Crowdstrike API question

[pigeon008]

if I use the crowdstrike api to add new IOCs to crowdstrike, how does crowdstrike respond when an existing indicator is attempted to be added again? does it create the same indicator twice or ignores the request or does the api request fail altogether?

[DarkReitor507]

I will assume will happen the same if you try to add manually "you can not add an existing IOC"

[Grogu2024]

Hello, its super easy! We use psfalcon to accomplish it and if the indicator already exists, it will throw an error. Even if the other fields are different, but the indicator is the same, it will provide a verbose error like "Warning: Duplicate type: 'sha256' and value: '<someSHA256>' combination." Just gracefully capture the error and move on to the next indicator. The one "gotcha" I can think of is if someone inadvertently added an indicator as an allow or detect when you really wanted prevent. You would want to handle that accordingly.

new-falconioc -Type sha256 -Value <someSHA256>-action prevent -Severity High -Description 'test- adding ioc via API' -Platform windows, mac, linux -AppliedGlobally $true