CrowdStrike

Creates a custom indicator of compromise in CrowdStrike. You can specify what action to take when the IOC is detected in addition to its severity and what platforms to apply the rule to.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the request payload and the authorization header
[] Request the IOC be created
[] Check if the API request succeeded:
[]> If it did, set the output variable
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Create Custom IOC

prod-nam

prod-eu

prod-apjc

Uploads a custom real time response script to CrowdStrike. These scripts can be used with the "runscript" real time response command or the "CrowdStrike - Execute Real Time Response Command" atomic.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Build the request payload
[] Request the script be created
[] Check if the request was successful:
[]> If it wasn't, return an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Create Custom Response Script

Deletes one or more custom indicators of compromise (IOC) from CrowdStrike.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Build the query string
[] Request the indicators be deleted
[] Check if the API request succeeded:
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Delete Custom IOCs

Ends a real time response session in CrowdStrike.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] End the session
[] Check if the request was successful:
[]> If it wasn't, return an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - End Real Time Response Session

Perform various actions on one or more host in CrowdStrike such as enabling or lifting containment, deleting a host, or restoring a deleted host.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Check if a list of IDs was provided (if not, wrap the ID into a list)
[] Build the authorization header
[] Request the host action
[] Check if the API request succeeded:
[]> If it did, set the output variable
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Execute Host Actions

Executes a real time response command in CrowdStrike using an existing real time response session.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Set the request URL based on the requested user role
[] Build the authorization header
[] Build the request payload
[] Execute the command
[] Check if the request was successful:
[]> If it was, extract the cloud request ID and set the output variable
[]> If it wasn't, return an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Execute Real Time Response Command

Gets an OAuth access token for the CrowdStrike API. If you are using an integration-provided target, you do not need to use this atomic as an access token will be generated by the target for you.

Target: HTTP Endpoint for "api.crowdstrike.com"

Account Key: HTTP Basic Authentication with CrowdStrike API client (client ID as username, client secret as password)

Steps:
[] Make the API request to get a token
[] Check if the API request succeeded:
[]> If it did, attempt to extract the bearer token and expiration time and set the workflow's output variables
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Get Access Token

Fetches information about a specific actor from CrowdStrike using its ID.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Request actor details
[] Check if the API request succeeded:
[]> If it did, check if the actor was found and set the output variable
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Get Actor by ID

Fetches information about a specific alert from CrowdStrike using its ID.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Request alert details
[] Check if the API request succeeded:
[]> If it did, check if the alert was found and set the output variable
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Get Alert by ID

Fetches CVEs for a given host from CrowdStrike.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Request the CVE list
[] Check if the API request succeeded:
[]> If it did, extract the CVE list and set the output variable
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Get All CVEs by Host

Fetches information about a specific detection from CrowdStrike using its ID.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Request detection details
[] Check if the API request succeeded:
[]> If it did, check if the detection was found and set the output variable
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Get Detection by ID

Fetches information about a host's network interfaces from CrowdStrike using its ID.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Request host NIC details
[] Check if the API request succeeded:
[]> If it did, check if the host's details were found and set the output variable
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Get Host NIC Details

Fetches online status and last seen information for the host IDs provided from CrowdStrike.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the query string and the authorization header
[] Request host status details
[] Check if the API request succeeded:
[]> If it did, check if the host status was returned and set the output variable
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Get Host Online Status

Fetch host details for provided ID from CrowdStrike.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the request payload and the authorization header
[] Request host details
[] Check if the API request succeeded:
[]> If it did, set the output variable
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Get Hosts by IDs

Fetches information about behaviors related to an incident from CrowdStrike using an incident ID.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Request for incident behaviors
[] Check if the API request succeeded:
[]> If it did, extract the results and set the output variable
[]> If it didn't, output an error

More information about this API: https://falcon.us-2.crowdstrike.com/documentation/86/detections-monitoring-apis#find-behaviors

CrowdStrike - Get Incident Behaviors by Incident ID

Fetches information about a specific incident from CrowdStrike using its ID.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Request incident details
[] Check if the API request succeeded:
[]> If it did, check if the incident was found and set the output variable
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Get Incident by ID

Fetches information about a specific indicator (IOC) from CrowdStrike using its ID.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Request indicator details
[] Check if the API request succeeded:
[]> If it did, check if the indicator was found and set the output variables
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Get Indicator by ID

Gets the status of a real time response command from CrowdStrike.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Set the request URL based on the requested user role
[] Build the authorization header
[] Get the command status
[] Check if the request was successful:
[]> If it was, extract the command details and set the output variables
[]> If it wasn't, return an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Get Real Time Response Command Status

Fetches information about recent logins for a host from CrowdStrike using the host's ID.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Request recent login details
[] Check if the API request succeeded:
[]> If it did, check if the recent logins were returned and set the output variable
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Get Recent Logins for Host

Runs a real time response script on an endpoint in CrowdStrike. You will need to start a real time response session before using this atomic. Note that the "runscript" real time response command requires administrative real time response permissions, not read-only permissions.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Check if at least one required input was provided (if not, end the workflow)
[] Build the authorization header
[] Build the request payload
[] Execute the command
[] Check if the request was successful:
[]> If it was, extract the cloud request ID and set the output variable
[]> If it wasn't, return an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Run Real Time Response Script

Searches CrowdStrike for actors that are being tracked. This atomic will return the first 100 search results.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] If there is a query, build the query string
[] Search for matching actors
[] Check if the API request succeeded:
[]> If it did, extract the results and set the output variable
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Search Actors

Searches CrowdStrike for detections.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization headers
[] Search for matching detections
[] Check if the API request succeeded:
[]> If it did, extract the results and set the output variables
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Search Detections

Searches CrowdStrike for hosts.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the query string and the authorization header
[] Search for matching hosts
[] Check if the API request succeeded:
[]> If it was, set the output variable
[]> If it wasn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Search Hosts

Searches CrowdStrike for incident behaviors.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization headers
[] Search for incident behaviors
[] Check if the API request succeeded:
[]> If it did, extract the results and set the output variables
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Search Incident Behaviors

Searches CrowdStrike for incidents.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization headers
[] Search for incidents
[] Check if the API request succeeded:
[]> If it did, extract the results and set the output variables
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Search Incidents

Searches CrowdStrike for indicators.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization headers
[] Search for indicators
[] Check if the API request succeeded:
[]> If it did, extract the results and set the output variables
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Search Indicators

Fetches CrowdScores from CrowdStrike.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization headers
[] Fetch the CrowdScores
[] Check if the API request succeeded:
[]> If it did, extract the results and set the output variables
[]> If it didn't, output an error

More information about this API can be found in the CrowdStrike documentation.

CrowdStrike - Show CrowdScores

Starts a real time response session for an endpoint in CrowdStrike.

Target: CrowdStrike integration target or an HTTP Endpoint for "api.crowdstrike.com"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Build the request payload
[] Request to start a real time response session
[] Check if the request was successful:
[]> If it was, extract the session details and set the output variable
[]> If it wasn't, output an error

More information about this API can be found in the CrowdStrike documentation.