CrowdStrike Falcon CrowdStrike Subreddit

Using the Cloud Azure Registration service collection

Uber class support Service class support Documentation Version Page Updated

Table of Contents

Operation IDDescription
cloud_registration_azure_create_registration
PEP 8create_registration
Create an Azure registration for a tenant.
cloud_registration_azure_delete_legacy_subscription
PEP 8delete_legacy_subscription
Delete existing legacy Azure subscriptions.
cloud_registration_azure_delete_registration
PEP 8delete_registration
Deletes existing Azure registrations.
cloud_registration_azure_download_script
PEP 8download_script
Retrieve script to create resources
cloud_registration_azure_get_registration
PEP 8get_registration
Retrieve existing Azure registration for a tenant.
cloud_registration_azure_trigger_health_check
PEP 8health_check
Trigger health check scan for Azure registrations
cloud_registration_azure_update_registration
PEP 8update_registration
Update an existing Azure registration for a tenant.
cloud_registration_azure_validate_registration
PEP 8validate_registration
Validate an Azure registration by checking service principal, role assignments and deployment stack
download_azure_script
PEP 8deployment_script
Download Azure deployment script (Terraform or Bicep)

Passing credentials

WARNING

client_id and client_secret are keyword arguments that contain your CrowdStrike API credentials. Please note that all examples below do not hard code these values. (These values are ingested as strings.)

CrowdStrike does not recommend hard coding API credentials or customer identifiers within source code.

cloud_registration_azure_get_registration

Retrieve existing Azure registration for a tenant.

PEP8 method name

get_registration

Endpoint

MethodRoute
GET/cloud-security-registration-azure/entities/registrations/v1

Required Scope

cloud-azure-registration:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
tenant_idService Class SupportUber Class SupportquerystringTenant ID
parametersService Class SupportUber Class SupportquerydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CloudAzureRegistration

# Do not hardcode API credentials!
falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.get_registration(tenant_id="string")
print(response)
Service class example (Operation ID syntax)
from falconpy import CloudAzureRegistration

# Do not hardcode API credentials!
falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.cloud_registration_azure_get_registration(tenant_id="string")
print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cloud_registration_azure_get_registration", tenant_id="string")
print(response)

cloud_registration_azure_create_registration

Create an Azure registration for a tenant.

PEP8 method name

create_registration

Endpoint

MethodRoute
POST/cloud-security-registration-azure/entities/registrations/v1

Required Scope

cloud-azure-registration:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
bodyService Class SupportUber Class SupportbodydictionaryFull body payload in JSON format.
account_typeService Class SupportUber Class SupportbodystringAzure account type.
tenant_idService Class SupportUber Class SupportbodystringAzure tenant ID.
subscription_idsService Class SupportUber Class Supportbodystring or list of stringsAzure subscription IDs.

Usage

Service class example (PEP8 syntax)
from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.create_registration(tenant_id="string", 
                                     account_type="string", 
                                     subscription_ids=["string1", "string2"])

print(response)
Service class example (Operation ID syntax)
from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_create_registration(tenant_id="string", 
                                                             account_type="string", 
                                                             subscription_ids=["string1", "string2"])

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body = {
    "resource": {
        "tenant_id": "string",
        "account_type": "string",
        "subscription_ids": ["string1", "string2"]
    }
}

response = falcon.command("cloud_registration_azure_create_registration", body=body_payload)

print(response)

cloud_registration_azure_update_registration

Update an existing Azure registration for a tenant.

PEP8 method name

update_registration

Endpoint

MethodRoute
PATCH/cloud-security-registration-azure/entities/registrations/v1

Required Scope

cloud-azure-registration:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
bodyService Class SupportUber Class SupportbodydictionaryFull body payload in JSON format.
account_typeService Class SupportUber Class SupportbodystringAzure account type.
tenant_idService Class SupportUber Class SupportbodystringAzure tenant ID.
subscription_idsService Class SupportUber Class Supportbodystring or list of stringsAzure subscription IDs.

Usage

Service class example (PEP8 syntax)
from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.update_registration(tenant_id="string", 
                                     account_type="string", 
                                     subscription_ids=["string1", "string2"])

print(response)
Service class example (Operation ID syntax)
from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_update_registration(tenant_id="string", 
                                                             account_type="string", 
                                                             subscription_ids=["string1", "string2"])

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body = {
    "resource": {
        "tenant_id": "string",
        "account_type": "string",
        "subscription_ids": ["string1", "string2"]
    }
}

response = falcon.command("cloud_registration_azure_update_registration", body=body_payload)

print(response)

cloud_registration_azure_delete_registration

Deletes existing Azure registrations.

PEP8 method name

delete_registration

Endpoint

MethodRoute
DELETE/cloud-security-registration-azure/entities/registrations/v1

Required Scope

cloud-azure-registration:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
tenant_idsService Class SupportUber Class Supportquerystring or list of stringsAzure tenant IDs
parametersService Class SupportUber Class SupportquerydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.delete_registration(tenant_ids=["string1", "string2"])

print(response)
Service class example (Operation ID syntax)
from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_delete_registration(tenant_ids=["string1", "string2"])

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("cloud_registration_azure_delete_registration", tenant_ids=["string1", "string2"])

print(response)

download_azure_script

Download Azure deployment script (Terraform or Bicep)

PEP8 method name

deployment_script

Endpoint

MethodRoute
GET/cloud-security-registration-azure/entities/scripts/v1

Required Scope

cloud-azure-registration:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
tenant_idService Class SupportUber Class SupportquerystringAzure tenant ID
parametersService Class SupportUber Class SupportquerydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.deployment_script(tenant_id="string")

print(response)
Service class example (Operation ID syntax)
from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.download_azure_script(tenant_id="string")

print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("download_azure_script", tenant_id="string")

print(response)

Back to Table of Contents

cloud_registration_azure_download_script

Retrieve script to create resources

PEP8 method name

download_script

Endpoint

MethodRoute
POST/cloud-security-registration-azure/entities/scripts/v1

Required Scope

cloud-azure-registration:write

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
bodyService Class SupportUber Class SupportbodydictionaryFull body payload in JSON format.
tenant_idService Class SupportUber Class SupportbodystringAzure tenant ID.

Usage

Service class example (PEP8 syntax)
from falconpy import CloudAzureRegistration

# Do not hardcode API credentials!
falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.download_script(tenant_id="string")

print(response)
Service class example (Operation ID syntax)
from falconpy import CloudAzureRegistration

# Do not hardcode API credentials!
falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                                client_secret=CLIENT_SECRET
                                )

response = falcon.cloud_registration_azure_download_script(tenant_id="string")

print(response)
Uber class example
from falconpy import APIHarnessV2

# Do not hardcode API credentials!
falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "resources": [
        {
            "tenantId": "string"
        }
    ]
}

response = falcon.command("cloud_registration_azure_download_script", body=body_payload)

print(response)

GetAzureInstallationToken

Gets Azure installation token.

PEP8 method name

get_azure_installation_token

Endpoint

MethodRoute
GET/cloud-security-registration-azure/entities/installation-tokens/v1

Required Scope

cloud-azure-registration:read

Content-Type

  • Consumes: application/json
  • Produces: application/json

Keyword Arguments

NameServiceUberTypeData typeDescription
tenant_idService Class SupportUber Class SupportquerystringAzure tenant ID to retrieve installation token for
parametersService Class SupportUber Class SupportquerydictionaryFull query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)
from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.get_azure_installation_token(tenant_id="string")
print(response)
Service class example (Operation ID syntax)
from falconpy import CloudAzureRegistration

falcon = CloudAzureRegistration(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.GetAzureInstallationToken(tenant_id="string")
print(response)
Uber class example
from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("GetAzureInstallationToken", tenant_id="string")
print(response)