CrowdStrike SearchIndicators
CertifiedEnterprise EditionSearch CrowdStrike Falcon threat intelligence indicators
CrowdStrike SearchIndicators
Search CrowdStrike Falcon threat intelligence indicators
Searches intelligence indicators with the CrowdStrike Falcon Query Language (FQL). Omitting filter matches every indicator visible to the API client.
type: io.kestra.plugin.ee.crowdstrike.intel.SearchIndicatorsExamples
List high-confidence malicious indicators for a malware family
id: search_indicators
namespace: company.team
tasks:
- id: search_indicators
type: io.kestra.plugin.ee.crowdstrike.intel.SearchIndicators
clientId: "{{ secret('CROWDSTRIKE_CLIENT_ID') }}"
clientSecret: "{{ secret('CROWDSTRIKE_CLIENT_SECRET') }}"
filter: "malicious_confidence:'high'+malware_families:'Cobalt Strike'"
limit: 100
Properties
clientId *Requiredstring
API client ID
Client ID of a CrowdStrike API client with the scopes required by the tasks and triggers being used.
clientSecret *Requiredstring
API client secret
Client secret of the CrowdStrike API client. Exchanged for a short-lived OAuth2 Bearer token on every task run and trigger poll; never logged.
baseUrl string
https://api.crowdstrike.comCrowdStrike API base URL
Base URL of the CrowdStrike Falcon API for your cloud region (for example: https://api.crowdstrike.com for US-1, https://api.us-2.crowdstrike.com for US-2, https://api.eu-1.crowdstrike.com for EU-1, or https://api.laggar.gcw.crowdstrike.com for US-GOV-1). Defaults to the US-1 endpoint. Using the wrong region for your tenant results in 403 Forbidden responses.
filter string
FQL filter
CrowdStrike Falcon Query Language expression (for example: malicious_confidence: 'high'). Matches every indicator when omitted.
limit integerstring
100Page size
Maximum number of indicators to return, from 1 to 5000. Defaults to 100.
offset integerstring
0Offset
Number of matching indicators to skip, for pagination. Defaults to 0.
sort string
Sort order
Sort field and direction (for example: last_updated.desc).
Outputs
indicators array
Matching intelligence indicators
io.kestra.plugin.ee.crowdstrike.intel.IndicatorRecord
Indicator ID.
Indicator value (for example a domain, IP, or hash).
Kill chain phases associated with this indicator.
UTC timestamp this indicator was last updated, ISO-8601.
Confidence that this indicator is malicious: low, medium, or high.
Malware families associated with this indicator.
Indicator type (for example domain, ip_address, hash_sha256).
total integer
Total number of indicators matching the filter, without pagination
