-
Notifications
You must be signed in to change notification settings - Fork 130
Intelligence Indicator Graph
Joshua Hiller edited this page Apr 21, 2025
·
1 revision
Operation ID | Description | ||||
---|---|---|---|---|---|
|
Search indicators based on FQL filter. |
Search indicators based on FQL filter.
search
Method | Route |
---|---|
/intelligence/combined/indicators/v1 |
- Produces: application/json
Name | Service | Uber | Type | Data type | Description |
---|---|---|---|---|---|
body | body | dictionary | Full body payload as JSON formatted dictionary. | ||
filter | body | string | FQL formatted filter. | ||
limit | query | integer | Limit | ||
offset | query | string | Offset | ||
parameters | query | dictionary | Full query parameters payload as a dictionary, not required when using other keywords. | ||
sort | body | dictionary or list of dictionaries | List of sort operations to perform on the resultset. |
from falconpy import IntelligenceIndicatorGraph
falcon = IntelligenceIndicatorGraph(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
sort_order = {
"field": "string",
"order": "string"
}
response = falcon.search(limit=integer, offset="string", filter="string", sort=sort_order)
print(response)
from falconpy import IntelligenceIndicatorGraph
falcon = IntelligenceIndicatorGraph(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
sort_order = {
"field": "string",
"order": "string"
}
response = falcon.SearchIndicators(limit=integer,
offset="string",
filter="string",
sort=sort_order
)
print(response)
from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID,
client_secret=CLIENT_SECRET
)
body_payload = {
"filter": "string",
"sort": [
{
"field": "string",
"order": "string"
}
]
}
response = falcon.command("SearchIndicators", limit="string", offset="string", body=body_payload)
print(response)
- Home
- Discussions Board
- Glossary of Terms
- Installation, Upgrades and Removal
- Samples Collection
- Using FalconPy
- API Operations
-
Service Collections
- Alerts
- API Integrations
- ASPM
- CAO Hunting
- Certificate Based Exclusions
- Cloud AWS Registration
- Cloud Azure Registration
- Cloud OCI Registration
- Cloud Connect AWS (deprecated)
- Cloud Security Assets
- Cloud Snapshots
- Configuration Assessment
- Configuration Assessment Evaluation Logic
- Container Alerts
- Container Detections
- Container Image Compliance
- Container Images
- Container Packages
- Container Vulnerabilities
- Content Update Policies
- Correlation Rules
- CSPM Registration
- Custom IOAs
- Custom Storage
- D4C Registration (deprecated)
- DataScanner (deprecated)
- Delivery Settings
- Deployments
- Detects
- Device Content
- Device Control Policies
- Discover
- Downloads
- Drift Indicators
- Event Streams
- Exposure Management
- FaaS Execution
- Falcon Complete Dashboard
- Falcon Container
- Falcon Intelligence Sandbox
- FDR
- FileVantage
- Firewall Management
- Firewall Policies
- Foundry LogScale
- Host Group
- Host Migration
- Hosts
- Identity Protection
- Image Assessment Policies
- Incidents
- Installation Tokens
- Intel
- Intelligence Feeds
- Intelligence Indicator Graph
- IOA Exclusions
- IOC
- IOCs (deprecated)
- Kubernetes Protection
- MalQuery
- Message Center
- ML Exclusions
- Mobile Enrollment
- MSSP (Flight Control)
- NGSIEM
- OAuth2
- ODS (On Demand Scan)
- Overwatch Dashboard
- Prevention Policy
- Quarantine
- Quick Scan
- Quick Scan Pro
- Real Time Response
- Real Time Response Admin
- Real Time Response Audit
- Recon
- Report Executions
- Response Policies
- Sample Uploads
- Scheduled Reports
- Sensor Download
- Sensor Update Policy
- Sensor Usage
- Sensor Visibility Exclusions
- Serverless Vulnerabilities
- Spotlight Evaluation Logic
- Spotlight Vulnerabilities
- Tailored Intelligence
- ThreatGraph
- Unidentified Containers
- User Management
- Workflows
- Zero Trust Assessment
- Documentation Support
-
CrowdStrike SDKs
- Crimson Falcon - Ruby
- FalconPy - Python 3
- FalconJS - Javascript
- goFalcon - Go
- PSFalcon - Powershell
- Rusty Falcon - Rust