Threat Intelligence

# Create a malicious domain indicator
New-FalconIoc -Type domain `
  -Value 'malicious.example.com' `
  -Action detect `
  -Platform @('windows', 'mac', 'linux') `
  -Severity high `
  -Description 'C2 domain from incident IR-2024-001' `
  -Tag @('C2', 'Incident-2024-001')

# Create a SHA256 hash indicator with prevention
New-FalconIoc -Type sha256 `
  -Value 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855' `
  -Action prevent `
  -Platform @('windows') `
  -Severity critical `
  -Filename 'malware.exe' `
  -Description 'Ransomware payload'

# Apply indicator to specific host groups
$Groups = Get-FalconHostGroup -Filter "name:*'Production'*"

New-FalconIoc -Type domain `
  -Value 'threat.local' `
  -Action prevent `
  -HostGroup @($Groups[0].id) `
  -Description 'Block in production only'

# Apply globally to all hosts
New-FalconIoc -Type ipv4 `
  -Value '192.0.2.100' `
  -Action prevent `
  -AppliedGlobally $true `
  -Description 'Global threat IP'

# Enable retrodetect to generate detections for past activity
Edit-FalconIoc -Id $IndicatorId -Retrodetect $true

# Create new indicator with retrodetect
New-FalconIoc -Type sha256 `
  -Value $FileHash `
  -Action detect `
  -Retrodetect $true `
  -Description 'Check historical executions'

# Get all available reports
Get-FalconIntel -Detailed -All

# Search by keyword
Get-FalconIntel -Query 'ransomware' -Detailed

# Filter by report type
Get-FalconIntel -Filter "type:'intelligence report'" -Detailed

# Search by target industry
Get-FalconIntel -Filter "target_industries:'Financial Services'" -Detailed

# Find recent reports
Get-FalconIntel -Filter "created_date:>='now-30d'" -Sort created_date.desc -Detailed

# Get report details
$Report = Get-FalconIntel -Filter "name:*'APT29'*" -Detailed | Select-Object -First 1

# Download report PDF
Receive-FalconIntel -Id $Report.id -Path "./reports/$($Report.slug).pdf"

# Bulk download recent reports
Get-FalconIntel -Filter "created_date:>='now-7d'" | ForEach-Object {
    Receive-FalconIntel -Id $_.id -Path "./reports/$($_.slug).pdf"
}

# List all tracked actors
Get-FalconActor -Detailed -All

# Search by name
Get-FalconActor -Query 'BEAR' -Detailed

# Filter by target country
Get-FalconActor -Filter "target_countries:'United States'" -Detailed

# Find actors by capability
Get-FalconActor -Filter "target_industries:'Technology'" -Detailed

# Get actor with TTPs
$Actor = Get-FalconActor -Filter "name:'FANCY BEAR'" -Include tactic_and_technique -Detailed

# View techniques used by actor
$Actor.tactic_and_technique

# Download MITRE ATT&CK data
Receive-FalconAttck -Slug $Actor.slug -Format json -Path './intel/'

# Get detailed TTP information
Get-FalconAttck -Slug $Actor.slug | Get-FalconAttck

# Find recent malicious indicators
Get-FalconIndicator -Filter "published_date:>='now-7d'" -Detailed -All

# Search by indicator type
Get-FalconIndicator -Filter "type:'domain'" -Detailed -Limit 100

# Find indicators by malware family
Get-FalconIndicator -Filter "malware_families:'emotet'" -Detailed

# Include related indicators
Get-FalconIndicator -Filter "indicator:'192.0.2.*'" -IncludeRelation $true -Detailed

# Get high-confidence recent indicators
$Indicators = Get-FalconIndicator -Filter "_marker:>='90'+published_date:>='now-1d'" -Detailed -All

# Convert to custom IOCs
foreach ($Indicator in $Indicators) {
    try {
        New-FalconIoc -Type $Indicator.type `
          -Value $Indicator.indicator `
          -Action detect `
          -Source "Falcon Intel: $($Indicator.malware_families -join ', ')" `
          -Description "Imported from intelligence report" `
          -Severity high
        
        Write-Host "Imported: $($Indicator.indicator)"
    }
    catch {
        Write-Warning "Failed to import $($Indicator.indicator): $_"
    }
}

# List malware families
Get-FalconMalwareFamily -Detailed -All

# Search by name
Get-FalconMalwareFamily -Query 'ransomware' -Detailed

# Get MITRE ATT&CK for malware family
$Family = Get-FalconMalwareFamily -Filter "name:'WannaCry'" -Detailed
Get-FalconMalwareFamily -Id $Family.id -Mitre

# Download MITRE data
Receive-FalconMalwareFamilyAttck -Slug $Family.slug -Format JSON -Path './intel/'

# Search for CVE information
Get-FalconCve -Query 'Microsoft Exchange' -Detailed -All

# Find recent critical CVEs
Get-FalconCve -Filter "created_date:>='now-30d'" -Detailed

# Get specific CVE details
Get-FalconCve -Id 'CVE-2024-1234'

# Search by CVSS score
Get-FalconCve -Filter "cvss_score:>=9.0" -Detailed

# Get latest Snort/Suricata ruleset
Get-FalconRule -Type snort-suricata-master -Detailed

# Download latest rules
$LatestRules = Get-FalconRule -Type snort-suricata-master | Select-Object -First 1
Receive-FalconRule -Id $LatestRules.id -Path './rules/snort-latest.zip'

# Get rule changelog
Get-FalconRule -Type snort-suricata-changelog -Detailed -All

# Get latest YARA rules
$YaraRules = Get-FalconRule -Type yara-master -Detailed | Select-Object -First 1

# Download YARA ruleset
Receive-FalconRule -Id $YaraRules.id -Path './rules/yara-master.zip'

# Get incremental updates
Get-FalconRule -Type yara-update -Detailed -All

# Daily import of new high-confidence indicators
function Import-DailyIntelligence {
    # Get yesterday's high-confidence indicators
    $Indicators = Get-FalconIndicator -Filter "published_date:>='now-1d'+_marker:>=85" -Detailed -All
    
    $ImportCount = 0
    $SkipCount = 0
    
    foreach ($Indicator in $Indicators) {
        # Check if already imported
        $Existing = Get-FalconIoc -Filter "value:'$($Indicator.indicator)'" -Detailed
        
        if (-not $Existing) {
            try {
                New-FalconIoc -Type $Indicator.type `
                  -Value $Indicator.indicator `
                  -Action detect `
                  -Platform @('windows', 'mac', 'linux') `
                  -Severity medium `
                  -Source 'Auto-Import' `
                  -Description "Intel: $($Indicator.malware_families -join ', ')" `
                  -Tag @('AutoImport', (Get-Date -Format 'yyyy-MM-dd'))
                
                $ImportCount++
            }
            catch {
                Write-Warning "Failed: $($Indicator.indicator) - $_"
            }
        }
        else {
            $SkipCount++
        }
    }
    
    Write-Host "Imported: $ImportCount | Skipped (existing): $SkipCount"
}

# Run the import
Import-DailyIntelligence