args:
- description: 'The indicators query. Using `GetIndicatorsByQuery` automation. <br/>Example: `type:IP and lastSeen:>="2022-02-16T16:20:00 +0200"`.'
  name: query
  required: true
- auto: PREDEFINED
  description: The action that will be taken if the indicator will be discovered in the organization.
  name: action
  predefined:
  - no_action
  - allow
  - detect
  - prevent_no_ui
  - prevent
  required: true
- defaultValue: '10000'
  description: The maximum number of indicators to fetch.
  name: limit
- defaultValue: '0'
  description: The results offset page. Only change when the number of the results exceed the limit.
  name: offset
- description: "List of host group IDs that the indicator applies to. \nCan be retrieved by running the cs-falcon-list-host-groups command.\nEither applied_globally or host_groups must be provided."
  isArray: true
  name: host_groups
- auto: PREDEFINED
  description: The platforms that the indicator applies to.
  isArray: true
  name: platforms
  predefined:
  - mac
  - windows
  - linux
  required: true
- auto: PREDEFINED
  defaultValue: 'true'
  description: "Whether the indicator is applied globally. \nEither applied_globally or host_groups must be provided. Default set to True."
  name: applied_globally
  predefined:
  - 'true'
  - 'false'
comment: Transform an indicator in Cortex into a CrowdStrike Falcon IOC. The output (found at the TransformIndicatorToCSFalconIOC.JsonOutput context path) is a JSON, which represents the indicators in CrowdStrike Falcon format. This JSON can be used as the input for the *cs-falcon-batch-upload-custom-ioc* command.
commonfields:
  id: TransformIndicatorToCSFalconIOC
  version: -1
name: TransformIndicatorToCSFalconIOC
outputs:
- contextPath: TransformIndicatorToCSFalconIOC
  description: Json output of the indicators. Should be the input for the *cs-falcon-batch-upload-custom-ioc*.
  type: String
- contextPath: TransformIndicatorToCSFalconIOC.Indicators.value
  description: The value of the Indicator.
  type: String
- contextPath: TransformIndicatorToCSFalconIOC.Indicators.expiration
  description: The date on which the indicator will become inactive.
  type: String
- contextPath: TransformIndicatorToCSFalconIOC.Indicators.description
  description: Descriptive label for the indicator.
  type: String
- contextPath: TransformIndicatorToCSFalconIOC.Indicators.tags
  description: List of tags of the indicator.
  type: Unknown
- contextPath: TransformIndicatorToCSFalconIOC.Indicators.source
  description: The source where this indicator originated.
  type: String
- contextPath: TransformIndicatorToCSFalconIOC.Indicators.id
  description: The ID of the indicator.
  type: String
- contextPath: TransformIndicatorToCSFalconIOC.Indicators.type
  description: 'Type of the indicator. Possible values are: md5, sha256, ipv4, ipv6 and domain.'
  type: String
- contextPath: TransformIndicatorToCSFalconIOC.Indicators.severity
  description: 'The severity of the indicator. possible values are: Informational, Low, Medium, High and Critical.'
  type: String
- contextPath: TransformIndicatorToCSFalconIOC.Indicators.action
  description: The action that will be taken if the indicator will be discovered in the organization.
  type: String
- contextPath: TransformIndicatorToCSFalconIOC.Indicators.applied_globally
  description: Whether the indicator is applied globally.
  type: Boolean
- contextPath: TransformIndicatorToCSFalconIOC.Indicators.platforms
  description: The platforms that the indicator applies to.
  type: Unknown
- contextPath: TransformIndicatorToCSFalconIOC.Indicators.host_groups
  description: List of host group IDs that the indicator applies to.
  type: Unknown
script: '-'
subtype: python3
timeout: '0'
type: python
dockerimage: demisto/python3:3.12.13.10116658
tests:
- No tests (auto formatted)
fromversion: 6.0.0
supportedModules:
- agentix
- xsiam
- edr
- cloud
- cloud_runtime_security