CrowdStrike SearchIOCs
CertifiedEnterprise EditionSearch CrowdStrike Falcon custom indicators of compromise
CrowdStrike SearchIOCs
Search CrowdStrike Falcon custom indicators of compromise
Searches custom IOCs with the CrowdStrike Falcon Query Language (FQL). Omitting filter matches every IOC visible to the API client.
type: io.kestra.plugin.ee.crowdstrike.ioc.SearchIOCsExamples
List every IOC that blocks execution
id: search_iocs
namespace: company.team
tasks:
- id: search_iocs
type: io.kestra.plugin.ee.crowdstrike.ioc.SearchIOCs
clientId: "{{ secret('CROWDSTRIKE_CLIENT_ID') }}"
clientSecret: "{{ secret('CROWDSTRIKE_CLIENT_SECRET') }}"
filter: "action:'prevent'"
limit: 100
Properties
clientId *string
API client ID
Client ID of a CrowdStrike API client with the scopes required by the tasks and triggers being used.
clientSecret *string
API client secret
Client secret of the CrowdStrike API client. Exchanged for a short-lived OAuth2 Bearer token on every task run and trigger poll; never logged.
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150baseUrl string
https://api.crowdstrike.comCrowdStrike API base URL
Base URL of the CrowdStrike Falcon API for your cloud region (for example: https://api.crowdstrike.com for US-1, https://api.us-2.crowdstrike.com for US-2, https://api.eu-1.crowdstrike.com for EU-1, or https://api.laggar.gcw.crowdstrike.com for US-GOV-1). Defaults to the US-1 endpoint. Using the wrong region for your tenant results in 403 Forbidden responses.
filter string
FQL filter
CrowdStrike Falcon Query Language expression (for example: action: 'prevent'). Matches every IOC when omitted.
limit integerstring
100Page size
Maximum number of IOCs to return, from 1 to 500. Defaults to 100.
offset integerstring
0Offset
Number of matching IOCs to skip, for pagination. Defaults to 0.
sort string
Sort order
Sort field and direction (for example: created_on.desc).
Outputs
ids array
Matching IOC IDs
records array
Matching IOC records
io.kestra.plugin.ee.crowdstrike.ioc.IocRecord
Action CrowdStrike takes when this indicator is observed.
UTC timestamp this indicator expires, ISO-8601. Absent for indicators without an expiration.
IOC ID.
Platforms this indicator applies to.
Indicator severity.
Indicator type: domain, ipv4, ipv6, md5, or sha256.
Indicator value.
total integer
Total number of IOCs matching the filter, without pagination
