Skip to content

New FalconIoc

Jump to bottom
bk-cs edited this page Jan 17, 2023 · 24 revisions

New-FalconIoc

SYNOPSIS

Create custom indicators

DESCRIPTION

Requires 'IOC Manager APIs: Write'.

PARAMETERS

Name Type Min Max Allowed Pipeline PipelineByName Description
Array Object[] X An array of indicators to create in a single request
Action String Action to perform when a host observes the indicator
Platform String[] Operating system platform
Source String 1 256 Origination source
Severity String Severity level
Description String Indicator description
Filename String Indicator filename,used with hash values
Tag String[] Indicator tag
MobileAction String no_action
allow
detect
prevent 		Action to perform when a mobile device observes the indicator
HostGroup String[] Host group identifier
AppliedGlobally Boolean Assign to all host groups
Expiration String Expiration date. When an indicator expires,its action is set to 'no_action' but it remains in your indicator list.
Comment String Audit log comment
Retrodetect Boolean Generate retroactive detections for hosts that have observed the indicator
IgnoreWarning Boolean Ignore warnings and create all indicators
Type String Indicator type
Value String String representation of the indicator

SYNTAX

New-FalconIoc [-Action] <String> [-Platform] <String[]> [[-Source] <String>] [[-Severity] <String>] [[-Description] <String>] [[-Filename] <String>] [[-Tag] <String[]>] [[-MobileAction] <String>] [[-HostGroup] <String[]>] [[-AppliedGlobally] <Boolean>] [[-Expiration] <String>] [[-Comment] <String>] [[-Retrodetect] <Boolean>] [[-IgnoreWarning] <Boolean>] [-Type] <String> [-Value] <String> [-WhatIf] [-Confirm] [<CommonParameters>]
New-FalconIoc -Array <Object[]> [[-Comment] <String>] [[-Retrodetect] <Boolean>] [[-IgnoreWarning] <Boolean>] [-WhatIf] [-Confirm] [<CommonParameters>]

SDK Reference

falconpy

indicator_create_v1

USAGE

Creating a domain indicator

New-FalconIoc -Type domain -Value example01.com -Action detect -Severity medium -Description 'test description' -Platforms windows, mac, linux -Tags test_tag -HostGroup <host_group_id>, <host_group_id> -Expiration 2021-05-01

Creating multiple indicators in a single request

$Array = @(
    @{
        type = 'domain'
        value = 'example01.com'
        action = 'detect'
        severity = 'medium'
        description = 'test description'
        platforms = @('windows', 'mac', 'linux')
        tags = @('test_tag')
        host_groups = @('<id>')
    },
    @{
        type = 'sha256'
        value = 'a88787d8ff144c502c7f5cffaafe2cc588d86079f9de88304c26b0cb99ce91cc'
        source = 'bd20201216'
        filename = 'iexplore.exe'
        action = 'prevent'
        severity = 'high'
        description = 'test block description'
        platforms = @('windows')
        tags = @('test_tag', 'test_tag2')
        applied_globally = $true
    }
)
New-FalconIoc -Array $Array

2023-01-17: PSFalcon v2.2.4

Clone this wiki locally