This is repurposed code from a crowdstrike engineer to do what I needed. I re-wrote 5-10% how I would want to use it with one function and append to a data frame.
Need: If you have crowstrike falcon prime and need to search for a csv of malicious ip's, and want to append the intel to your csv of ip's.
You need to get your base url, client secret and client id (remember not to hard code why I use getpass).
-
- Change the csv paths
-
- Install falconpy and other dependencies
-
- Run
-
- It will prompt you for the three things mentioned above
- I was threat hunting over a huge area with little integration to crowd strikes tools. So, this saved me a ton of time gathering intel on malicous IP's that were fuzzing or attempting to exploit.
***If you have issues and need help reach out to [email protected]
