CrowdStrike CreateIOC

CrowdStrike CreateIOC
Certified
Enterprise Edition
Create a CrowdStrike Falcon custom indicator of compromise

Creates a custom IOC (domain, IP, or file hash) with the given action and severity.

yaml
type: io.kestra.plugin.ee.crowdstrike.ioc.CreateIOC

Examples

Block a malicious domain for 30 days

yaml
id: create_ioc
namespace: company.team

tasks:
  - id: create_ioc
    type: io.kestra.plugin.ee.crowdstrike.ioc.CreateIOC
    clientId: "{{ secret('CROWDSTRIKE_CLIENT_ID') }}"
    clientSecret: "{{ secret('CROWDSTRIKE_CLIENT_SECRET') }}"
    iocType: DOMAIN
    value: "malicious.example.com"
    action: PREVENT
    severity: HIGH
    platforms:
      - "windows"
      - "linux"
    expirationDays: 30

Properties

action *string

Possible Values

NO_ACTIONALLOWPREVENTDETECT

Action

Action CrowdStrike takes when this indicator is observed.

clientId *string

API client ID

Client ID of a CrowdStrike API client with the scopes required by the tasks and triggers being used.

clientSecret *string

API client secret

Client secret of the CrowdStrike API client. Exchanged for a short-lived OAuth2 Bearer token on every task run and trigger poll; never logged.

iocType *string

Possible Values

DOMAINIPV4IPV6MD5SHA256

Indicator type

appliedGlobally booleanstring

Defaulttrue

Apply globally

Whether this indicator applies to every host in your CrowdStrike environment. CrowdStrike requires this to be set (this task does not yet support scoping an indicator to specific host groups). Defaults to true.

baseUrl string

Defaulthttps://api.crowdstrike.com

CrowdStrike API base URL

Base URL of the CrowdStrike Falcon API for your cloud region (for example: https://api.crowdstrike.com for US-1, https://api.us-2.crowdstrike.com for US-2, https://api.eu-1.crowdstrike.com for EU-1, or https://api.laggar.gcw.crowdstrike.com for US-GOV-1). Defaults to the US-1 endpoint. Using the wrong region for your tenant results in 403 Forbidden responses.

expirationDays integerstring

Expiration, in days

Number of days from now until this indicator expires, from 1 to 365. Converted to an RFC-3339 expiration timestamp before being sent to the CrowdStrike API. Never expires when omitted.

platforms array

SubTypestring

Platforms

Platforms this indicator applies to (for example: windows, linux, mac). Applies to all platforms when omitted.