FalconCrowstrikeCustomIOC Responder v2

[nicoctn]

Hello,

As the Swagger API create_ioc & IOCs endpoint are now deprecated (issue #904), the previous Falcon responser does not work anymore. But I’ve been able to rebuilt it (based on ag-michael previous work) using the new IOC.indicator_create() method from falconpy instead. Here are some modifications I’ve added to this responder:

Choice of the severity level when IOCs are ingested by Falcon CustomIOC:

• informational
• low
• medium
• high (default)
• critical

Choice of how the IOCs are ingested by Falcon CustomIOC:

• no_action: Save the indicator for future use, but take no action. No severity required.
• detect: Enable detections for the indicator at the selected severity.

Choice of the tag added to TheHive (Default: « Falcon:Custom IOC Uploaded »)

Choice of the tag added to Falcon (Default: « Cortex Incident - FalconCustomIOC »)

Choice of the expiration date by IOC types (in days) - 30 days by default:

• Domains (including subdomains & FQDN)
• IP addresses (including ipv4 & ipv6)
• Hashes (sha256 & md5 - sha1 not supported)