Create Indicator

Create an indicator for a possible breach.

Basic Parameters

Parameter	Description
Action	The type of action to apply to detections based on the indicator.
Applied Globally	Check to apply the indicator globally across your account. NOTE: If this field is not checked, Host Groups must be provided.
Comment	An audit log comment to add to the creation of the indicator.
Description	A description for the created indicator.
Expiration Date	An expiration date for the created indicator.
Filename	Specify to direct the indicator to a single file by its name.
Host Groups	A comma-separated list of host groups to apply the indicator to. NOTE: If the indicator is not applied globally, this field must be provided.
Mobile Action	Add a mobile action to be initiated in response to detections of this indicator.
Platforms	A comma-separated list of platforms to apply the indicator to.
Severity	The severity of incidents created based on the created indicator.
Source	A source for the indicator.
Tags	A comma-separated list of tags for the created indicator.
Type	The type of indicator.
Value	The value of the indicator.

Advanced Parameters

Parameter	Description
Ignore Warnings	Check to ignore warnings.
Submit To RetroDetects	Whether to submit to RetroDetects.

Example Output

{
	"meta": {
		"query_time": 2,
		"pagination": {
			"limit": 0,
			"total": 2
		},
		"powered_by": "<string>",
		"trace_id": "<string>"
	},
	"errors": null,
	"resources": [
		{
			"id": "<string>",
			"type": "<string>",
			"value": "<string>",
			"action": "<string>",
			"severity": "<string>",
			"description": "<string>",
			"platforms": [
				"<string>",
				"<string>"
			],
			"expired": false,
			"deleted": false,
			"applied_globally": true,
			"from_parent": false,
			"created_on": "<string>",
			"created_by": "<string>",
			"modified_on": "<string>",
			"modified_by": "<string>"
		}
	]
}

Workflow Library Example

Create Indicator with Crowdstrike and Send Results Via Email

Preview this Workflow on desktop