to execute. Either definition_id or name must be provided.
      name: definition_id
      isArray: true
    - description: The workflow name to execute. Either definition_id or name must be provided.
      name: name
    - description: A comma-separated list of CID(s) to execute the workflow on.
      name: execution_cid
      isArray: true
    - description: The key used for deduplication of workflow executions. If not set, a new UUID is used.
      name: key
    - description: The URL of the source that triggered the workflow execution.
      name: source_event_url
    - description: The JSON body to pass to the workflow execution. Can be an empty object {}.
      name: body
    description: 'Executes an on-demand workflow. Use cs-falcon-list-workflow-definitions to find workflows to run. Note: This command executes on-demand workflows only.'
    name: cs-falcon-workflow-execute
    outputs: []
  - arguments:
    - description: 'Filters results using a query in Falcon Query Language (FQL). For more information, see the FQL Syntax Documentation: https://www.falconpy.io/Usage/Falcon-Query-Language.html. For a list of available properties, see Workflow execution FQL filters - https://falcon.crowdstrike.com/documentation/page/z028de1a/fusion-workflow-apis#zec519e3'
      name: filter
    - description: The workflow definition ID to filter by. If 'filter' is provided, this argument is ignored.
      name: definition_id
    - description: The workflow definition name to filter by. If 'filter' is provided, this argument is ignored.
      name: definition_name
    - description: The execution ID to filter by. If 'filter' is provided, this argument is ignored.
      name: execution_id
    - description: The offset to start retrieving records from.
      name: offset
      defaultValue: '0'
    - description: The maximum number of records to return. Max is 500.
      name: limit
      defaultValue: '50'
    - description: 'A comma-separated list of properties to sort by in the format property.direction (for example  name.desc, time.asc, created_at.desc).'
      name: sort
    description: 'Lists workflow executions from CrowdStrike Falcon. Use cs-falcon-workflow-execute to find executions IDs.'
    name: cs-falcon-list-workflow-executions
    outputs: []
  - arguments:
    - description: A comma-separated list of workflow execution IDs to retrieve results for.
      name: ids
      required: true
      isArray: true
    description: Gets detailed results for specific workflow executions. Use cs-falcon-list-workflow-executions to find execution IDs.
    name: cs-falcon-list-workflow-execution-results
    outputs: []
  - arguments:
    - description: A comma-separated list of workflow execution IDs to perform the action on. Get the workflow execution ID using cs-falcon-list-workflow-executions.
      name: ids
      required: true
      isArray: true
    - auto: PREDEFINED
      description: The action to perform on the workflow executions.
      name: action_name
      required: true
      predefined:
      - cancel
      - resume
    description: Performs an action (cancel or resume) on one or more workflow executions. Use cs-falcon-list-workflow-execution-results to find execution activity status.
    name: cs-falcon-workflow-execution-action
    outputs: []
  dockerimage: demisto/py3-tools:1.0.0.10120494
  isfetch: true
  isfetch:marketplacev2: false
  isfetch:platform: true
  isfetchevents: true
  isfetchassets: true
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
  script: '-'
  subtype: python3
  type: python
fromversion: 5.0.0
tests:
- Test - CrowdStrike Falcon
- CrowdStrike Falcon Basic Test
defaultclassifier: CrowdStrike Falcon
defaultmapperin: CrowdStrike Falcon-Mapper
defaultmapperout: CrowdStrike Falcon - Outgoing Mapper
supportedModules:
- agentix
- xsiam
- edr
- cloud
- cloud_runtime_security
- exposure_management