custom_ioa

CrowdStrike FalconPy
CrowdStrike FalconPy

CrowdStrike Subreddit

Custom IOA examples

The examples in this folder focus on leveraging CrowdStrike's Custom IOA API to manage Indicators of Attack within your Falcon Tenant.

This solution supports MSSP scenarios and can clone rules to and delete rules from children.

Custom IOA Cloner

Running the program

In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes:

Service Collection
Scope

Custom IOA

READ, WRITE

Execution syntax

This demonstration was developed to leverage easy to use command-line arguments.

Command line arguments

This program accepts the following command line arguments.

Argument
Long Argument
Description

-h

--help

Display command line help and exit

-n

--no_color

Disable color output in result displays

-b

--base_url

Base URL

-t TABLE_FORMAT

--table_format TABLE_FORMAT

Table format to use for display, one of: plain, simple, github, grid, fancy_grid, pipe, orgtbl, jira, presto, pretty, psql, rst, mediawiki, moinmoin, youtrack, html, unsafehtml, latext, latex_raw, latex_booktabs, latex_longtable, textile, or tsv.

-f FILTER

--filter FILTER

String to filter results (IOA rule group name)

-c

--clone

Clone all IOA rule group matches to new rule groups

-d DELETE_LIST

--delete DELETE_LIST

List of rule group IDs to delete (comma-delimit)

-m MANAGED_TARGETS

--managed_targets MANAGED_TARGETS

List of child CIDs to target for cloning / deletions (comma-delimit)

-k FALCON_CLIENT_ID

--falcon_client_id FALCON_CLIENT_ID

CrowdStrike Falcon API Client ID

-s FALCON_CLIENT_SECRET

--falcon_client_secret FALCON_CLIENT_SECRET

CrowdStrike Falcon API Client Secret

Basic usage

The only required command line arguments are -k (CrowdStrike Falcon API Client ID) and -s (CrowdStrike Falcon API Client Secret).

The default command is "list" with no filters specified, which displays all Custom IOA rule groups within your tenant.

Example

Example result

Filtering by name

You can filter results down using the -f argument to filter by name.

Cloning IOA rule groups

Cloning IOA rule groups can be performed by passing the -c argument. Any matches to the filter string (-f) are cloned.

Cloning IOA rule groups to a child

Cloning IOA rule groups to a child can be performed by passing the -c argument along with the -m argument. Any matches to the filter string (-f) are cloned into valid children specified within the comma delimited list provided.

Deleting IOA rule groups

You must provide the exact rule group ID in order to delete using the -d argument. Multiple IDs may be specified at the same time if you provide these as a comma-delimited list.

Deleting IOA rule groups within a child

You may delete rule groups from within a single child by passing the child CID with the -m argument. You must provide the exact rule group ID in order to delete using the -d argument. Multiple IDs may be specified at the same time if you provide these as a comma-delimited list.

Command-line help

Command-line help is available via the -h argument.

Example source code

Source code for this example can be found here.

Previouscspm_registrationNextdetects

Last updated

Was this helpful?