DELETE /iocs/entities/indicators/v1

[Sylverd]

Anyone can help me identify what values I need to add? I can't understand where the hash goes or how to add several hashes to delete, I don't know where to find the IDs either.

i using this code

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
 client_secret=CLIENT_SECRET
 )

id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("indicator_delete_v1",
 filter="string",
 from_parent=boolean,
 comment="string",
 ids=id_list
 )

print(response)

[crowdstrikedcs]

Hi @Sylverd thanks for the question!

When browsing the Falcon Console, you can view the "IOC Management" dashboard here each of these records has a unique "ID" that will be used in your id_list above.

To get these values over API I recommend using the indicator_combined operation found here. This operation allows you to query and view details for indicators in your account.You may additionally for those indicators of a specified type or value. For Example here is a sample response:

You can see this indicator has a type and value (cnn.com & domain) as well as an id which will be used to delete from your operation above. Here is an example:

id_list = '0309d21b61b2682893a85d15394731a068d87ec221d73d8ea47a9b6d38565798'
response = falcon.command("indicator_delete_v1", ids=id_list)

print(response)

Try this out and let us know if you have any additional questions.

[Sylverd]

Hi @crowdstrikedcs

Thank you so much for the support it was very helpful

Regards!