commonfields: id: FalconIntel version: -1 name: FalconIntel display: CrowdStrike Falcon Intel (Deprecated) category: Data Enrichment & Threat Intelligence provider: CrowdStrike description: Deprecated. Use CrowdStrike Falcon Intel v2 integration instead. configuration: - display: Server URL (e.g. https://192.168.0.1) name: url defaultvalue: https://intelapi.crowdstrike.com/ type: 0 required: true - display: API ID name: id defaultvalue: "" type: 0 required: true - display: API Key name: key defaultvalue: "" type: 4 required: true - display: Indicator Threshold. Minimum malicious confidence from Falcon Intel to consider the indicator malicious.(low, medium, high) name: threshold defaultvalue: high type: 0 required: false - display: Use system proxy settings name: useproxy defaultvalue: "true" type: 8 required: false - display: Trust any certificate (not secure) name: insecure defaultvalue: "false" type: 8 required: false - display: Support indicator API V2 name: version defaultvalue: "true" type: 8 required: false script: script: '' type: javascript commands: - name: file arguments: - name: file required: true default: true description: The file hash md5/sha1/sha256 to check outputs: - contextPath: File.MD5 description: Bad hash MD5 - contextPath: File.SHA1 description: Bad hash SHA1 - contextPath: File.SHA256 description: Bad hash SHA256 - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision - contextPath: File.Malicious.Description description: For malicious files, the reason for the vendor to make the decision - contextPath: DBotScore.Indicator description: The indicator that was tested. - contextPath: DBotScore.Type description: The indicator type. - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. - contextPath: DBotScore.Score description: The actual score. description: Check file reputation - name: url arguments: - name: url required: true default: true description: URL to be checked outputs: - contextPath: URL.Data description: Bad URL - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision - contextPath: URL.Malicious.Description description: For malicious URLs, the reason for the vendor to make the decision - contextPath: DBotScore.Indicator description: The indicator that was tested. - contextPath: DBotScore.Type description: The indicator type. - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. - contextPath: DBotScore.Score description: The actual score. description: Check the given URL reputation - name: domain arguments: - name: domain required: true default: true description: Domain to be checked outputs: - contextPath: Domain.Name description: Bad domain - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision - contextPath: Domain.Malicious.Description description: For malicious domains, the reason for the vendor to make the decision - contextPath: DBotScore.Indicator description: The indicator that was tested. - contextPath: DBotScore.Type description: The indicator type. - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. - contextPath: DBotScore.Score description: The actual score. description: Check the given URL reputation - name: ip arguments: - name: ip required: true default: true description: IP to check outputs: - contextPath: IP.Address description: Bad IP - contextPath: IP.Malicious.Vendor description: For malicious IPs, the vendor that made the decision - contextPath: IP.Malicious.Description description: For malicious IPs, the reason for the vendor to make the decision - contextPath: DBotScore.Indicator description: The indicator that was tested. - contextPath: DBotScore.Type description: The indicator type. - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. - contextPath: DBotScore.Score description: The actual score. description: Check IP reputation - name: cs-actors arguments: - name: q default: true description: Search all fields for the given data - name: name description: Search based on actor name - name: desc description: Search based on description - name: minLastModifiedDate description: Search range from modified date. Dates are formatted as YYYY-MM-DD. - name: maxLastModifiedDate description: Search range to modified date. Dates are formatted as YYYY-MM-DD. - name: minLastActivityDate description: Search range from activity date. Dates are formatted as YYYY-MM-DD. - name: maxLastActivityDate description: Search range to activity date. Dates are formatted as YYYY-MM-DD. - name: origins description: Search by origins separated by "," - name: targetCountries description: Search by target countries separated by "," - name: targetIndustries description: Search by target industries separated by "," - name: motivations description: Search by motivations separated by "," - name: offset description: Which page of the results to retrieve. It is 0 based. - name: limit description: Number of results for the page - name: sort description: Sort is field_name.order, field_name.order where order is either asc or desc - name: slug description: 'Search by ''slug'' or short descriptive name. Ex: "anchor-panda"' description: Search known actors based on the given parameters. Dates are formatted as YYYY-MM-DD. Max date is taken automatically looking at end-of-day time. Origins, targetCountries, targetIndustries and motivations can all receive multiple values separated by ",". Offset is 0 based. Sort is field_name.order, field_name.order where order is either asc or desc. - name: cs-indicators arguments: - name: parameter required: true description: Based on what parameter to search. See CrowdStrike documentation for details. Can be one of indicator, type, report, actor, malicious_confidence, published_date, last_updated, malware_family, kill_chain, labels, DomainType, EmailAddressType, IntelNews, IPAddressType, Malware, Status, Target, ThreatType, Vulnerability - name: filter required: true auto: PREDEFINED predefined: - match - equal - gt - gte - lt - lte description: Can be either match, equal, gt(e), lt(e) - name: value required: true description: The value for the given parameter - name: sort description: Sort by a field. Should be field_name.order where order is either asc or desc. Fields are indicator, type, report, actor, malicious_confidence, published_date, last_updated. - name: page description: The page to retrieve - 1 based - name: pageSize description: The size of the page to retrieve outputs: - contextPath: File.MD5 description: hash MD5 - contextPath: File.SHA1 description: hash SHA1 - contextPath: File.SHA256 description: hash SHA256 - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision - contextPath: File.Malicious.Description description: For malicious files, the reason for the vendor to make the decision - contextPath: File.Reports description: For malicious files, the associated reports describing the hash - contextPath: File.Actors description: For malicious files, the associated actors - contextPath: File.MalwareFamilies description: For malicious files, the associated malware family - contextPath: File.KillChains description: For malicious files, the associated kill chain - contextPath: URL.Data description: Bad URL - contextPath: URL.Malicious.Vendor description: For malicious URLs, the vendor that made the decision - contextPath: URL.Malicious.Description description: For malicious URLs, the reason for the vendor to make the decision - contextPath: URL.Reports description: For malicious URL, the associated reports describing the URL - contextPath: URL.Actors description: For malicious URL, the associated actors - contextPath: URL.MalwareFamilies description: For malicious URL, the associated malware family - contextPath: URL.KillChains description: For malicious URL, the associated kill chain - contextPath: Domain.Name description: Bad domain - contextPath: Domain.Malicious.Vendor description: For malicious domains, the vendor that made the decision - contextPath: Domain.Malicious.Description description: For malicious domains, the reason for the vendor to make the decision - contextPath: Domain.Reports description: For malicious domain, the associated reports describing the domain - contextPath: Domain.Actors description: For malicious domain, the associated actors - contextPath: Domain.MalwareFamilies description: For malicious domain, the associated malware family - contextPath: Domain.KillChains description: For malicious domain, the associated kill chain - contextPath: IP.Address description: IP Indicators - contextPath: IP.Malicious.Vendor description: For malicious IPs, the vendor that made the decision - contextPath: IP.Malicious.Description description: For malicious IPs, the reason for the vendor to make the decision - contextPath: IP.Reports description: For malicious IP, the associated reports describing the IP - contextPath: IP.Actors description: For malicious IP, the associated actors - contextPath: IP.MalwareFamilies description: For malicious IP, the associated malware family - contextPath: IP.KillChains description: For malicious IP, the associated kill chain - contextPath: DBotScore.Indicator description: The indicator we tested - contextPath: DBotScore.Type description: The type of the indicator - contextPath: DBotScore.Vendor description: Vendor used to calculate the score - contextPath: DBotScore.Score description: The actual score description: Search known indicators based on the given parameters - name: cs-reports arguments: - name: q description: Perform a generic substring search across all fields in a report - name: name description: Search for keywords across report names (i.e. the report’s title) - name: actor description: Search for a report related to a particular actor. For a list of actors, refer to the Intel Actors API - name: targetCountries description: Search reports by targeted country/countries - name: targetIndustries description: Search reports by targeted industry/industries - name: motivations description: Search by motivation - name: slug description: Search by report 'slug' or short descriptive name - name: description description: Search the body of the report - name: type auto: PREDEFINED predefined: - intelligence report - alert - periodic report - tipper description: The type of object to search for. - name: subType auto: PREDEFINED predefined: - weekly - monthly - quarterly - annual description: The sub-type to search for. - name: tags description: Tags associated with a report (managed internally by CS) - name: minLastModifiedDate description: Constrain results to those modified on or after a certain date - format YYYY-MM-DD - name: maxLastModifiedDate description: Constrain results to those modified on or before a certain date - format YYYY-MM-DD - name: offset description: Used to paginate the response. You can then use limit to set the number of results for the next page. - name: limit description: Limits the number of results to return - name: sort description: 'The field and direction to sort results on in the format of: . or .. Valid values include: name, target_countries, target_industries, type, created_date, last_modified_date' description: The Falcon Intel Reports API allows to query CrowdStrike intelligence publications. - name: cs-report-pdf arguments: - name: id required: true default: true description: The ID of the report to retrieve description: Retrieve the Falcon Intel Report PDF tests: - No tests - deprecated fromversion: 5.0.0 deprecated: true