CrowdStrike UpdateIOC

CrowdStrike UpdateIOC
Certified
Enterprise Edition
Update a CrowdStrike Falcon custom indicator of compromise

Patches the action, severity, and/or expiration of an existing custom IOC. At least one of action, severity, or expirationDays must be set.

yaml
type: io.kestra.plugin.ee.crowdstrike.ioc.UpdateIOC

Examples

Escalate an indicator to prevent and extend its expiration

yaml
id: update_ioc
namespace: company.team

tasks:
  - id: update_ioc
    type: io.kestra.plugin.ee.crowdstrike.ioc.UpdateIOC
    clientId: "{{ secret('CROWDSTRIKE_CLIENT_ID') }}"
    clientSecret: "{{ secret('CROWDSTRIKE_CLIENT_SECRET') }}"
    iocId: "4f8b9c1a2d3e4f5061728394a5b6c7d"
    action: PREVENT
    severity: CRITICAL
    expirationDays: 90

Properties

clientId *string

API client ID

Client ID of a CrowdStrike API client with the scopes required by the tasks and triggers being used.

clientSecret *string

API client secret

Client secret of the CrowdStrike API client. Exchanged for a short-lived OAuth2 Bearer token on every task run and trigger poll; never logged.

action string

Possible Values

NO_ACTIONALLOWPREVENTDETECT

Action

New action CrowdStrike takes when this indicator is observed.

baseUrl string

Defaulthttps://api.crowdstrike.com

CrowdStrike API base URL

Base URL of the CrowdStrike Falcon API for your cloud region (for example: https://api.crowdstrike.com for US-1, https://api.us-2.crowdstrike.com for US-2, https://api.eu-1.crowdstrike.com for EU-1, or https://api.laggar.gcw.crowdstrike.com for US-GOV-1). Defaults to the US-1 endpoint. Using the wrong region for your tenant results in 403 Forbidden responses.