def get_query_filter():
    """
    returns the query filter to be used to extract indicators of compromise from the crowdstrike api
    """

    indicator_type_filter = parse_indicator_type_filter()
    marker_filter = CrowdStrike_State.get()
    if marker_filter is None:
        look_back_date = get_look_back_date()
        query_filter = f"({indicator_type_filter})+(last_updated:>'{look_back_date}')"
    else:
        query_filter = f"({indicator_type_filter})+(_marker:>'{marker_filter}')+(malicious_confidence:'high')"

    return query_filter

    returns the query filter to be used to extract indicators of compromise from the crowdstrike api
    
Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/CrowdStrikeFalconAdversaryIntelligence/CrowdStrikeFalconThreatIntelConnector/__init__.py