IOC Management

Create, modify, and delete custom indicators of compromise (IOCs) to enhance threat detection and prevention across your environment.

Cmdlets

Edit-FalconIoc

Modify custom indicators. Permissions: IOC Manager APIs: Write

object[]

One or more indicators to modify in a single request

string

Action to perform when a host observes the indicator

string[]

Operating system platform

string

Severity level

string

Origination source (1-256 characters)

string

Indicator description

string

Indicator filename, used with hash values

string[]

Indicator tag

string

Action to perform when a mobile device observes the indicator. Valid values: allow, detect, no_action, prevent

string[]

Host group identifier (32-character hex)

boolean

Assign to all host groups

string

Expiration date and time (UTC ISO 8601). When an indicator expires it is set to ‘no_action’

boolean

Inheritance from parent CID

string

Audit log comment

boolean

Generate retroactive detections for hosts that have observed the indicator

boolean

Ignore warnings and modify all indicators

string

required

Indicator identifier (64-character hex)

Example

# Update an indicator's severity
Edit-FalconIoc -Id '1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef' -Severity 'high' -Comment 'Updated severity based on new intelligence'

# Change action to prevent
Edit-FalconIoc -Id '1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef' -Action 'prevent' -Retrodetect $true

# Set expiration date
Edit-FalconIoc -Id '1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef' -Expiration '2024-12-31T23:59:59Z'

Get-FalconIoc

Search for custom indicators. Permissions: IOC Manager APIs: Read

string[]

Indicator identifier (64-character hex)

string

Falcon Query Language expression to limit results

string

Property and direction to sort results. Valid values:

action.asc, action.desc
applied_globally.asc, applied_globally.desc
metadata.av_hits.asc, metadata.av_hits.desc
metadata.company_name.raw.asc, metadata.company_name.raw.desc
created_by.asc, created_by.desc
created_on.asc, created_on.desc
expiration.asc, expiration.desc
expired.asc, expired.desc
metadata.filename.raw.asc, metadata.filename.raw.desc
modified_by.asc, modified_by.desc
modified_on.asc, modified_on.desc
severity_number.asc, severity_number.desc
source.asc, source.desc
type.asc, type.desc
value.asc, value.desc

int32

Maximum number of results per request (1-2000)

boolean

Inheritance from parent CID

int32

Position to begin retrieving results

string

Pagination token to retrieve the next set of results

switch

Retrieve detailed information

switch

Repeat requests until all available results are retrieved

switch

Display total result count instead of results

Example

# Get all custom IOCs
Get-FalconIoc -All -Detailed

# Search for indicators by type
Get-FalconIoc -Filter "type:'ipv4'" -Detailed

# Get indicators created in the last 24 hours
Get-FalconIoc -Filter "created_on:>'now-24h'" -Sort created_on.desc

# Get specific indicator by ID
Get-FalconIoc -Id '1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef'

# Get indicators set to 'prevent' action
Get-FalconIoc -Filter "action:'prevent'" -All

Get-FalconIocAction

Search for custom indicator actions. Permissions: IOC Manager APIs: Read

string[]

Custom indicator action identifier

int32

Maximum number of results per request

int32

Position to begin retrieving results

switch

Retrieve detailed information

switch

Repeat requests until all available results are retrieved

Example

# Get all available IOC actions
Get-FalconIocAction -Detailed

Get-FalconIocPlatform

List custom indicator platforms. Permissions: IOC Manager APIs: Read

int32

Maximum number of results per request

int32

Position to begin retrieving results

switch

Repeat requests until all available results are retrieved

Example

# List all supported platforms
Get-FalconIocPlatform

Get-FalconIocSeverity

List custom indicator severities. Permissions: IOC Manager APIs: Read

int32

Maximum number of results per request

int32

Position to begin retrieving results

switch

Repeat requests until all available results are retrieved

Example

# List all severity levels
Get-FalconIocSeverity

Get-FalconIocType

List custom indicator types. Permissions: IOC Manager APIs: Read

int32

Maximum number of results per request

int32

Position to begin retrieving results

switch

Repeat requests until all available results are retrieved

Example

# List all available IOC types
Get-FalconIocType

New-FalconIoc

Create custom indicators. Permissions: IOC Manager APIs: Write

object[]

One or more indicators to create in a single request

string

required

Indicator type

string

required

String representation of the indicator

string

required

Action to perform when a host observes the indicator

string[]

required

Operating system platform

string

required

Severity level

string

Origination source (1-256 characters)

string

Indicator description

string

Indicator filename, used with hash values

string[]

Indicator tag

string

Action to perform when a mobile device observes the indicator. Valid values: allow, detect, no_action, prevent

string[]

Host group identifier (32-character hex). Required if AppliedGlobally is not set

boolean

Assign to all host groups. Required if HostGroup is not set

string

Expiration date and time (UTC ISO 8601). When an indicator expires it is set to ‘no_action’

string

Audit log comment

boolean

Generate retroactive detections for hosts that have observed the indicator

boolean

Ignore warnings and create all indicators

Example

# Create a malicious IP indicator
New-FalconIoc -Type 'ipv4' -Value '192.0.2.100' -Action 'prevent' -Platform 'windows','linux','mac' -Severity 'high' -Source 'Threat Intel Feed' -Description 'C2 server identified by threat intelligence' -AppliedGlobally $true -Comment 'Added from threat feed'

# Create a file hash indicator
New-FalconIoc -Type 'sha256' -Value 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855' -Action 'detect' -Platform 'windows' -Severity 'medium' -Filename 'malware.exe' -AppliedGlobally $true -Retrodetect $true

# Create a domain indicator with expiration
New-FalconIoc -Type 'domain' -Value 'malicious-site.com' -Action 'prevent' -Platform 'windows','mac' -Severity 'critical' -Tag 'phishing','campaign-2024' -AppliedGlobally $true -Expiration '2024-12-31T23:59:59Z'

# Create indicator for specific host groups
$HostGroups = @('a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6', 'p6o5n4m3l2k1j0i9h8g7f6e5d4c3b2a1')
New-FalconIoc -Type 'ipv4' -Value '198.51.100.50' -Action 'detect' -Platform 'linux' -Severity 'low' -HostGroup $HostGroups

Remove-FalconIoc

Remove custom indicators. Permissions: IOC Manager APIs: Write

string

Falcon Query Language expression to find indicators for removal

string

Audit log comment

boolean

Inheritance from parent CID

string[]

Indicator identifier (64-character hex)

Example

# Remove a specific indicator
Remove-FalconIoc -Id '1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef' -Comment 'False positive'

# Remove expired indicators
Remove-FalconIoc -Filter "expired:true" -Comment 'Cleanup expired IOCs'

# Remove indicators by tag
Remove-FalconIoc -Filter "tags:'temp-investigation'" -Comment 'Investigation closed'

IOC Management Workflow

Identify Threat Indicators

Obtain IOC values from threat intelligence feeds, incident investigations, or security research.

Validate IOC Types

Use Get-FalconIocType to verify supported indicator types (IPv4, domain, SHA256, etc.).

Create Indicators

Use New-FalconIoc to create indicators with appropriate action, severity, and scope.

Monitor and Update

Use Get-FalconIoc to review existing indicators and Edit-FalconIoc to update as needed.

Clean Up

Remove outdated or false positive indicators using Remove-FalconIoc.

Best Practices

Use Expiration Dates

Set expiration dates on temporary IOCs to automatically prevent them from blocking legitimate traffic after investigations conclude.

Enable Retrodetection Carefully

Use the Retrodetect parameter when creating or editing IOCs only when you need to identify past compromises. This can generate significant detections.

Tag for Organization

Apply meaningful tags to group related indicators (e.g., by campaign, threat actor, or investigation ID) for easier management.

Document with Comments

Always use the Comment parameter to maintain an audit trail of why indicators were created, modified, or removed.

Falcon Intelligence

Access CrowdStrike threat intelligence

Detections

Manage and investigate detections

Overview

Authentication

Alerts & Detections

Host Management

Real-time Response

Threat Intelligence

Policy Management

Cloud Security

Identity & Access

Security Operations

Monitoring & Analysis

Utilities

Cmdlets

Edit-FalconIoc

Get-FalconIoc

Get-FalconIocAction

Get-FalconIocPlatform

Get-FalconIocSeverity

Get-FalconIocType

New-FalconIoc

Remove-FalconIoc

IOC Management Workflow

Best Practices

Falcon Intelligence

Detections

​Cmdlets

​Edit-FalconIoc

​Get-FalconIoc

​Get-FalconIocAction

​Get-FalconIocPlatform

​Get-FalconIocSeverity

​Get-FalconIocType

​New-FalconIoc

​Remove-FalconIoc

​IOC Management Workflow

​Best Practices

​Related Resources

Falcon Intelligence

Detections

Cmdlets

Edit-FalconIoc

Get-FalconIoc

Get-FalconIocAction

Get-FalconIocPlatform

Get-FalconIocSeverity

Get-FalconIocType

New-FalconIoc

Remove-FalconIoc

IOC Management Workflow

Best Practices

Related Resources