CrowdStrike CreateIOC
CertifiedEnterprise EditionCreate a CrowdStrike Falcon custom indicator of compromise
CrowdStrike CreateIOC
Create a CrowdStrike Falcon custom indicator of compromise
Creates a custom IOC (domain, IP, or file hash) with the given action and severity.
type: io.kestra.plugin.ee.crowdstrike.ioc.CreateIOCExamples
Block a malicious domain for 30 days
id: create_ioc
namespace: company.team
tasks:
- id: create_ioc
type: io.kestra.plugin.ee.crowdstrike.ioc.CreateIOC
clientId: "{{ secret('CROWDSTRIKE_CLIENT_ID') }}"
clientSecret: "{{ secret('CROWDSTRIKE_CLIENT_SECRET') }}"
iocType: DOMAIN
value: "malicious.example.com"
action: PREVENT
severity: HIGH
platforms:
- "windows"
- "linux"
expirationDays: 30
Properties
action *string
NO_ACTIONALLOWPREVENTDETECTAction
Action CrowdStrike takes when this indicator is observed.
clientId *string
API client ID
Client ID of a CrowdStrike API client with the scopes required by the tasks and triggers being used.
clientSecret *string
API client secret
Client secret of the CrowdStrike API client. Exchanged for a short-lived OAuth2 Bearer token on every task run and trigger poll; never logged.
iocType *string
DOMAINIPV4IPV6MD5SHA256Indicator type
appliedGlobally booleanstring
trueApply globally
Whether this indicator applies to every host in your CrowdStrike environment. CrowdStrike requires this to be set (this task does not yet support scoping an indicator to specific host groups). Defaults to true.
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150baseUrl string
https://api.crowdstrike.comCrowdStrike API base URL
Base URL of the CrowdStrike Falcon API for your cloud region (for example: https://api.crowdstrike.com for US-1, https://api.us-2.crowdstrike.com for US-2, https://api.eu-1.crowdstrike.com for EU-1, or https://api.laggar.gcw.crowdstrike.com for US-GOV-1). Defaults to the US-1 endpoint. Using the wrong region for your tenant results in 403 Forbidden responses.
expirationDays integerstring
Expiration, in days
Number of days from now until this indicator expires, from 1 to 365. Converted to an RFC-3339 expiration timestamp before being sent to the CrowdStrike API. Never expires when omitted.
platforms array
Platforms
Platforms this indicator applies to (for example: windows, linux, mac). Applies to all platforms when omitted.
severity string
MEDIUMINFORMATIONALLOWMEDIUMHIGHCRITICALSeverity
Severity of this indicator. Defaults to MEDIUM.
value string
Indicator value
The domain, IP address, or file hash to match.
Outputs
id string
ID of the created IOC
