CrowdStrike SearchActors
CertifiedEnterprise EditionSearch CrowdStrike Falcon threat actors
CrowdStrike SearchActors
Search CrowdStrike Falcon threat actors
Searches threat actor profiles with the CrowdStrike Falcon Query Language (FQL). Omitting filter matches every actor visible to the API client.
type: io.kestra.plugin.ee.crowdstrike.intel.SearchActorsExamples
List actors known to target the financial industry
id: search_actors
namespace: company.team
tasks:
- id: search_actors
type: io.kestra.plugin.ee.crowdstrike.intel.SearchActors
clientId: "{{ secret('CROWDSTRIKE_CLIENT_ID') }}"
clientSecret: "{{ secret('CROWDSTRIKE_CLIENT_SECRET') }}"
filter: "target_industries:'Financial Services'"
limit: 50
Properties
clientId *Requiredstring
API client ID
Client ID of a CrowdStrike API client with the scopes required by the tasks and triggers being used.
clientSecret *Requiredstring
API client secret
Client secret of the CrowdStrike API client. Exchanged for a short-lived OAuth2 Bearer token on every task run and trigger poll; never logged.
baseUrl string
https://api.crowdstrike.comCrowdStrike API base URL
Base URL of the CrowdStrike Falcon API for your cloud region (for example: https://api.crowdstrike.com for US-1, https://api.us-2.crowdstrike.com for US-2, https://api.eu-1.crowdstrike.com for EU-1, or https://api.laggar.gcw.crowdstrike.com for US-GOV-1). Defaults to the US-1 endpoint. Using the wrong region for your tenant results in 403 Forbidden responses.
filter string
FQL filter
CrowdStrike Falcon Query Language expression (for example: target_industries: 'Financial Services'). Matches every actor when omitted.
limit integerstring
50Page size
Maximum number of actors to return, from 1 to 5000. Defaults to 50.
offset integerstring
0Offset
Number of matching actors to skip, for pagination. Defaults to 0.
sort string
Sort order
Sort field and direction (for example: name.asc).
Outputs
actors array
Matching threat actors
io.kestra.plugin.ee.crowdstrike.intel.ActorRecord
Assessed capability of this actor.
io.kestra.plugin.ee.crowdstrike.intel.ActorRecord-TaxonomyItem
Numeric taxonomy ID.
URL-safe slug.
Human-readable value (for example a country or industry name).
Actor ID.
Actor name (for example FANCY BEAR).
Short description of the actor.
URL-safe actor slug.
Countries this actor is known to target.
io.kestra.plugin.ee.crowdstrike.intel.ActorRecord-TaxonomyItem
Numeric taxonomy ID.
URL-safe slug.
Human-readable value (for example a country or industry name).
Industries this actor is known to target.
io.kestra.plugin.ee.crowdstrike.intel.ActorRecord-TaxonomyItem
Numeric taxonomy ID.
URL-safe slug.
Human-readable value (for example a country or industry name).
total integer
Total number of actors matching the filter, without pagination
