how to filter ip addresses indicator ONLY?

[NSH531]

thanks,netanel

[jshcodes]

Hi @NSH531 -

You should be able to use the filter keyword to limit your results to just IP addresses. (A complete list of available filters can be found here: https://falconpy.io/Service-Collections/Intel.html#queryintelindicatorentities)

result = intel.query_indicator_entities(filter="type:'ip_address'")

# OR

result = intel.query_indicator_entities(filter="type:'ip_address_block'")

Uber class would do the same thing with slightly different syntax:

result = falcon.command("QueryIntelIndicatorEntities", filter="type:'ip_address'")