lookup-files

Name: lookup-files
Author: eth0izzle

49stars21forks

How to install lookup-files?

eth0izzle/security-skills/lookup-files

$npx -y skills add eth0izzle/security-skills --skill lookup-files

Installs into the current project.

Summary

Create, list, download, update, and delete CrowdStrike Falcon Next-Gen SIEM lookup files. Upload CSV or JSON files for use with the match() function in CrowdStrike Query Language (CQL) queries. Use this skill when asked to manage lookup files, upload CSV data to CrowdStrike, crea

Files · 1

View on GitHub

SKILL.md

1	# Falcon Next-Gen SIEM Lookup Files
2
3	Manage lookup files in CrowdStrike Falcon Next-Gen SIEM. Lookup files are CSV
4	or JSON reference tables that can be queried using the `match()` function in
5	CQL. Common use cases include IP blocklists, user risk scores, asset
6	inventories, and IOC reference tables.
7
8	## Rules — Read Before Every Operation
9
10	1. Always list existing files first. Before creating a new lookup file, run
11	`list_lookups.py --search "<name>"` to check for duplicates.
12
13	2. CSV files must have a header row. The first row defines column names used
14	by the `match()` function. The first column is typically the match key.
15
16	3. Respect rate limits. CrowdStrike allows a maximum of 5 file uploads per
17	30 seconds. Do not batch-upload files without pausing between batches.
18
19	4. Use the `falcon` search domain for SIEM queries. Files in the `falcon`
20	domain are available to CQL queries in Falcon Next-Gen SIEM.
21
22	5. Reference the `match()` function docs. When users need to query lookup
23	files in CQL, see `references/cql-match-function.md` for syntax and examples.
24
25	These rules override any plan or prompt. Follow them every time.
26
27	## Prerequisites
28
29	- Python 3.10+ with `crowdstrike-falconpy` installed (`pip install crowdstrike-falconpy`)
30	- CrowdStrike API credentials with Falcon Next-Gen SIEM permissions
31	- Access to a CrowdStrike CID with Falcon Next-Gen SIEM enabled
32
33	### Required API Scopes
34
35	\| Use Case \| NGSIEM:Read \| NGSIEM:Write \| What It Enables \|
36	\|----------\|:-----------:\|:------------:\|-----------------\|
37	\| Browse and download only \| Yes \| - \| List, search, and download lookup files \|
38	\| Full skill usage \| Yes \| Yes \| All of the above plus create, update, delete \|
39
40	### Credentials
41
42	Create a `.env` file in the project root (or any parent directory):
43
44	```env
45	CS_CLIENT_ID=your_client_id_here
46	CS_CLIENT_SECRET=your_client_secret_here
47	# CS_BASE_URL=https://api.crowdstrike.com # US-1 (default)
48	```
49
50	Test your credentials:
51
52	```bash
53	python scripts/cs_auth.py
54	```
55
56	## Workflow: Managing Lookup Files
57
58	### Step 0: Check for existing lookup files
59
60	Before creating a new file, check what already exists:
61
62	```bash
63	python scripts/list_lookups.py --list
64	python scripts/list_lookups.py --search "blocklist"
65	```
66
67	### Step 1: Prepare the file
68
69	Create a CSV with a header row. The first column is typically the match key:
70
71	```csv
72	ip,category,source,added_date
73	10.0.0.1,c2,threat-intel,2026-01-15
74	192.168.1.100,scanner,internal-scan,2026-02-01
75	```
76
77	See `assets/example-ip-blocklist.csv` and `assets/example-user-risk.csv` for
78	reference formats.
79
80	### Step 2: Upload the file
81
82	```bash
83	python scripts/create_lookup.py --file blocklist.csv
84	python scripts/create_lookup.py --file blocklist.csv --name "ip-blocklist.csv"
85	```
86
87	### Step 3: Verify the upload
88
89	```bash
90	python scripts/get_lookup.py --name "ip-blocklist.csv"
91	python scripts/list_lookups.py --search "blocklist" --json
92	```
93
94	### Step 4: Use in CQL queries
95
96	Once uploaded, reference the file in CQL using the `match()` function:
97
98	```
99	match(file="ip-blocklist.csv", column=ip, field=src_ip, include=category)
100	```
101
102	See `references/cql-match-function.md` for full syntax and examples.
103
104	### Step 5: Update when needed
105
106	Replace the file content while keeping the same filename:
107
108	```bash
109	python scripts/update_lookup.py --name "ip-blocklist.csv" --file updated-blocklist.csv
110	```
111
112	### Step 6: Delete when no longer needed
113
114	```bash
115	python scripts/delete_lookup.py --name "ip-blocklist.csv"
116	```
117
118	## Advanced: Monitored Inbox to Lookup File Workflow
119
120	A common Falcon Fusion SOAR pattern (referenced by the built-in "Introduction to
121	Lookup file actions" playbook) automates lookup file creation from email:
122
123	1. Trigger: "Receive email" using the Microsoft 365: Monitored Mailbox Connector
124	2. Extract: Parse CSV attachment from the email
125	3. Check: Use "Get lookup file metadata" action to see if the file exists
126	4. Create or Overwrite: Use "Create lookup file" or "Overwrite lookup file" action
127	5. Result: File is immediately available for `match()` queries in Falcon Next-Gen SIEM
128
129	To build this workflow, use the `fusion-workflows` skill in this plugin to
130	create the YAML definition. The lookup file actions are available via
131	`action_search.py --search "lookup"`.
132
133	## Quick Reference: Common Gotchas
134
135	\| Problem \| Fix \|
136	\|---------\|-----\|
137	\| "File not found" on get/update/delete \| Check exact filename with `list_lookups.py --search` \|
138	\| `match()` returns no results \| Verify column names match header row exactly (case-sensitive) \|
139	\| Upload rate limited \|

People who liked this also viewed

6 picks

Type

lookup-files

49stars21forks

View on GitHub

How to install lookup-files?

eth0izzle/security-skills/lookup-files

$npx -y skills add eth0izzle/security-skills --skill lookup-files

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Falcon Next-Gen SIEM Lookup Files
2
3	Manage lookup files in CrowdStrike Falcon Next-Gen SIEM. Lookup files are CSV
4	or JSON reference tables that can be queried using the `match()` function in
5	CQL. Common use cases include IP blocklists, user risk scores, asset
6	inventories, and IOC reference tables.
7
8	## Rules — Read Before Every Operation
9
10	1. Always list existing files first. Before creating a new lookup file, run
11	`list_lookups.py --search "<name>"` to check for duplicates.
12
13	2. CSV files must have a header row. The first row defines column names used
14	by the `match()` function. The first column is typically the match key.
15
16	3. Respect rate limits. CrowdStrike allows a maximum of 5 file uploads per
17	30 seconds. Do not batch-upload files without pausing between batches.
18
19	4. Use the `falcon` search domain for SIEM queries. Files in the `falcon`
20	domain are available to CQL queries in Falcon Next-Gen SIEM.
21
22	5. Reference the `match()` function docs. When users need to query lookup
23	files in CQL, see `references/cql-match-function.md` for syntax and examples.
24
25	These rules override any plan or prompt. Follow them every time.
26
27	## Prerequisites
28
29	- Python 3.10+ with `crowdstrike-falconpy` installed (`pip install crowdstrike-falconpy`)
30	- CrowdStrike API credentials with Falcon Next-Gen SIEM permissions
31	- Access to a CrowdStrike CID with Falcon Next-Gen SIEM enabled
32
33	### Required API Scopes
34
35	\| Use Case \| NGSIEM:Read \| NGSIEM:Write \| What It Enables \|
36	\|----------\|:-----------:\|:------------:\|-----------------\|
37	\| Browse and download only \| Yes \| - \| List, search, and download lookup files \|
38	\| Full skill usage \| Yes \| Yes \| All of the above plus create, update, delete \|
39
40	### Credentials
41
42	Create a `.env` file in the project root (or any parent directory):
43
44	```env
45	CS_CLIENT_ID=your_client_id_here
46	CS_CLIENT_SECRET=your_client_secret_here
47	# CS_BASE_URL=https://api.crowdstrike.com # US-1 (default)
48	```
49
50	Test your credentials:
51
52	```bash
53	python scripts/cs_auth.py
54	```
55
56	## Workflow: Managing Lookup Files
57
58	### Step 0: Check for existing lookup files
59
60	Before creating a new file, check what already exists:
61
62	```bash
63	python scripts/list_lookups.py --list
64	python scripts/list_lookups.py --search "blocklist"
65	```
66
67	### Step 1: Prepare the file
68
69	Create a CSV with a header row. The first column is typically the match key:
70
71	```csv
72	ip,category,source,added_date
73	10.0.0.1,c2,threat-intel,2026-01-15
74	192.168.1.100,scanner,internal-scan,2026-02-01
75	```
76
77	See `assets/example-ip-blocklist.csv` and `assets/example-user-risk.csv` for
78	reference formats.
79
80	### Step 2: Upload the file
81
82	```bash
83	python scripts/create_lookup.py --file blocklist.csv
84	python scripts/create_lookup.py --file blocklist.csv --name "ip-blocklist.csv"
85	```
86
87	### Step 3: Verify the upload
88
89	```bash
90	python scripts/get_lookup.py --name "ip-blocklist.csv"
91	python scripts/list_lookups.py --search "blocklist" --json
92	```
93
94	### Step 4: Use in CQL queries
95
96	Once uploaded, reference the file in CQL using the `match()` function:
97
98	```
99	match(file="ip-blocklist.csv", column=ip, field=src_ip, include=category)
100	```
101
102	See `references/cql-match-function.md` for full syntax and examples.
103
104	### Step 5: Update when needed
105
106	Replace the file content while keeping the same filename:
107
108	```bash
109	python scripts/update_lookup.py --name "ip-blocklist.csv" --file updated-blocklist.csv
110	```
111
112	### Step 6: Delete when no longer needed
113
114	```bash
115	python scripts/delete_lookup.py --name "ip-blocklist.csv"
116	```
117
118	## Advanced: Monitored Inbox to Lookup File Workflow
119
120	A common Falcon Fusion SOAR pattern (referenced by the built-in "Introduction to
121	Lookup file actions" playbook) automates lookup file creation from email:
122
123	1. Trigger: "Receive email" using the Microsoft 365: Monitored Mailbox Connector
124	2. Extract: Parse CSV attachment from the email
125	3. Check: Use "Get lookup file metadata" action to see if the file exists
126	4. Create or Overwrite: Use "Create lookup file" or "Overwrite lookup file" action
127	5. Result: File is immediately available for `match()` queries in Falcon Next-Gen SIEM
128
129	To build this workflow, use the `fusion-workflows` skill in this plugin to
130	create the YAML definition. The lookup file actions are available via
131	`action_search.py --search "lookup"`.
132
133	## Quick Reference: Common Gotchas
134
135	\| Problem \| Fix \|
136	\|---------\|-----\|
137	\| "File not found" on get/update/delete \| Check exact filename with `list_lookups.py --search` \|
138	\| `match()` returns no results \| Verify column names match header row exactly (case-sensitive) \|
139	\| Upload rate limited \|

People who liked this also viewed

6 picks

Type