How do I compare new indicators with indicators that already exist in the crowdstrike system?

[NSH531]

I wrote this code:

`

    falcon = falconpy.APIHarness(client_id="____",                    client_secret="????"
                )

    BODY = {
    "ids": [indic]
    }
    response3 = falcon.command("QueryIntelIndicatorEntities",
                      limit=2500000,
                      filter="indicator"
                      )

    li=[]       
    x=y.conn()["body"]
    x1=x["resources"]

    for i in x1:

        cond=(indic == i["indicator"])
        
        li.append(cond)
        if(cond):
            return "found "+indic
        return "not found"

`
I glad to any help on this and migrate code of ideas from my code on falconpy
@jshcodes

[jshcodes]

Can we get a little more detail on the goal here? The code above will generate an error as 2.5 million far exceeds the maximum limit of 5000 indicators per request. Are you wanting to confirm an indicator exists within CrowdStrike Intel? (example: A specific hash)

[NSH531]

I would like to send a batch of the indicators to the crowdstrike intelligence and get an answer for each of the indicators whether there is a crowdstrike indicator database or whether the indicator does not yet exist in the indicator database

[jshcodes]

We should leverage the filter keyword in this scenario.

Something along the lines of:

from falconpy import Intel

intel = Intel(client_id="FALCON_CLIENT_ID",
              client_secret="FALCON_CLIENT_SECRET"
              )

# Probably should not exceed 500 indicators at a time with this list. 
# It has the potential to exceed the maximum header length.
indicators = ['indicator1', 'indicator2', 'indicator3', 'etc.']

result = intel.query_indicator_entities(filter=f"indicator:{indicators}")

[jshcodes]

Using the Uber Class, this would look like:

from falconpy import APIHarness

intel = APIHarness(client_id="FALCON_CLIENT_ID",
                   client_secret="FALCON_CLIENT_SECRET"
                   )

# Probably should not exceed 500 indicators at a time with this list. 
# It has the potential to exceed the maximum header length.
indicators = ['indicator1', 'indicator2', 'indicator3', 'etc.']

result = falcon.command("QueryIntelIndicatorEntities", filter=f"indicator:{indicators}")

[NSH531]

But running the above code and taking me a while

[NSH531]

pls see http://github.com/crowdstrike/falconpy/issues/627
@jshcodes

[jshcodes]

Hi @NSH531 -

I've posted another solution to the issue you opened. Check it out and let us know if you have any questions or problems.