Repository navigation
Add CrowdStrike IOC publishing workflow action - #946
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8424a584bf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| address = ipaddress.ip_address(value) | ||
| return f"ipv{address.version}", str(address) | ||
| domain = value.rstrip(".").encode("idna").decode("ascii").lower() | ||
| if len(domain) > 253 or any( |
There was a problem hiding this comment.
For a syntactically valid DNS name between 201 and 253 characters, this validation accepts the value and proceeds to the Falcon lookup/create call, although CrowdStrike documents custom domain IOCs as having a maximum length of 200 characters in the IOC API reference. The provider rejection then marks the invocation as failed—and can leave other indicators partially published—instead of classifying the attribute as malformed before network access; use Falcon's 200-character limit here.
Useful? React with 👍 / 👎.
Add
crowdstrike_ioc_publish, a workflow action that creates and renews Falcon custom IOCs directly from supplied MISP events and object attributes. It supports MD5, SHA-256, domains/hostnames, IPv4/IPv6, domain/IP composites, and the hash component of supported file composites.The action requires explicit Falcon host-group or global scope, publishes only IDS-marked non-deleted attributes, validates and normalizes supported values (including Falcon's 200-character domain limit after IDNA encoding), and deduplicates by type/value while returning all contributing source references.
detectis the default action;preventis restricted to file hashes. Expiration is configurable from 1 to 365 days.Before writing, it looks up the exact IOC and updates only records whose source namespace and fixed module ownership tag both match. Foreign, parent, ambiguous or incomplete matches fail without overwriting those records. Updates preserve existing Falcon tags. Errors, warnings, missing acknowledgements, rate limits and uncertain outcomes are reported per indicator, with a top-level failure and counts when publication is partial. Writes are not automatically retried and absent MISP data does not cause deletions.
Credentials stay on the module server in
CROWDSTRIKE_CLIENT_IDandCROWDSTRIKE_CLIENT_SECRET; the region selects a fixed commercial Falcon endpoint. Includes a dry-run mode, limits of 100 unique indicators and a processing time budget, and a setup guide explaining scope, ownership, workflow return behavior and lifecycle limitations. Workflow filters are explicitly unsupported, and extracted/filter payloads are rejected rather than ignored.Validation:
git diff --checkpass; generated module documentation matches metadata.No live Falcon tenant was contacted or modified.
crowdstrike-falconpyis already an optional dependency, so no dependency change is needed. Existing strictfileanddomain-ipobject templates work without extensions; no misp-objects PR is required.