func _getCrowdStrikeIOCID(iocStr string, client *client.CrowdStrikeAPISpecification) (id string, err error) {
	fql := fmt.Sprintf(`value:"%s"`, iocStr)
	params := ioc.NewIndicatorSearchV1Params().WithFilter(&fql)
	res, err := client.Ioc.IndicatorSearchV1(params)
	if err != nil {
		return "", err
	}
	if err = falcon.AssertNoError(res.GetPayload().Errors); err != nil {
		return "", err
	}
	resources := res.GetPayload().Resources
	if len(resources) != 1 {
		return "", errors.New("IOC not found: " + iocStr)
	}
	return resources[0], nil
}
searchCrowdStrikeIOC searches custom IOCs for an IOC and returns an id if found.
if no IOC is found, an empty string is returned
package main
import (
	"context"
	"errors"
	"flag"
	"fmt"
	"os"
	"regexp"
	"time"
	"github.com/crowdstrike/gofalcon/falcon"
	"github.com/go-openapi/strfmt"
	"github.com/crowdstrike/gofalcon/falcon/client"
	"github.com/crowdstrike/gofalcon/falcon/client/ioc"
	"github.com/crowdstrike/gofalcon/falcon/models"
	"github.com/crowdstrike/gofalcon/pkg/falcon_util"
)
func getCrowdstrikeIOCs(client *client.CrowdStrikeAPISpecification) ([]string, error) {
	iocs := []string{}
	var limit, offset, total int64
	limit = 2000
	offset = 0
	total = 0
	for offset <= total {
		params := ioc.NewIndicatorCombinedV1Params().WithDefaults()
		params.SetOffset(&offset)
		params.SetLimit(&limit)
		res, err := client.Ioc.IndicatorCombinedV1(params)
		if err != nil {
			return []string{}, err
		}
		if err = falcon.AssertNoError(res.GetPayload().Errors); err != nil {
			return []string{}, err
		}
		for _, ioc := range res.GetPayload().Resources {
			iocs = append(iocs, ioc.Value)
		}
		total = *res.GetPayload().Meta.Pagination.Total
		offset += limit
	}
	return iocs, nil
}
func getIOCType(iocStr string) (string, error) {
	var RegexIPv4 = regexp.MustCompile(`^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)){3}$`)
	var RegexIPv6 = regexp.MustCompile(`(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))`)
	var RegexURL = regexp.MustCompile(`^https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()!@:%_\+.~#?&\/\/=]*)$`)
	var RegexDomain = regexp.MustCompile(`(([a-zA-Z]{1})|([a-zA-Z]{1}[a-zA-Z]{1})|([a-zA-Z]{1}[0-9]{1})|([0-9]{1}[a-zA-Z]{1})|([a-zA-Z0-9][a-zA-Z0-9-_]{1,61}[a-zA-Z0-9]))\.([a-zA-Z]{2,6}|[a-zA-Z0-9-]{2,30}\.[a-zA-Z]{2,3})`)
	var RegexEmail = regexp.MustCompile(`^(([^<>()\[\]\\.,;:\s@"]+(\.[^<>()\[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$`)
	var RegexMD5 = regexp.MustCompile(`^[a-f0-9]{32}$`)
	var RegexSHA256 = regexp.MustCompile(`^[a-f0-9]{64}$`)
	switch {
	case RegexEmail.MatchString(iocStr):
		return "", errors.New("email is an unsupported IOC type")
	case RegexURL.MatchString(iocStr):
		return "", errors.New("URLs are an unsupported IOC type")
	case RegexDomain.MatchString(iocStr):
		return "domain", nil
	case RegexIPv4.MatchString(iocStr):
		return "ipv4", nil
	case RegexIPv6.MatchString(iocStr):
		return "ipv6", nil
	case RegexMD5.MatchString(iocStr):
		return "md5", nil
	case RegexSHA256.MatchString(iocStr):
		return "sha256", nil
	default:
		return "", errors.New("unknown IOC type")
	}
}
func addCrowdStrikeIOCs(iocs []string, description string, client *client.CrowdStrikeAPISpecification) error {
	body := models.APIIndicatorCreateReqsV1{}
	for _, iocStr := range iocs {
		iocType, err := getIOCType(iocStr)
		if err != nil {
			return err
		}
		action := "detect"
		if iocType == "md5" || iocType == "sha256" {
			action = "prevent"
		}
		truth := true
		body.Indicators = append(body.Indicators, &models.APIIndicatorCreateReqV1{
			AppliedGlobally: &truth,
			Type:            iocType,   
			Action:          action,    
			Severity:        "medium",  
			Description:     description,
			Platforms:       []string{"windows", "mac", "linux"},
			Value:           iocStr,
			Expiration:      strfmt.DateTime(time.Now().Add(24 * time.Hour * 365 * 10)),
		})
	}
	params := ioc.NewIndicatorCreateV1Params().WithBody(&body)
	t := true
	params.SetRetrodetects(&t)
	_, err := client.Ioc.IndicatorCreateV1(params)
	if err != nil {
		return err
	}
	return nil
}
func addCrowdStrikeIOC(iocStr string, description string, client *client.CrowdStrikeAPISpecification) error {
	return addCrowdStrikeIOCs([]string{iocStr}, description, client)
}