Hey folks, I've been diving into CrowdStrike's intel feeds lately, trying to tighten up our cloud security monitoring. The sheer volume of IOCs is impressive, but it's a bit like drinking from a firehose. I'm specifically trying to filter for threats targeting our AWS and Azure environments.
I've been poking around the Falcon platform and the API. There's a ton of generic malware and phishing indicators, which are useful, but I want to surface things like suspicious CloudTrail event patterns, malicious IAM role ARNs, or crypto-mining scripts that target cloud APIs. Has anyone built a reliable filter for this?
For instance, I tried using the `type` and `tags` fields in a query, but I'm not sure I'm using the right taxonomy. Something like this:
```python
# Example of my basic API filter attempt
params = {
'filter': "type:'malware' AND tags:'cloud'",
'limit': 50
}
```
This still brings back a lot of non-cloud-specific stuff. Are there specific threat actors or report names I should be watching for? Or maybe a better approach is to pull the feed and then filter locally using the `labels` or `mitre_techniques` fields?
I'm also curious if anyone has integrated this filtered intel into their observability stack—like creating Prometheus alerts based on IOC matches in cloud logs, or visualizing threat actor campaigns in Grafana. Would love to hear about your workflows or any pitfalls you've hit.