Threat Graph

The Threat Graph API provides access to CrowdStrike’s ThreatGraph, a unified view of security events and their relationships across your environment. ThreatGraph connects detections, processes, files, network connections, and other entities to reveal attack patterns and lateral movement.

Overview

Falcon ThreatGraph enables:

Entity relationship mapping: Understand connections between processes, files, users, and network activity
Threat investigation: Trace attack paths and identify compromised systems
Lateral movement detection: Discover how threats spread across your environment
Indicator analysis: Find hosts where specific indicators have been observed

ThreatGraph uses a vertex-and-edge model where entities (vertexes) are connected by relationships (edges).

Vertexes

Vertexes represent entities like processes, files, domains, devices, detections, and users.

Get vertex details

Get-FalconThreatGraphVertex

Get-FalconThreatGraphVertex -Id <string[]> [-VertexType <string>] [-Scope <string>] [-Nano <boolean>] [-IncludeEdge]

string[]

required

Vertex identifier(s)

VertexType

string

Vertex type (default: any-vertex). Options include:

process, processes - Process execution
detection, detections - Security detections
device, devices - Endpoint devices
domain, domains - DNS domains
ipv4, ipv6 - IP addresses
indicator, indicators - Threat indicators
user, users - User accounts
file, extracted-files - Files
module, modules - Loaded modules/libraries
command-lines - Command line executions
incident, incidents - Security incidents
hunting-leads - Threat hunting leads
And many more (see full list in source)

Scope

string

Scope of the request. Options: cspm, customer, cwpp, device, global

Nano

boolean

Return nano-precision entity timestamps

IncludeEdge

switch

Include a brief list of connected edges

Example: Get process details with connected edges

Get-FalconThreatGraphVertex -Id "ind:abc123:1234567890" -VertexType process -IncludeEdge

Edges

Edges represent relationships between vertexes, such as “process spawned process” or “process connected to domain”.

List available edge types

Get-FalconThreatGraphEdge

Example output: Edge types like spawned_process, read_file, wrote_file, dns_request, network_connection

Get edges for a vertex

Get-FalconThreatGraphEdge

Get-FalconThreatGraphEdge -Id <string> -EdgeType <string> [-Scope <string>] [-Direction <string>] [-Nano <boolean>] [-Limit <int32>] [-Offset <string>] [-All] [-Total]

string

required

Vertex identifier

EdgeType

string

required

Edge type to retrieve (e.g., spawned_process, dns_request, network_connection)

Scope

string

Scope of the request. Options: cspm, customer, cwpp, device, global

Direction

string

Edge direction to filter results

Nano

boolean

Return nano-precision entity timestamps

Limit

int32

Maximum number of results per request (1-100, default: 100)

Offset

string

Position to begin retrieving results

All

switch

Repeat requests until all available results are retrieved

Total

switch

Display total result count instead of results

Example: Get all child processes

Get-FalconThreatGraphEdge -Id "ind:abc123:1234567890" -EdgeType spawned_process -All

Indicator Searches

Search for hosts with an indicator

Get-FalconThreatGraphIndicator

Get-FalconThreatGraphIndicator -Type <string> -Value <string> [-Nano <boolean>] [-Limit <int32>] [-Offset <string>] [-All] [-Total]

Type

string

required

Indicator type. Options: domain, ipv4, ipv6, md5, sha1, sha256

Value

string

required

Indicator value (e.g., domain name, IP address, file hash)

Nano

boolean

Return nano-precision entity timestamps

Limit

int32

Maximum number of results per request (1-100, default: 100)

Offset

string

Position to begin retrieving results

All

switch

Repeat requests until all available results are retrieved

Total

switch

Display total result count instead of results

Example: Find hosts that contacted a domain

Get-FalconThreatGraphIndicator -Type domain -Value "malicious-domain.com" -All

Example: Find hosts with a file hash

Get-FalconThreatGraphIndicator -Type sha256 -Value "abc123def456..." -All

Example: Find hosts that connected to an IP

Get-FalconThreatGraphIndicator -Type ipv4 -Value "192.168.1.100" -All

Common Workflows

Investigate a detection

# Get detection vertex
$Detection = Get-FalconThreatGraphVertex -Id "ldt:abc123:1234567890" -VertexType detection -IncludeEdge

# Get associated process
$ProcessId = $Detection.edges | Where-Object { $_.edge_type -eq 'associated_process' } | Select-Object -ExpandProperty vertex_id
$Process = Get-FalconThreatGraphVertex -Id $ProcessId -VertexType process -IncludeEdge

# Get parent process
$ParentEdges = Get-FalconThreatGraphEdge -Id $ProcessId -EdgeType spawned_by -All
$ParentId = $ParentEdges.vertex_id
$Parent = Get-FalconThreatGraphVertex -Id $ParentId -VertexType process

Trace process execution chain

# Starting from a suspicious process
$ProcessId = "ind:abc123:1234567890"

# Get child processes
$Children = Get-FalconThreatGraphEdge -Id $ProcessId -EdgeType spawned_process -All

foreach ($Child in $Children) {
    $ChildDetails = Get-FalconThreatGraphVertex -Id $Child.vertex_id -VertexType process
    Write-Host "Child process: $($ChildDetails.process_name) - $($ChildDetails.command_line)"
}

Analyze network connections

# Get network connections from a process
$ProcessId = "ind:abc123:1234567890"
$Connections = Get-FalconThreatGraphEdge -Id $ProcessId -EdgeType network_connection -All

foreach ($Conn in $Connections) {
    $ConnDetails = Get-FalconThreatGraphVertex -Id $Conn.vertex_id -VertexType ipv4
    Write-Host "Connected to: $($ConnDetails.ip_address):$($ConnDetails.port)"
}

Hunt for lateral movement

# Find all hosts where a suspicious file hash was seen
$Hosts = Get-FalconThreatGraphIndicator -Type sha256 -Value "suspicious-hash-here" -All

foreach ($Host in $Hosts) {
    Write-Host "Found on device: $($Host.device_id) at $($Host.timestamp)"
    
    # Get device details
    $Device = Get-FalconThreatGraphVertex -Id $Host.device_id -VertexType device
    Write-Host "  Hostname: $($Device.hostname)"
    Write-Host "  Last seen: $($Device.last_seen)"
}

Investigate file operations

# Get files written by a process
$ProcessId = "ind:abc123:1234567890"
$WrittenFiles = Get-FalconThreatGraphEdge -Id $ProcessId -EdgeType wrote_file -All

foreach ($File in $WrittenFiles) {
    $FileDetails = Get-FalconThreatGraphVertex -Id $File.vertex_id -VertexType extracted_file
    Write-Host "Wrote file: $($FileDetails.file_path)"
    Write-Host "  SHA256: $($FileDetails.sha256)"
}

Map attack timeline

# Start with an incident
$IncidentId = "inc:abc123:1234567890"
$Incident = Get-FalconThreatGraphVertex -Id $IncidentId -VertexType incident -IncludeEdge

# Get all associated detections
$DetectionEdges = $Incident.edges | Where-Object { $_.edge_type -eq 'associated_detection' }

$Timeline = foreach ($Edge in $DetectionEdges) {
    $Detection = Get-FalconThreatGraphVertex -Id $Edge.vertex_id -VertexType detection
    [PSCustomObject]@{
        Timestamp = $Detection.timestamp
        Severity = $Detection.severity
        Tactic = $Detection.tactic
        Technique = $Detection.technique
        Description = $Detection.description
    }
}

$Timeline | Sort-Object Timestamp | Format-Table

Understanding Vertex Types

Common Vertex Types

Type	Description
`process`	Executing processes
`detection`	Security detections and alerts
`device`	Endpoint devices/hosts
`domain`	DNS domains
`ipv4`, `ipv6`	IP addresses
`indicator`	Threat indicators (IoCs)
`user`	User accounts and sessions
`extracted_file`	Files extracted for analysis
`module`	Loaded DLLs/libraries
`command_line`	Command line executions
`incident`	Security incidents
`hunting_lead`	Threat hunting leads

Common Edge Types

Edge Type	Description
`spawned_process`	Parent-child process relationship
`spawned_by`	Reverse of spawned_process
`dns_request`	DNS query made by process
`network_connection`	Network connection established
`wrote_file`	File written by process
`read_file`	File read by process
`loaded_module`	DLL/library loaded by process
`associated_detection`	Detection linked to entity
`associated_process`	Process linked to detection

Requires Threatgraph: Read permission.

Use nano-precision timestamps when you need exact correlation between events occurring in rapid succession.

Overview

Authentication

Alerts & Detections

Host Management

Real-time Response

Threat Intelligence

Policy Management

Cloud Security

Identity & Access

Security Operations

Monitoring & Analysis

Utilities

Overview

Vertexes

Get vertex details

Edges

List available edge types

Get edges for a vertex

Indicator Searches

Search for hosts with an indicator

Common Workflows

Investigate a detection

Trace process execution chain

Analyze network connections

Hunt for lateral movement

Investigate file operations

Map attack timeline

Understanding Vertex Types

Common Vertex Types

Common Edge Types

Build docs developers (and LLMs) love

Overview

Authentication

Alerts & Detections

Host Management

Real-time Response

Threat Intelligence

Policy Management

Cloud Security

Identity & Access

Security Operations

Monitoring & Analysis

Utilities

​Overview

​Vertexes

​Get vertex details

​Edges

​List available edge types

​Get edges for a vertex

​Indicator Searches

​Search for hosts with an indicator

​Common Workflows

​Investigate a detection

​Trace process execution chain

​Analyze network connections

​Hunt for lateral movement

​Investigate file operations

​Map attack timeline

​Understanding Vertex Types

​Common Vertex Types

​Common Edge Types

Build docs developers (and LLMs) love

Overview

Vertexes

Get vertex details

Edges

List available edge types

Get edges for a vertex

Indicator Searches

Search for hosts with an indicator

Common Workflows

Investigate a detection

Trace process execution chain

Analyze network connections

Hunt for lateral movement

Investigate file operations

Map attack timeline

Understanding Vertex Types

Common Vertex Types

Common Edge Types