CrowdStrike Falcon Intelligence (Intel) API

This is reference documentation. The agent-invokable lookup skill is /lookup-crowdstrike; the runtime CLI is tools/clis/crowdstrike.py. Read this file when the lookup skill's options are not enough and you need to know which raw endpoint to hit, what fields a response carries, or how to construct an FQL query the CLI does not expose directly.

Source of truth: https://developer.crowdstrike.com/api-reference/collections/intel/

Base URL

OAuth2 base differs by cloud region. The Intel path prefix is /intel/.

Override with CROWDSTRIKE_BASE_URL (or --base-url). FalconPy also accepts the short names us-1, us-2, eu-1, usgov1.

Authentication

OAuth2 client-credentials flow:

1. POST /oauth2/token with form-encoded client_id and client_secret.
2. Response: {"access_token": "<jwt>", "expires_in": 1799, "token_type": "bearer"}.
3. All subsequent requests carry Authorization: Bearer <access_token>.

FalconPy performs this exchange and refresh automatically when given client_id= / client_secret=.

# Manual token exchange
TOKEN=$(curl -s -X POST "https://api.crowdstrike.com/oauth2/token" \
  -d "client_id=$CROWDSTRIKE_CLIENT_ID&client_secret=$CROWDSTRIKE_CLIENT_SECRET" | jq -r .access_token)

# Subsequent call
curl -s "https://api.crowdstrike.com/intel/combined/actors/v1?filter=origins.slug%3A%27ru%27&limit=10" \
  -H "Authorization: Bearer $TOKEN"

The API client needs the Intel scopes: Indicators (Falcon Intelligence): Read, Actors (Falcon Intelligence): Read, Reports (Falcon Intelligence): Read, and Rules (Falcon Intelligence): Read for rule-set endpoints. Create it in the Falcon console → Support and resources → API clients and keys. If the env vars are unset, inform the user to run /cti-setup or ./scripts/setup.sh.

Rate limits

Per-tenant token bucket. Responses carry X-RateLimit-Limit and X-RateLimit-Remaining. On exhaustion the API returns HTTP 429 with a Retry-After: <seconds> header — back off and retry. 429 is also returned briefly if you call before the OAuth token is minted.

Falcon Query Language (FQL)

Query/combined endpoints accept a filter parameter in FQL:

• Equality: malicious_confidence:'high', name:'FANCY BEAR' (actor name; exact match)
• Country slugs are ISO 3166-1 alpha-2 codes, not names: origins.slug:'ru' (Russia), 'cn' (China), 'ir' (Iran), 'kp' (North Korea), target_countries.slug:'us'
• Other nested arrays use word slugs: target_industries.slug:'financial-services', motivations.slug:'state-sponsored', actors.slug:'mustang-panda'
• Comparisons / dates: created_date:>'2025-01-01', last_updated:>=1704067200
• Boolean combine: + = AND, , = OR. e.g. origins.slug:'cn'+target_industries.slug:'government'
• Free-text: the separate q parameter does a fuzzy text match across the entity (used by actor/reports --search)
• Sort: sort=created_date|desc, sort=last_activity_date|desc. name is not a sortable field on the actors endpoint — sorting by it silently returns zero results
• Page: limit (max 5000 for most, 10000 for indicators) + offset

Capability map

The CLI wraps the bold-path subset (actors, indicators, reports, mitre-attacks, mitre-reports). The rest are reachable directly via FalconPy if a skill needs them.

Key endpoints — examples

Indicator (IOC) lookup

# Single-value lookup (CLI: `indicator <value>`)
curl -s "https://api.crowdstrike.com/intel/combined/indicators/v1?filter=indicator%3A%271.1.1.1%27&limit=50" \
  -H "Authorization: Bearer $TOKEN"

# Browse/sweep the feed — latest high-confidence malicious IOCs (CLI: `indicators --malicious`)
curl -s "https://api.crowdstrike.com/intel/combined/indicators/v1?filter=malicious_confidence%3A%27high%27&sort=published_date%7Cdesc&limit=10" \
  -H "Authorization: Bearer $TOKEN"

type values are: ip_address, domain, url, hash_md5, hash_sha1, hash_sha256, email_address, file_name, mutex_name, registry, service_name, username, persona_name, x509_serial, x509_subject (and more). Combine confidence + type + actors:'<slug>' + malware_families:'<fam>' + published_date:>EPOCH with +. Requires the Indicators (Falcon Intelligence): Read scope — without it the endpoint returns HTTP 403 "scope not permitted" even though Actors/Reports work.

Response resources[] highlights: indicator, type (ip_address/domain/hash_sha256/url/…), malicious_confidence (high/medium/low/unverified), actors[] (slugs), malware_families[], kill_chains[], threat_types[], reports[] (report IDs), labels[], relations[], published_date, last_updated.

Actor entities

# Search by origin (ISO country-code slug; sort by activity, NOT name)
curl -s "https://api.crowdstrike.com/intel/combined/actors/v1?filter=origins.slug%3A%27ru%27&sort=last_activity_date%7Cdesc&limit=30" \
  -H "Authorization: Bearer $TOKEN"

# Free-text profile lookup
curl -s "https://api.crowdstrike.com/intel/combined/actors/v1?q=Charming%20Kitten&limit=1" \
  -H "Authorization: Bearer $TOKEN"

Actor resources[] fields: id, name, slug, short_description, description, known_as, origins[], target_countries[], target_industries[], motivations[], capability, group, actor_type, first_activity_date, last_activity_date, url. Each origins/target_* element is {id, value, slug}.

Reports

# Latest reports for an actor
curl -s "https://api.crowdstrike.com/intel/combined/reports/v1?filter=actors.slug%3A%27mustang-panda%27&sort=created_date%7Cdesc&limit=5" \
  -H "Authorization: Bearer $TOKEN"

# Download a report PDF (binary)
curl -s "https://api.crowdstrike.com/intel/entities/report-files/v1?ids=CSA-250123" \
  -H "Authorization: Bearer $TOKEN" -o report.pdf

Report resources[] fields: id, name, title, slug, short_description, description, created_date, last_modified_date, actors[], target_countries[], target_industries[], motivations[], tags[], report_type, sub_type, url, attachments[].

MITRE ATT&CK for an actor

# Technique IDs mapped to an actor (by slug or id)
curl -s "https://api.crowdstrike.com/intel/combined/mitre-attacks/v1?id=charming-kitten" \
  -H "Authorization: Bearer $TOKEN"

# Full ATT&CK report — csv | json | json_navigator
curl -s "https://api.crowdstrike.com/intel/entities/mitre-reports/v1?actor_id=charming-kitten&format=json_navigator" \
  -H "Authorization: Bearer $TOKEN"

QueryMitreAttacks returns a flat list of ATT&CK technique IDs in resources[]. GetMitreReport returns the full mapping; json_navigator is an ATT&CK Navigator layer JSON you can load directly into the Navigator UI. Resolve technique IDs against the bundled dataset with /mitre-attack.

Response shape

FalconPy returns {status_code, headers, body} where body = {meta, resources, errors}. The CLI unwraps body.resources and emits a normalised envelope. See skills/lookup-crowdstrike/SKILL.md § Response format.