CrowdStrike Operators

Anomali supports integration with CrowdStrike services, enabling you to access CrowdStrike data through Anomali Search. Refer to Integration with CrowdStrike for instructions on activating the integration.

After the integration is activated, you can use the following operators to query CrowdStrike data in Anomali Search:

• cs_query_alerts

  Note: The cs_query_alerts operator replaces the cs_query_detects operator, which is now deprecated. See Migration for migration details.

• cs_get_alert_entities

  Note: The cs_get_alert_entities operator replaces the cs_get_detect_summaries operator, which is not deprecated. See Migration for migration details.

• cs_query_device

• cs_get_system_info

• cs_get_process_detail

• cs_hunt_ip

• cs_hunt_domain

• cs_hunt_file

• cs_list_users